Files

T

Yaowei Zheng b18ae8f5f1 feat(server,web): serve Workspace HTML previews from a separate origin (#46 )

Serve "open in new tab" HTML previews from a separate origin (the loopback counterpart, or PENGUIN_PREVIEW_ORIGIN) with a signed, host-bound token, so localStorage/cookies/third-party embeds work while Agent-generated pages stay off the app origin. The app is canonicalized onto localhost and the preview host (127.0.0.1) serves only /preview/* — its /api answers 401 and app routes 302 to the canonical host — so the preview origin can neither set nor honor a session cookie.

2026-07-23 23:11:04 +08:00

2026-07-22-web-app.md

feat(server,web): serve Workspace HTML previews from a separate origin (#46 )

2026-07-23 23:11:04 +08:00

README.md

feat(server,web): serve Workspace HTML previews from a separate origin (#46 )

2026-07-23 23:11:04 +08:00

README.md

Unreleased

Changes since v0.1.1. The version number is assigned at release, when this folder is renamed.

[2026-07-22] Web App: Workspace HTML previews open on a separate origin with a signed token, so localStorage, cookies and third-party embeds work while Agent-generated pages still cannot reach the session cookie or the API. (details)