Fix canonical routed preview origins#2098
Merged
Merged
Conversation
chubes4
force-pushed
the
fix-2092-canonical-preview-origin
branch
from
July 26, 2026 17:14
af8d250 to
fc41d30
Compare
Collaborator
Author
|
Addressed all requested changes and rebased non-interactively onto current Updates:
Commits:
Checks:
|
Collaborator
Author
|
Required PR CI coverage is now wired at head
|
Collaborator
Author
|
Green head: The required Agent Task Contracts workflow now:
Verification:
|
This was referenced Jul 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
runtime.preview.siteUrlroute aliases as the browser-visible origin while proxying transport to the disposable local previewArchitecture and root cause
route-hostpreviously rewrote individual requests with Playwright interception after navigation had already resolved against the ephemeral127.0.0.1:<port>preview. That made network requests work but left the document at the wrong origin, so browser-native History, storage, cookie, form, and redirect semantics diverged from production.For a declared HTTP
runtime.preview.siteUrlalias, local Playground runners now create the browser context with the local preview server as an HTTP proxy and navigate against the canonical site URL. The browser therefore owns canonical same-origin semantics while the proxy forwards the request to the disposable upstream runtime. Proxy absolute-form requests retain their canonicalHost, and local-upstream redirects are translated back to the browser-visible host.Security boundary
siteUrlhostname explicitly present inroute-hostactivates canonical origin preservationblock-hoststill wins over routed aliasespreview-canonical-origin-preservation-inconclusiveinstead of navigating under a different originCompatibility
The existing request-interception route remains unchanged for non-canonical routed previews. Public and secure preview modes retain their existing effective origins. The local Playground provider currently preserves declared HTTP aliases; HTTPS canonical aliases are reported as structured inconclusive because the local proxy does not terminate canonical TLS.
Tests
npm run test:browser-canonical-preview-originnpm run test:browser-callback-materialization-contractsnpx tsx tests/browser-adaptive-exploration.test.ts(16 passed)npm run buildgit diff --checknpm run checkreached the existing smoke suite, then failed at unrelatedcommand-registry-smoke:wordpress.collect-workload-result outputShape should mention outputSchema idFixes #2092