gloomberb 0.11.0 → 0.11.2

package/src/renderers/browser/config-host.ts

@@ -0,0 +1,58 @@
+import {
+  setConfigStoreHost,
+  type ConfigStoreHost,
+} from "../../data/config/store";
+import {
+  normalizeConfigForSave,
+  normalizeLoadedConfig,
+} from "../../data/config/store/normalize";
+import { createDefaultConfig, type AppConfig } from "../../types/config";
+import { BROWSER_STORAGE_KEYS, SafeJsonStorage, type StorageLike } from "./storage";
+
+export const BROWSER_DATA_DIR = "browser://local";
+
+function browserReady(config: AppConfig): AppConfig {
+  return { ...config, onboardingComplete: true, onboardingProgress: undefined };
+}
+
+function createBrowserDefaultConfig(dataDir: string): AppConfig {
+  return browserReady(createDefaultConfig(dataDir));
+}
+
+export function createBrowserConfigStore(storage: StorageLike): ConfigStoreHost {
+  const data = new SafeJsonStorage<unknown>(storage, BROWSER_STORAGE_KEYS.config, null);
+  return {
+    async getDataDir() { return BROWSER_DATA_DIR; },
+    async loadConfig(dataDir) {
+      const saved = data.get();
+      if (!saved || typeof saved !== "object" || Array.isArray(saved)) {
+        return createBrowserDefaultConfig(dataDir);
+      }
+      return browserReady(normalizeLoadedConfig(saved as Record<string, unknown>, dataDir).config);
+    },
+    async saveConfig(config) {
+      data.set(normalizeConfigForSave(browserReady({ ...config, dataDir: BROWSER_DATA_DIR })));
+    },
+    async initDataDir(dataDir) {
+      const config = createBrowserDefaultConfig(dataDir);
+      data.set(config);
+      return config;
+    },
+    async resetAllData(dataDir) {
+      for (const key of Object.values(BROWSER_STORAGE_KEYS)) {
+        try { storage.removeItem(key); } catch {}
+      }
+      data.set(createBrowserDefaultConfig(dataDir));
+    },
+    async exportConfig() {
+      throw new Error("Config file export is unavailable in the browser.");
+    },
+    async importConfig() {
+      throw new Error("Config file import is unavailable in the browser.");
+    },
+  };
+}
+
+export function installBrowserConfigStore(storage: StorageLike = localStorage): void {
+  setConfigStoreHost(createBrowserConfigStore(storage));
+}

package/src/renderers/browser/deeplink-bridge.test.ts

@@ -0,0 +1,41 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { createBrowserDeepLinkBridge } from "./deeplink-bridge";
+
+const originalWindow = globalThis.window;
+
+afterEach(() => {
+  if (originalWindow === undefined) delete (globalThis as { window?: unknown }).window;
+  else Object.defineProperty(globalThis, "window", { configurable: true, value: originalWindow });
+});
+
+describe("browser social share handoff", () => {
+  test("maps a valid pane share query to the common deep-link runtime", () => {
+    const id = "0123456789abcdef0123456789abcdef";
+    Object.defineProperty(globalThis, "window", {
+      configurable: true,
+      value: {
+        location: { search: `?share=${id}` },
+        addEventListener() {},
+        removeEventListener() {},
+      },
+    });
+    const seen: string[] = [];
+    createBrowserDeepLinkBridge().subscribe((deeplink) => seen.push(deeplink.url));
+    expect(seen).toEqual([`gloomberb://share/${id}`]);
+  });
+
+  test("prefers a shared layout query", () => {
+    const id = "fedcba9876543210fedcba9876543210";
+    Object.defineProperty(globalThis, "window", {
+      configurable: true,
+      value: {
+        location: { search: `?layout=${id}&share=0123456789abcdef0123456789abcdef` },
+        addEventListener() {},
+        removeEventListener() {},
+      },
+    });
+    const seen: string[] = [];
+    createBrowserDeepLinkBridge().subscribe((deeplink) => seen.push(deeplink.url));
+    expect(seen).toEqual([`gloomberb://layout/${id}`]);
+  });
+});

package/src/renderers/browser/deeplink-bridge.ts

@@ -0,0 +1,22 @@
+import { marketplaceLayoutIdFromSearch } from "../../layout-marketplace/api";
+import { paneShareIdFromSearch } from "../../shares/location";
+import type { DesktopDeepLinkBridge } from "../../types/desktop-deeplink";
+
+export function createBrowserDeepLinkBridge(): DesktopDeepLinkBridge {
+  return {
+    subscribe(listener) {
+      const emit = () => {
+        const layoutId = marketplaceLayoutIdFromSearch(window.location.search);
+        if (layoutId) {
+          listener({ url: `gloomberb://layout/${layoutId}` });
+          return;
+        }
+        const shareId = paneShareIdFromSearch(window.location.search);
+        if (shareId) listener({ url: `gloomberb://share/${shareId}` });
+      };
+      emit();
+      window.addEventListener("popstate", emit);
+      return () => window.removeEventListener("popstate", emit);
+    },
+  };
+}

package/src/renderers/browser/error-boundary.tsx

@@ -0,0 +1,23 @@
+/** @jsxImportSource react */
+import { Component, type ErrorInfo, type ReactNode } from "react";
+
+export class BrowserErrorBoundary extends Component<
+  { children: ReactNode },
+  { error: unknown }
+> {
+  override state = { error: null as unknown };
+
+  static getDerivedStateFromError(error: unknown) {
+    return { error };
+  }
+
+  override componentDidCatch(error: Error, info: ErrorInfo): void {
+    console.error("Browser renderer crashed", error, info.componentStack);
+  }
+
+  override render() {
+    if (!this.state.error) return this.props.children;
+    const message = this.state.error instanceof Error ? this.state.error.message : String(this.state.error);
+    return <div className="gloom-fatal"><h1>Gloomberb crashed</h1><pre>{message}</pre><button onClick={() => window.location.reload()}>Reload</button></div>;
+  }
+}

package/src/renderers/browser/main.tsx

@@ -0,0 +1,64 @@
+/** @jsxImportSource react */
+import "../electrobun/view/styles.css";
+import { createRoot } from "react-dom/client";
+import { App } from "../../app";
+import { loadConfig } from "../../data/config/store";
+import { applyLanguageFromConfig } from "../../i18n";
+import { getBrowserBuiltinPlugins } from "../../plugins/catalog-browser";
+import { UiHostProvider } from "../../ui/host";
+import { WebDialogHostProvider } from "../electrobun/view/dialog-host";
+import { BrowserErrorBoundary } from "./error-boundary";
+import { installFocusScopeRelease } from "../electrobun/view/host/focus-scope";
+import { WebInputHostProvider } from "../electrobun/view/input-host";
+import { webNativeRenderer } from "../electrobun/view/native-renderer";
+import { WebToastHostProvider } from "../electrobun/view/toast-host";
+import { createBrowserAppServices } from "./app-services";
+import {
+  installBrowserFetchTransports,
+  restoreBrowserCloudSession,
+} from "./cloud-transport";
+import { BROWSER_DATA_DIR, installBrowserConfigStore } from "./config-host";
+import { browserRendererHost, browserUiHost } from "./ui-host";
+import { createBrowserDeepLinkBridge } from "./deeplink-bridge";
+
+const rootElement = document.getElementById("root");
+if (!rootElement) throw new Error("Missing root element");
+const appRootElement = rootElement;
+appRootElement.tabIndex = -1;
+const root = createRoot(appRootElement);
+root.render(<div className="gloom-loading">Starting Gloomberb...</div>);
+
+async function boot(): Promise<void> {
+  installBrowserConfigStore();
+  installBrowserFetchTransports();
+  installFocusScopeRelease();
+  await restoreBrowserCloudSession();
+  const config = await loadConfig(BROWSER_DATA_DIR);
+  applyLanguageFromConfig(config);
+  const deepLinkBridge = createBrowserDeepLinkBridge();
+  root.render(
+    <BrowserErrorBoundary>
+      <UiHostProvider ui={browserUiHost} renderer={browserRendererHost} nativeRenderer={webNativeRenderer}>
+        <WebInputHostProvider>
+          <WebToastHostProvider>
+            <WebDialogHostProvider>
+              <App
+                config={config}
+                servicesFactory={createBrowserAppServices}
+                plugins={getBrowserBuiltinPlugins()}
+                desktopDeepLinkBridge={deepLinkBridge}
+                updatesEnabled={false}
+              />
+            </WebDialogHostProvider>
+          </WebToastHostProvider>
+        </WebInputHostProvider>
+      </UiHostProvider>
+    </BrowserErrorBoundary>,
+  );
+  appRootElement.focus({ preventScroll: true });
+}
+
+void boot().catch((error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  root.render(<div className="gloom-fatal"><h1>Gloomberb failed to start</h1><pre>{message}</pre></div>);
+});

package/src/renderers/browser/persistence.ts

@@ -0,0 +1,74 @@
+import type { AppPersistencePort } from "../../core/app-service-ports";
+import type { PluginStateRecord } from "../../data/plugin-state-store";
+import type { SessionSnapshotRecord } from "../../data/session-store";
+import { DesktopMemoryResourceStore } from "../electrobun/view/resource-store";
+import { BROWSER_STORAGE_KEYS, SafeJsonStorage, type StorageLike } from "./storage";
+
+type PluginState = Record<string, Record<string, PluginStateRecord>>;
+type Sessions = Record<string, SessionSnapshotRecord>;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+export class BrowserPersistence implements AppPersistencePort {
+  readonly resources = new DesktopMemoryResourceStore();
+  private readonly pluginStateData: SafeJsonStorage<PluginState>;
+  private readonly sessionData: SafeJsonStorage<Sessions>;
+
+  constructor(storage: StorageLike) {
+    this.pluginStateData = new SafeJsonStorage(storage, BROWSER_STORAGE_KEYS.pluginState, {}, (value): value is PluginState => isRecord(value));
+    this.sessionData = new SafeJsonStorage(storage, BROWSER_STORAGE_KEYS.session, {}, (value): value is Sessions => isRecord(value));
+  }
+
+  readonly pluginState = {
+    get: <T>(pluginId: string, key: string, schemaVersion = 1): PluginStateRecord<T> | null => {
+      const record = this.pluginStateData.get()[pluginId]?.[key];
+      if (!isRecord(record) || record.schemaVersion !== schemaVersion || !("value" in record)) return null;
+      return record as unknown as PluginStateRecord<T>;
+    },
+    set: (pluginId: string, key: string, value: unknown, schemaVersion = 1): void => {
+      const state = this.pluginStateData.get();
+      this.pluginStateData.set({
+        ...state,
+        [pluginId]: {
+          ...state[pluginId],
+          [key]: { value, schemaVersion, updatedAt: Date.now() },
+        },
+      });
+    },
+    delete: (pluginId: string, key: string): void => {
+      const state = this.pluginStateData.get();
+      const plugin = { ...state[pluginId] };
+      delete plugin[key];
+      this.pluginStateData.set({ ...state, [pluginId]: plugin });
+    },
+    keys: (pluginId: string): string[] => Object.keys(this.pluginStateData.get()[pluginId] ?? {}),
+    clear: (pluginId: string): void => {
+      const state = { ...this.pluginStateData.get() };
+      delete state[pluginId];
+      this.pluginStateData.set(state);
+    },
+  };
+
+  readonly sessions = {
+    get: <T>(sessionId = "app", schemaVersion = 1): SessionSnapshotRecord<T> | null => {
+      const record = this.sessionData.get()[sessionId];
+      if (!isRecord(record) || record.schemaVersion !== schemaVersion || !("value" in record)) return null;
+      return record as unknown as SessionSnapshotRecord<T>;
+    },
+    set: (sessionId: string, value: unknown, schemaVersion = 1): void => {
+      this.sessionData.set({
+        ...this.sessionData.get(),
+        [sessionId]: { sessionId, value, schemaVersion, updatedAt: Date.now() },
+      });
+    },
+    delete: (sessionId: string): void => {
+      const state = { ...this.sessionData.get() };
+      delete state[sessionId];
+      this.sessionData.set(state);
+    },
+  };
+
+  close(): void {}
+}

package/src/renderers/browser/storage.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, test } from "bun:test";
+import { createDefaultConfig } from "../../types/config";
+import { createBrowserConfigStore, BROWSER_DATA_DIR } from "./config-host";
+import { BrowserPersistence } from "./persistence";
+import { BROWSER_STORAGE_KEYS, SafeJsonStorage, type StorageLike } from "./storage";
+import { BrowserTickerRepository } from "./ticker-repository";
+
+class MemoryStorage implements StorageLike {
+  readonly values = new Map<string, string>();
+  failWrites = false;
+  getItem(key: string) { return this.values.get(key) ?? null; }
+  setItem(key: string, value: string) {
+    if (this.failWrites) throw new DOMException("full", "QuotaExceededError");
+    this.values.set(key, value);
+  }
+  removeItem(key: string) { this.values.delete(key); }
+}
+
+describe("browser local persistence", () => {
+  test("falls back safely for malformed JSON and quota failures", () => {
+    const storage = new MemoryStorage();
+    storage.values.set("key", "{");
+    const data = new SafeJsonStorage(storage, "key", { count: 0 });
+    expect(data.get()).toEqual({ count: 0 });
+    storage.values.set("wrong-shape", "[]");
+    const shaped = new SafeJsonStorage(storage, "wrong-shape", { ok: true }, (value): value is { ok: boolean } => !!value && typeof value === "object" && !Array.isArray(value));
+    expect(shaped.get()).toEqual({ ok: true });
+    storage.failWrites = true;
+    data.set({ count: 2 });
+    expect(data.get()).toEqual({ count: 2 });
+  });
+
+  test("normalizes config and persists tickers, plugin state, and session state", async () => {
+    const storage = new MemoryStorage();
+    storage.values.set(BROWSER_STORAGE_KEYS.config, JSON.stringify({ theme: 42 }));
+    const configStore = createBrowserConfigStore(storage);
+    const config = await configStore.loadConfig(BROWSER_DATA_DIR);
+    expect(config.theme).toBe(createDefaultConfig(BROWSER_DATA_DIR).theme);
+    expect(config.onboardingComplete).toBe(true);
+    config.baseCurrency = "EUR";
+    await configStore.saveConfig(config);
+    expect((await configStore.loadConfig(BROWSER_DATA_DIR)).baseCurrency).toBe("EUR");
+
+    const tickers = new BrowserTickerRepository(storage);
+    await tickers.createTicker({
+      ticker: "AAPL",
+      exchange: "NASDAQ",
+      currency: "USD",
+      name: "Apple Inc.",
+      portfolios: [],
+      watchlists: [],
+      positions: [],
+      custom: {},
+      tags: [],
+    });
+    expect((await new BrowserTickerRepository(storage).loadTicker("aapl"))?.metadata.ticker).toBe("AAPL");
+
+    const persistence = new BrowserPersistence(storage);
+    persistence.pluginState.set("alerts", "draft", { enabled: true }, 2);
+    persistence.sessions.set("app", { focusedPaneId: "portfolio-list:main" }, 1);
+    const restored = new BrowserPersistence(storage);
+    expect(restored.pluginState.get("alerts", "draft", 2)?.value).toEqual({ enabled: true });
+    expect(restored.pluginState.get("alerts", "draft", 1)).toBeNull();
+    expect(restored.sessions.get("app", 1)?.value).toEqual({ focusedPaneId: "portfolio-list:main" });
+  });
+});

package/src/renderers/browser/storage.ts

@@ -0,0 +1,50 @@
+export interface StorageLike {
+  getItem(key: string): string | null;
+  setItem(key: string, value: string): void;
+  removeItem(key: string): void;
+}
+
+/** localStorage wrapper that keeps the app usable when JSON or quota is bad. */
+export class SafeJsonStorage<T> {
+  private value: T;
+
+  constructor(
+    private readonly storage: StorageLike,
+    readonly key: string,
+    fallback: T,
+    validate: (value: unknown) => value is T = (_value): _value is T => true,
+  ) {
+    this.value = fallback;
+    try {
+      const raw = storage.getItem(key);
+      if (raw !== null) {
+        const parsed: unknown = JSON.parse(raw);
+        if (!validate(parsed)) throw new Error("Invalid stored value");
+        this.value = parsed;
+      }
+    } catch {
+      try { storage.removeItem(key); } catch {}
+    }
+  }
+
+  get(): T {
+    return this.value;
+  }
+
+  set(value: T): void {
+    this.value = value;
+    try { this.storage.setItem(this.key, JSON.stringify(value)); } catch {}
+  }
+
+  clear(fallback: T): void {
+    this.value = fallback;
+    try { this.storage.removeItem(this.key); } catch {}
+  }
+}
+
+export const BROWSER_STORAGE_KEYS = {
+  config: "gloomberb.web.config.v1",
+  tickers: "gloomberb.web.tickers.v1",
+  pluginState: "gloomberb.web.plugin-state.v1",
+  session: "gloomberb.web.session.v1",
+} as const;

package/src/renderers/browser/ticker-repository.ts

@@ -0,0 +1,59 @@
+import type { AppTickerRepositoryPort } from "../../core/app-service-ports";
+import { hydrateTickerMetadata } from "../../tickers/metadata";
+import type { TickerMetadata, TickerRecord } from "../../types/ticker";
+import { BROWSER_STORAGE_KEYS, SafeJsonStorage, type StorageLike } from "./storage";
+
+type StoredTickers = Record<string, TickerMetadata>;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function normalizeSymbol(symbol: string): string {
+  return symbol.trim().toUpperCase();
+}
+
+function hydrate(metadata: TickerMetadata): TickerRecord | null {
+  try {
+    return { metadata: hydrateTickerMetadata(metadata as unknown as Record<string, unknown>) };
+  } catch {
+    return null;
+  }
+}
+
+export class BrowserTickerRepository implements AppTickerRepositoryPort {
+  private readonly data: SafeJsonStorage<StoredTickers>;
+
+  constructor(storage: StorageLike) {
+    this.data = new SafeJsonStorage(storage, BROWSER_STORAGE_KEYS.tickers, {}, (value): value is StoredTickers => isRecord(value));
+  }
+
+  async loadAllTickers(): Promise<TickerRecord[]> {
+    return Object.values(this.data.get()).flatMap((metadata) => {
+      const ticker = hydrate(metadata);
+      return ticker ? [ticker] : [];
+    });
+  }
+
+  async loadTicker(symbol: string): Promise<TickerRecord | null> {
+    const metadata = this.data.get()[normalizeSymbol(symbol)];
+    return metadata ? hydrate(metadata) : null;
+  }
+
+  async saveTicker(ticker: TickerRecord): Promise<void> {
+    const symbol = normalizeSymbol(ticker.metadata.ticker);
+    this.data.set({ ...this.data.get(), [symbol]: ticker.metadata });
+  }
+
+  async createTicker(metadata: TickerMetadata): Promise<TickerRecord> {
+    const ticker = { metadata };
+    await this.saveTicker(ticker);
+    return ticker;
+  }
+
+  async deleteTicker(symbol: string): Promise<void> {
+    const tickers = { ...this.data.get() };
+    delete tickers[normalizeSymbol(symbol)];
+    this.data.set(tickers);
+  }
+}

package/src/renderers/browser/ui-host.tsx

@@ -0,0 +1,40 @@
+/** @jsxImportSource react */
+import type { RendererHost, UiHost } from "../../ui/host";
+import { safeExternalUrl } from "../../utils/external-url";
+import { createDomUiHost } from "../electrobun/view/dom-ui-host";
+
+export const browserUiHost: UiHost = createDomUiHost("browser", {
+  nativePaneChrome: true,
+  titleBarOverlay: true,
+  nativeWindowChrome: false,
+  nativeContextMenu: false,
+  publicSharing: true,
+});
+
+export const browserRendererHost: RendererHost = {
+  supportsNativeDesktopNotifications: false,
+  requestExit() {},
+  notify() {},
+  async openExternal(rawUrl) {
+    const url = safeExternalUrl(rawUrl);
+    if (!url) return;
+    const opened = window.open(url, "_blank", "noopener,noreferrer");
+    if (opened) opened.opener = null;
+  },
+  async copyText(text) {
+    await navigator.clipboard.writeText(text);
+  },
+  async readText() {
+    return navigator.clipboard.readText();
+  },
+  async copyPngImage(pngBase64) {
+    const ClipboardItemCtor = globalThis.ClipboardItem;
+    if (!ClipboardItemCtor || !navigator.clipboard.write) {
+      throw new Error("Image clipboard is unavailable in this browser.");
+    }
+    const bytes = Uint8Array.from(atob(pngBase64), (char) => char.charCodeAt(0));
+    await navigator.clipboard.write([
+      new ClipboardItemCtor({ "image/png": new Blob([bytes], { type: "image/png" }) }),
+    ]);
+  },
+};

package/src/renderers/cloudflare/worker.test.ts

@@ -0,0 +1,136 @@
+import { describe, expect, test } from "bun:test";
+import { handleRequest, SECURITY_HEADERS, type WorkerEnv } from "./worker";
+
+function fixture() {
+  const requests: Request[] = [];
+  const env: WorkerEnv = {
+    ASSETS: {
+      async fetch(request) {
+        requests.push(request);
+        return new Response("<!doctype html>", { headers: { "content-type": "text/html" } });
+      },
+    },
+  };
+  return { env, requests };
+}
+
+describe("static Cloudflare host", () => {
+  test("reports health without invoking static assets", async () => {
+    const { env, requests } = fixture();
+    const response = await handleRequest(new Request("https://term.example/health"), env);
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({ status: "ok" });
+    expect(requests).toHaveLength(0);
+  });
+
+  test("serves app assets with an enforced CSP and security headers", async () => {
+    const { env } = fixture();
+    const response = await handleRequest(new Request("https://term.example/"), env);
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-security-policy")).toBe(SECURITY_HEADERS["content-security-policy"]);
+    expect(response.headers.has("content-security-policy-report-only")).toBe(false);
+    expect(response.headers.get("x-frame-options")).toBe("DENY");
+    expect(response.headers.get("referrer-policy")).toBe("strict-origin-when-cross-origin");
+    expect(response.headers.get("cache-control")).toBe("no-store");
+  });
+
+  test("rewrites valid pane and layout share paths to the slim document", async () => {
+    const id = "0123456789abcdef0123456789abcdef";
+    for (const prefix of ["s", "l"]) {
+      const { env, requests } = fixture();
+      const response = await handleRequest(new Request(`https://term.example/${prefix}/${id}`), env);
+      expect(new URL(requests[0]!.url).pathname).toBe("/share.html");
+      expect(response.headers.get("x-robots-tag")).toBe("noindex, nofollow, noarchive");
+    }
+  });
+
+  test("serves the Apple app site association without touching static assets", async () => {
+    const { env, requests } = fixture();
+    const response = await handleRequest(
+      new Request("https://term.example/.well-known/apple-app-site-association"),
+      env,
+    );
+
+    // Apple's fetcher accepts none of: a redirect, an HTML body, a 404. Any of
+    // those disables universal links silently, so pin the exact contract.
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toContain("application/json");
+    expect(requests).toHaveLength(0);
+
+    const body = (await response.json()) as {
+      applinks: { details: { appIDs: string[]; components: { "/": string }[] }[] };
+    };
+    const detail = body.applinks.details[0]!;
+    expect(detail.appIDs).toEqual(["3XQML3UV65.sh.gloom.companion"]);
+    // Only share links are claimed; everything else must stay in the browser.
+    expect(detail.components[0]!["/"]).toBe("/s/*");
+  });
+
+  test("claims exactly the share paths the worker itself rewrites", async () => {
+    const { env } = fixture();
+    const response = await handleRequest(
+      new Request("https://term.example/.well-known/apple-app-site-association"),
+      env,
+    );
+    const body = (await response.json()) as {
+      applinks: { details: { components: { "/": string }[] }[] };
+    };
+    const claimed = body.applinks.details[0]!.components[0]!["/"];
+
+    // A real share id must match the pattern advertised to Apple, otherwise the
+    // app is claiming links the site does not serve, or missing ones it does.
+    const shareId = "0123456789abcdef0123456789abcdef";
+    const pattern = new RegExp(`^${claimed.replace("*", ".*")}$`);
+    expect(pattern.test(`/s/${shareId}`)).toBe(true);
+    expect(pattern.test("/settings")).toBe(false);
+  });
+
+  test("proxies only the same-origin API path to api.gloom.sh", async () => {
+    const { env, requests } = fixture();
+    let upstream: Request | undefined;
+    const response = await handleRequest(new Request("https://term.example/api/chat/channels/everyone/messages?limit=1", {
+      method: "POST",
+      headers: {
+        Cookie: "session=browser-cookie",
+        Origin: "https://term.example",
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ content: "hello" }),
+    }), env, async (request) => {
+      upstream = request;
+      return Response.json({ ok: true });
+    });
+
+    expect(response.status).toBe(200);
+    expect(requests).toHaveLength(0);
+    expect(upstream?.url).toBe("https://api.gloom.sh/chat/channels/everyone/messages?limit=1");
+    expect(upstream?.method).toBe("POST");
+    expect(upstream?.headers.get("cookie")).toBe("session=browser-cookie");
+    expect(upstream?.headers.get("origin")).toBe("https://term.example");
+    expect(await upstream?.text()).toBe('{"content":"hello"}');
+  });
+
+  test("rejects cross-origin API requests before proxying", async () => {
+    const { env } = fixture();
+    let proxied = false;
+    const response = await handleRequest(new Request("https://term.example/api/auth/sign-out", {
+      method: "POST",
+      headers: { Origin: "https://attacker.example" },
+    }), env, async () => {
+      proxied = true;
+      return new Response();
+    });
+    expect(response.status).toBe(403);
+    expect(proxied).toBe(false);
+  });
+
+  test("rejects every non-API mutation without invoking assets or outbound fetch", async () => {
+    const { env, requests } = fixture();
+    const response = await handleRequest(new Request("https://term.example/shares", {
+      method: "POST",
+      headers: { Origin: "https://term.example" },
+    }), env);
+    expect(response.status).toBe(405);
+    expect(requests).toHaveLength(0);
+  });
+});