From 49b68183a70bb7ee44471d78216b9095d38f2c36 Mon Sep 17 00:00:00 2001
From: liugddx <liugddx@gmail.com>
Date: Sat, 10 Oct 2026 09:58:47 +0800
Subject: [PATCH] fix(desktop): correct the preview loopback boundary and pin
 its boot wiring

Two follow-ups from the #5254 review.

The loopback_endpoint boundary said an answer did not prove "that the
embedded browser shares this loopback namespace". It does: the embedded
browser runs in the Desktop process. What a verified answer does not prove
is that, with a remote (SSH) Runtime Host, the listener on the Desktop
machine is the server the agent started. Say that instead, and assert it.

Desktop boot publishing the preflight in the desktop_artifact_preview
offer had no test, so boot could stop wiring it without any test failing.
Pin it from source, as main-startup-lifetime.test.ts does for other boot
contracts.

Refs #5254.

Generated-by: Claude Code
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../main/__tests__/preview-preflight.test.ts  | 23 +++++++++++++++++++
 apps/desktop/src/main/preview-preflight.ts    |  2 +-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/apps/desktop/src/main/__tests__/preview-preflight.test.ts b/apps/desktop/src/main/__tests__/preview-preflight.test.ts
index 7a434ed356..62cd8be124 100644
--- a/apps/desktop/src/main/__tests__/preview-preflight.test.ts
+++ b/apps/desktop/src/main/__tests__/preview-preflight.test.ts
@@ -25,9 +25,11 @@
  */
 
 import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
 import { createServer, type Server } from 'node:http';
 import type { Socket } from 'node:net';
 import { after, describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
 import type { MakaTool, MakaToolContext } from '@maka/runtime/tool-runtime';
 import { parseNavigable } from '../browser/logic.js';
 import {
@@ -160,6 +162,9 @@ describe('preview preflight capability classification', () => {
     assert.equal(capability.status, 'verified');
     assert.match(capability.evidence, /HTTP 404/u);
     assert.match(capability.boundary ?? '', /not that any particular page exists there/u);
+    // A remote Runtime Host's server and the Desktop loopback are different machines.
+    assert.match(capability.boundary ?? '', /on the Desktop machine/u);
+    assert.match(capability.boundary ?? '', /Runtime Host runs remotely/u);
   });
 
   it('never turns a failed connection into an unsupported capability', () => {
@@ -311,6 +316,24 @@ describe('artifact preview offer', () => {
     const named = names.filter((name) => ARTIFACT_PREVIEW_HANDOFF.includes(name));
     assert.deepEqual(named, ['ArtifactPreview']);
   });
+
+  it('is the toolset Desktop boot publishes for the artifact preview offer', () => {
+    // Boot cannot be constructed in a unit test, so pin its wiring from source,
+    // as main-startup-lifetime.test.ts does for other boot contracts. Without
+    // this, boot could stop publishing the preflight and no test would fail.
+    const boot = readFileSync(
+      fileURLToPath(new URL('../../../src/main/runtime-host-boot.ts', import.meta.url)),
+      'utf8',
+    );
+    const offer = boot.indexOf("offerId: 'desktop_artifact_preview'");
+    const next = boot.indexOf('offerId:', offer + 1);
+    assert.ok(offer >= 0 && next > offer, 'boot declares the desktop_artifact_preview offer');
+    assert.match(
+      boot.slice(offer, next),
+      /tools: buildArtifactPreviewOfferTools\(\{\s*preflight: createPreviewPreflightAuthority\(\),/u,
+      'the offer publishes the preflight from the production authority',
+    );
+  });
 });
 
 describe('preview preflight loopback probe', () => {
diff --git a/apps/desktop/src/main/preview-preflight.ts b/apps/desktop/src/main/preview-preflight.ts
index bdab08627d..018bd5182f 100644
--- a/apps/desktop/src/main/preview-preflight.ts
+++ b/apps/desktop/src/main/preview-preflight.ts
@@ -250,7 +250,7 @@ export function classifyLoopbackEndpoint(input: {
       status: 'verified',
       evidence: `HEAD / at ${input.origin} answered with HTTP ${probe.status} to the Desktop main process.`,
       boundary:
-        'An answer proves a listener at this origin and nothing more: not that any particular page exists there, not that it loads, and not that the embedded browser shares this loopback namespace.',
+        'An answer proves a listener at this origin on the Desktop machine and nothing more: not that any particular page exists there, not that it loads, and, when the Runtime Host runs remotely, not that the listener is the server the agent started.',
     };
   }
   // The rule this whole tool exists for: a connection outcome can produce