3 Commits

Author	SHA1	Message	Date
Yaowei Zheng	e015d9e591	fix(desktop): Workspace HTML previews (render view and new window) (#189) ... Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-04 18:10:46 +08:00
Yaowei Zheng	6b8b631e37	fix(web): use the separate-origin preview for in-app HTML rendering (#59) ... Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 14:52:25 +08:00
Yaowei Zheng	b18ae8f5f1	feat(server,web): serve Workspace HTML previews from a separate origin (#46) ... Serve "open in new tab" HTML previews from a separate origin (the loopback counterpart, or PENGUIN_PREVIEW_ORIGIN) with a signed, host-bound token, so localStorage/cookies/third-party embeds work while Agent-generated pages stay off the app origin. The app is canonicalized onto localhost and the preview host (127.0.0.1) serves only /preview/* — its /api answers 401 and app routes 302 to the canonical host — so the preview origin can neither set nor honor a session cookie.	2026-07-23 23:11:04 +08:00