local-operator-ui 0.33.15 → 0.33.17

package/out/main/index.js

@@ -1242,7 +1242,19 @@ const desktopRequestUnion = zod.z.discriminatedUnion("op", [
     command: id$1,
     name: zod.z.string().max(128).optional()
   }).strict(),
-  zod.z.object({ op: zod.z.literal("models.catalogue"), live: zod.z.boolean().optional() }).strict(),
+  zod.z.object({
+    op: zod.z.literal("models.catalogue"),
+    live: zod.z.boolean().optional(),
+    /*
+     * Which view of the catalogue to answer with: `usable` (the rows this
+     * machine can run, plus the session's current model) or `all`. Absent
+     * means `all`, which is also what a backend that predates the
+     * parameter does with it — the picker stays correct either way, because
+     * a compile-time-correct request against an old backend is filtered
+     * client-side by `scopeCatalogue`.
+     */
+    scope: zod.z.enum(["usable", "all"]).optional()
+  }).strict(),
   zod.z.object({
     op: zod.z.literal("usage.get"),
     provider: id$1.optional(),
@@ -3106,11 +3118,13 @@ function desktopEndpoint(request) {
         path: `/v1/desktop/sessions/${request.sessionId}/command-entities?command=${encodeURIComponent(request.command)}${request.name ? `&name=${encodeURIComponent(request.name)}` : ""}`,
         method: "GET"
       };
-    case "models.catalogue":
+    case "models.catalogue": {
+      const scope = request.scope ? `&scope=${request.scope}` : "";
       return {
-        path: `/v1/desktop/models?live=${request.live ?? false}`,
+        path: `/v1/desktop/models?live=${request.live ?? false}${scope}`,
         method: "GET"
       };
+    }
     case "usage.get": {
       const query = new URLSearchParams({
         live: String(request.live ?? false),
@@ -3484,6 +3498,7 @@ function desktopEndpoint(request) {
 const MAX_PROBE_PATHS = 64;
 const DIRECTORY_ENTRY_LIMIT = 200;
 const MAX_FILE_READ_BYTES = 64 * 1024 * 1024;
+const EXTERNAL_OPEN_REFUSED_CHANNEL = "external-open-refused";
 const MINI_VIEW_SUMMONED = "mini-view:summoned";
 const MINI_VIEW_DISMISS = "mini-view:dismiss";
 const MINI_VIEW_REGISTRATION = "mini-view:registration";
@@ -3827,9 +3842,9 @@ function classifyRecord(record, now, liveness = recordPidLiveness(record, now))
   return age > HEARTBEAT_TIMEOUT_MS ? "wedged" : "live";
 }
 function recordAddress(record) {
-  return addressOf("http:", canonicalHost(record.host), record.port);
+  return addressOf("http:", canonicalHost$1(record.host), record.port);
 }
-function canonicalHost(host) {
+function canonicalHost$1(host) {
   const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
   const unqualified = bare.endsWith(".") ? bare.slice(0, -1) : bare;
   const lower = unqualified.toLowerCase();
@@ -4098,7 +4113,7 @@ function normaliseAddress(url) {
     const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
     return addressOf(
       parsed.protocol,
-      canonicalHost(parsed.hostname),
+      canonicalHost$1(parsed.hostname),
       Number(port)
     );
   } catch {
@@ -42824,6 +42839,374 @@ function attachWindowChrome(options) {
   };
   return { sync, dispose };
 }
+const ALLOW = { allowed: true };
+const deny = (reason) => ({ allowed: false, reason });
+const EXTERNAL_SCHEMES = /* @__PURE__ */ new Set([
+  "https:",
+  "http:",
+  "mailto:"
+]);
+const MAX_EXTERNAL_URL_LENGTH = 16384;
+const IPV4_PART = /^\d{1,3}$/;
+const IPV6_MAPPED_PREFIX = /^::ffff:(.+)$/;
+const TRAILING_DOT = /\.$/;
+function isPrivateIpv4(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4) return false;
+  const octets = [];
+  for (const part of parts) {
+    if (!IPV4_PART.test(part)) return false;
+    const value = Number(part);
+    if (value > 255) return false;
+    octets.push(value);
+  }
+  const [a, b] = octets;
+  if (a === 0 || a === 127) return true;
+  if (a === 10) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 169 && b === 254) return true;
+  return false;
+}
+function isPrivateIpv6(host) {
+  if (host === "::" || host === "::1") return true;
+  const mapped = IPV6_MAPPED_PREFIX.exec(host);
+  if (mapped) {
+    const rest = mapped[1];
+    if (rest.includes(".")) return isPrivateIpv4(rest);
+    const groups = rest.split(":");
+    if (groups.length === 2) {
+      const hi = Number.parseInt(groups[0], 16);
+      const lo = Number.parseInt(groups[1], 16);
+      if (Number.isFinite(hi) && Number.isFinite(lo)) {
+        return isPrivateIpv4(
+          [hi >> 8, hi & 255, lo >> 8, lo & 255].join(".")
+        );
+      }
+    }
+    return true;
+  }
+  const first = Number.parseInt(host.split(":")[0] || "0", 16);
+  if (!Number.isFinite(first)) return true;
+  if ((first & 65472) === 65152) return true;
+  if ((first & 65024) === 64512) return true;
+  return false;
+}
+const canonicalHost = (hostname) => hostname.toLowerCase().replace(TRAILING_DOT, "");
+function isLocalOrPrivateHost(hostname) {
+  const host = canonicalHost(hostname);
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  if (host.startsWith("[") && host.endsWith("]"))
+    return isPrivateIpv6(host.slice(1, -1));
+  return isPrivateIpv4(host);
+}
+function externalUrlVerdict(raw) {
+  if (typeof raw !== "string" || raw.length === 0)
+    return { allowed: false, reason: "not a string" };
+  if (raw.length > MAX_EXTERNAL_URL_LENGTH)
+    return { allowed: false, reason: "too long" };
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return { allowed: false, reason: "not a URL" };
+  }
+  if (!EXTERNAL_SCHEMES.has(url.protocol))
+    return {
+      allowed: false,
+      reason: `scheme ${url.protocol} is not handed out`
+    };
+  if (url.protocol !== "mailto:") {
+    if (url.username || url.password)
+      return { allowed: false, reason: "URL carries credentials" };
+    if (!url.hostname) return { allowed: false, reason: "URL has no host" };
+    if (isLocalOrPrivateHost(url.hostname))
+      return {
+        allowed: false,
+        reason: "URL names a loopback or private-network host"
+      };
+  } else if (/(^|[?&])attach(ment)?=/i.test(url.search)) {
+    return { allowed: false, reason: "mailto: names an attachment" };
+  }
+  return { allowed: true, url: url.href };
+}
+async function openVettedExternal(raw, open2, log2) {
+  const verdict = externalUrlVerdict(raw);
+  if (!verdict.allowed) {
+    log2(`[window-guard] refused to open externally: ${verdict.reason}`);
+    return { ok: false, reason: verdict.reason };
+  }
+  try {
+    await open2(verdict.url);
+    return { ok: true };
+  } catch (error) {
+    const reason = `the OS could not open the URL: ${error instanceof Error ? error.message : String(error)}`;
+    log2(`[window-guard] ${reason}`);
+    return { ok: false, reason };
+  }
+}
+const AUTH_HOSTS = [
+  "accounts.google.com",
+  "oauth.googleusercontent.com",
+  "content.googleapis.com",
+  "ssl.gstatic.com",
+  "login.microsoftonline.com",
+  "microsoftonline.com",
+  "login.live.com",
+  "login.windows.net",
+  "login.microsoft.com"
+];
+const AUTH_SCHEMES = /* @__PURE__ */ new Set([
+  "storagerelay:",
+  "msauth:",
+  "msftauth:"
+]);
+function isAuthPopupUrl(url) {
+  if (url.protocol !== "https:") return false;
+  if (url.username || url.password) return false;
+  if (url.port !== "") return false;
+  const host = url.hostname.toLowerCase();
+  return AUTH_HOSTS.some(
+    (domain) => host === domain || host.endsWith(`.${domain}`)
+  );
+}
+function popupVerdict(raw) {
+  if (raw === "about:blank")
+    return {
+      action: "deny",
+      reason: "about:blank is refused as a popup start"
+    };
+  let url = null;
+  try {
+    url = new URL(raw);
+  } catch {
+  }
+  if (url && (isAuthPopupUrl(url) || AUTH_SCHEMES.has(url.protocol)))
+    return { action: "auth" };
+  const external = externalUrlVerdict(raw);
+  return external.allowed ? { action: "external", url: external.url } : { action: "deny", reason: external.reason };
+}
+function popupNavigationVerdict(rawUrl) {
+  if (rawUrl === "about:blank") return ALLOW;
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return deny("not a URL");
+  }
+  if (isAuthPopupUrl(url) || AUTH_SCHEMES.has(url.protocol)) return ALLOW;
+  return deny(`the sign-in window may not navigate to ${url.protocol}`);
+}
+const STATIC_FRAME_PREFIX = "/v1/static/";
+function frameNavigationVerdict(input, trustedRendererUrls) {
+  let url;
+  try {
+    url = new URL(input.url);
+  } catch {
+    return deny("not a URL");
+  }
+  if (input.isMainFrame) {
+    return trustedRendererUrls.some(
+      (trusted) => trustedDesktopFrame(input.url, trusted)
+    ) ? ALLOW : deny("the main window may only show the app's own document");
+  }
+  if (url.protocol === "blob:") {
+    let minted;
+    try {
+      minted = new URL(url.pathname);
+    } catch {
+      return deny("blob: URL names no origin");
+    }
+    const own = trustedRendererUrls.some((trusted) => {
+      try {
+        const t = new URL(trusted);
+        return t.protocol === "file:" ? minted.protocol === "file:" : minted.origin === t.origin;
+      } catch {
+        return false;
+      }
+    });
+    return own ? ALLOW : deny("blob: minted by a document that is not the app");
+  }
+  if ((url.protocol === "http:" || url.protocol === "https:") && isLocalOrPrivateHost(url.hostname) && url.pathname.startsWith(STATIC_FRAME_PREFIX))
+    return ALLOW;
+  return deny(`a child frame may not navigate to ${url.protocol}`);
+}
+function permissionVerdict(query, trustedRendererUrls) {
+  if (!query.isMainFrame) return false;
+  if (!trustedRendererUrls.some(
+    (trusted) => trustedDesktopFrame(query.requestingUrl, trusted)
+  ))
+    return false;
+  if (query.permission === "clipboard-sanitized-write" || query.permission === "fullscreen")
+    return true;
+  if (query.permission !== "media") return false;
+  if (query.mediaTypes)
+    return query.mediaTypes.length > 0 && query.mediaTypes.every((type2) => type2 === "audio");
+  return query.mediaType === "audio";
+}
+function decodedPathname(pathname) {
+  let current = pathname;
+  for (let round = 0; round < 3; round += 1) {
+    let next;
+    try {
+      next = decodeURIComponent(current);
+    } catch {
+      break;
+    }
+    if (next === current) break;
+    current = next;
+  }
+  return current;
+}
+function isStaticServeRequest(rawUrl) {
+  try {
+    const url = new URL(rawUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+    if (!isLocalOrPrivateHost(url.hostname)) return false;
+    return decodedPathname(url.pathname).toLowerCase().startsWith(STATIC_FRAME_PREFIX);
+  } catch {
+    return false;
+  }
+}
+const PREVIEW_CSP = [
+  "default-src 'none'",
+  "script-src 'unsafe-inline' 'unsafe-eval' https:",
+  "style-src 'unsafe-inline' https:",
+  "img-src data: blob: https:",
+  "font-src data: https:",
+  "media-src data: blob: https:",
+  "connect-src https:",
+  "worker-src blob:",
+  "form-action 'none'",
+  "base-uri 'none'"
+].join("; ");
+function withPreviewPolicy(headers) {
+  const out = { ...headers };
+  const existing = (name) => Object.keys(out).find((key) => key.toLowerCase() === name);
+  const cspKey = existing("content-security-policy");
+  if (cspKey) out[cspKey] = [...out[cspKey], PREVIEW_CSP];
+  else out["Content-Security-Policy"] = [PREVIEW_CSP];
+  if (!existing("x-content-type-options"))
+    out["X-Content-Type-Options"] = ["nosniff"];
+  return out;
+}
+function downloadVerdict(itemUrl, initiatorUrl, trustedRendererUrls) {
+  if (!itemUrl.startsWith("blob:"))
+    return deny("only the app's own blob: exports may write files");
+  if (!trustedRendererUrls.some(
+    (trusted) => trustedDesktopFrame(initiatorUrl, trusted)
+  ))
+    return deny("the download was not started by one of the app's documents");
+  return ALLOW;
+}
+function installNavigationVerdict(contents, decide, log2) {
+  const onNavigation = (event) => {
+    if (event.isSameDocument) return;
+    const verdict = decide(event.url, event.isMainFrame);
+    if (verdict.allowed) return;
+    event.preventDefault();
+    log2(
+      `[window-guard] blocked ${event.isMainFrame ? "main-frame" : "child-frame"} navigation to ${event.url.slice(0, 200)}: ${verdict.reason}`
+    );
+  };
+  contents.on("will-frame-navigate", onNavigation);
+  contents.on("will-redirect", onNavigation);
+}
+function guardNavigation(contents, trustedUrls, log2) {
+  installNavigationVerdict(
+    contents,
+    (url, isMainFrame) => frameNavigationVerdict({ url, isMainFrame }, trustedUrls()),
+    log2
+  );
+}
+function guardWindowOpen(contents, decide, openExternal, authWindowOptions, log2, notifyRefused) {
+  contents.setWindowOpenHandler((details) => {
+    const verdict = decide(details.url);
+    if (verdict.action === "auth") {
+      return {
+        action: "allow",
+        overrideBrowserWindowOptions: authWindowOptions
+      };
+    }
+    if (verdict.action === "external") {
+      void openExternal(verdict.url).then((outcome) => {
+        if (!outcome.ok) notifyRefused?.(verdict.url, outcome.reason);
+      });
+    } else {
+      log2(`[window-guard] denied window.open: ${verdict.reason}`);
+      notifyRefused?.(details.url, verdict.reason);
+    }
+    return { action: "deny" };
+  });
+  contents.on("did-create-window", (window) => {
+    guardPopupNavigation(window.webContents, log2);
+  });
+}
+function guardPopupNavigation(contents, log2) {
+  installNavigationVerdict(contents, (url) => popupNavigationVerdict(url), log2);
+  contents.setWindowOpenHandler(() => {
+    log2("[window-guard] denied window.open from the sign-in popup");
+    return { action: "deny" };
+  });
+}
+function guardPermissions(ses, trustedUrls, log2) {
+  ses.setPermissionRequestHandler(
+    (_contents, permission, callback, details) => {
+      const granted = permissionVerdict(
+        {
+          permission,
+          mediaTypes: "mediaTypes" in details ? details.mediaTypes ?? [] : void 0,
+          isMainFrame: details.isMainFrame,
+          requestingUrl: details.requestingUrl
+        },
+        trustedUrls()
+      );
+      if (!granted)
+        log2(
+          `[window-guard] denied permission request ${permission} from ${details.requestingUrl.slice(0, 200)}`
+        );
+      callback(granted);
+    }
+  );
+  ses.setPermissionCheckHandler(
+    (_contents, permission, _origin, details) => permissionVerdict(
+      {
+        permission,
+        mediaType: details.mediaType,
+        isMainFrame: details.isMainFrame,
+        requestingUrl: details.requestingUrl ?? ""
+      },
+      trustedUrls()
+    )
+  );
+}
+function guardPreviewResponses(ses) {
+  ses.webRequest.onHeadersReceived((details, callback) => {
+    if (!isStaticServeRequest(details.url)) {
+      callback({});
+      return;
+    }
+    callback({
+      responseHeaders: withPreviewPolicy(
+        details.responseHeaders ?? {}
+      )
+    });
+  });
+}
+function guardDownloads(ses, trustedUrls, log2) {
+  ses.on("will-download", (event, item, webContents) => {
+    const verdict = downloadVerdict(
+      item.getURL(),
+      webContents?.getURL() ?? "",
+      trustedUrls()
+    );
+    if (verdict.allowed) return;
+    event.preventDefault();
+    log2(
+      `[window-guard] blocked a download from ${item.getURL().slice(0, 200)}: ${verdict.reason}`
+    );
+  });
+}
 const BASE64_FILE_EXTENSIONS = ["csv", "tsv", "xls", "xlsx", "ods"];
 const resolveUserPath = (filePath, cwd) => resolveUserPath$1(filePath, cwd, electron.app.getPath("home"));
 const windowLaunch = resolveWindowLaunchPlan({
@@ -43098,6 +43481,45 @@ const ownLaunchRequest = () => ({
   show: windowLaunch.show,
   trigger: "initial-present"
 });
+const rendererDocumentUrl = () => process.env.ELECTRON_RENDERER_URL || node_url.pathToFileURL(path$1.join(__dirname, "../renderer/index.html")).href;
+const trustedRendererDocuments = () => [
+  rendererDocumentUrl(),
+  miniViewUrlFor(rendererDocumentUrl())
+];
+const openExternalVetted = (raw) => openVettedExternal(
+  raw,
+  (url) => electron.shell.openExternal(url),
+  (message) => logger.warn(message, LogFileType.BACKEND)
+);
+const authPopupWindowOptions = {
+  width: 800,
+  height: 700,
+  // Increased height for better visibility
+  minWidth: 600,
+  minHeight: 500,
+  center: true,
+  frame: true,
+  autoHideMenuBar: false,
+  backgroundColor: "#FFFFFF",
+  webPreferences: {
+    contextIsolation: true,
+    nodeIntegration: false,
+    webSecurity: true,
+    allowRunningInsecureContent: false,
+    sandbox: true,
+    // Enable sandbox for additional security
+    // Disable various features that aren't needed for auth
+    enableWebSQL: false,
+    navigateOnDragDrop: false,
+    spellcheck: false,
+    /*
+     * A JS dialog in a popup must not be able to wedge it (round-2 S-7): a
+     * renderer-reached `confirm()`/`alert()` needs no permission and blocks
+     * every later evaluation on the page behind its modal.
+     */
+    disableDialogs: true
+  }
+};
 function createWindow(initialSession = null, openCatalogue = false, request = ownLaunchRequest()) {
   const chrome = resolveLaunchWindowChrome({
     argv: process.argv,
@@ -43242,66 +43664,22 @@ function createWindow(initialSession = null, openCatalogue = false, request = ow
       );
     }, 1500);
   });
-  mainWindow2.webContents.setWindowOpenHandler((details) => {
-    const url = new URL(details.url);
-    const trustedAuthDomains = [
-      // Google auth domains
-      "accounts.google.com",
-      "oauth.googleusercontent.com",
-      "content.googleapis.com",
-      "ssl.gstatic.com",
-      // Microsoft auth domains
-      "login.microsoftonline.com",
-      "login.live.com",
-      "login.windows.net",
-      "login.microsoft.com",
-      "microsoftonline.com",
-      "msauth",
-      "msftauth",
-      // Auth relay domains
-      "storagerelay",
-      // Special case for initial blank page
-      "about:blank"
-    ];
-    const isTrustedAuthDomain = (
-      // Special case for about:blank which is used by MSAL to initialize the popup
-      details.url === "about:blank" || // Check other trusted domains
-      trustedAuthDomains.some(
-        (domain) => url.hostname.includes(domain) || url.protocol.includes(domain) || // Special case for storage relay URLs
-        details.url.startsWith("storagerelay:") || details.url.includes("storagerelay")
-      )
-    );
-    if (isTrustedAuthDomain) {
-      return {
-        action: "allow",
-        overrideBrowserWindowOptions: {
-          width: 800,
-          height: 700,
-          // Increased height for better visibility
-          minWidth: 600,
-          minHeight: 500,
-          center: true,
-          frame: true,
-          autoHideMenuBar: false,
-          backgroundColor: "#FFFFFF",
-          webPreferences: {
-            contextIsolation: true,
-            nodeIntegration: false,
-            webSecurity: true,
-            allowRunningInsecureContent: false,
-            sandbox: true,
-            // Enable sandbox for additional security
-            // Disable various features that aren't needed for auth
-            enableWebSQL: false,
-            navigateOnDragDrop: false,
-            spellcheck: false
-          }
-        }
-      };
-    }
-    electron.shell.openExternal(details.url);
-    return { action: "deny" };
-  });
+  guardNavigation(
+    mainWindow2.webContents,
+    trustedRendererDocuments,
+    (m) => logger.warn(m, LogFileType.BACKEND)
+  );
+  guardWindowOpen(
+    mainWindow2.webContents,
+    popupVerdict,
+    openExternalVetted,
+    authPopupWindowOptions,
+    (m) => logger.warn(m, LogFileType.BACKEND),
+    (url, reason) => mainWindow2.webContents.send(EXTERNAL_OPEN_REFUSED_CHANNEL, {
+      url,
+      reason
+    })
+  );
   if (utils.is.dev && process.env.ELECTRON_RENDERER_URL) {
     mainWindow2.loadURL(process.env.ELECTRON_RENDERER_URL);
   } else {
@@ -43340,8 +43718,8 @@ const reportBackendFailure = (message, fileType) => {
 const reportRaise = (line) => {
   logger.info(`[window-raise] ${line}`, LogFileType.BACKEND);
 };
-function describeForwardedLaunch(profile, session) {
-  const named = session === null ? null : `the conversation it named (${session})`;
+function describeForwardedLaunch(profile, session2) {
+  const named = session2 === null ? null : `the conversation it named (${session2})`;
   const handed = named === null ? "it named no conversation" : `${named} rides with it`;
   const effect = windowLaunch.show === "never" ? named === null ? `${handed}, so nothing is waiting to be opened, and it will not raise a window in the meantime` : `${handed}: the app will open it in the window it already has open, or in the next window it creates when that window is in use or there is none, and it will not raise a window in the meantime (up to ${PARKED_LAUNCH_LIMIT} conversations wait; an older one is dropped and logged)` : windowLaunch.show === "inactive" ? `${handed}; the app may order its window forward without activating it` : `${handed}; the app will raise its window`;
   return `[second-instance] this launch did not start a window of its own: the app already open is the instance answering (profile: ${profile}), and this launch's window mode (${windowLaunch.mode}) was handed to it — ${effect}. Quit that app to start a fresh instance. Exiting.`;
@@ -43394,15 +43772,15 @@ function rendererArgumentFlags(initialSession, openCatalogue, chromeMode) {
 }
 const parkedLaunches = [];
 const PARKED_LAUNCH_LIMIT = 16;
-function parkLaunch(session, request, why = "unreachable") {
-  parkedLaunches.push({ session, request });
+function parkLaunch(session2, request, why = "unreachable") {
+  parkedLaunches.push({ session: session2, request });
   const parkLine = {
     trigger: request.trigger,
     requester: request.requester,
     report: reportRaise
   };
-  if (why === "in-use") reportParkedInUse(session, request.show, parkLine);
-  else reportParked(session, parkLine, request.show);
+  if (why === "in-use") reportParkedInUse(session2, request.show, parkLine);
+  else reportParked(session2, parkLine, request.show);
   if (parkedLaunches.length <= PARKED_LAUNCH_LIMIT) return;
   const evicted = parkedLaunches.shift();
   if (evicted) {
@@ -43460,12 +43838,12 @@ let openOwnWindow = null;
 let attachBrowserHostToWindow = null;
 const CONVERSATION_PAINT_FALLBACK_MS = 3e3;
 const heldForConversation = /* @__PURE__ */ new Map();
-function holdPresentUntilConversation(window, session, request) {
+function holdPresentUntilConversation(window, session2, request) {
   const timer = setTimeout(() => {
     releaseHeldWindow(window.id);
   }, CONVERSATION_PAINT_FALLBACK_MS);
   timer.unref?.();
-  heldForConversation.set(window.id, { session, timer, request });
+  heldForConversation.set(window.id, { session: session2, timer, request });
 }
 function releaseHeldWindow(windowId) {
   const held = heldForConversation.get(windowId);
@@ -43482,9 +43860,9 @@ function releaseHeldWindow(windowId) {
   }
   return true;
 }
-function releaseHeldWindowFor(session) {
+function releaseHeldWindowFor(session2) {
   for (const [windowId, held] of heldForConversation) {
-    if (held.session !== session) continue;
+    if (held.session !== session2) continue;
     releaseHeldWindow(windowId);
   }
 }
@@ -43564,8 +43942,8 @@ if (!gotTheLock) {
             show: request.show,
             argv: commandLine
           }),
-          openConversation: openConversationInWindow ? (session, request) => openConversationInWindow?.(
-            session,
+          openConversation: openConversationInWindow ? (session2, request) => openConversationInWindow?.(
+            session2,
             secondInstanceRequest(request)
           ) : null,
           /*
@@ -43584,8 +43962,8 @@ if (!gotTheLock) {
           // WITH it, so the flush cannot re-derive it from argv that is gone, and
           // the queue holds EVERY parked request rather than the last one
           // (review round 2, MAJOR-1).
-          queue: (session, request) => {
-            parkLaunch(session, secondInstanceRequest(request));
+          queue: (session2, request) => {
+            parkLaunch(session2, secondInstanceRequest(request));
           },
           report: reportRaise
         }
@@ -43595,6 +43973,17 @@ if (!gotTheLock) {
 }
 electron.app.whenReady().then(async () => {
   utils.electronApp.setAppUserModelId("com.local-operator");
+  guardPermissions(
+    electron.session.defaultSession,
+    trustedRendererDocuments,
+    (m) => logger.warn(m, LogFileType.BACKEND)
+  );
+  guardPreviewResponses(electron.session.defaultSession);
+  guardDownloads(
+    electron.session.defaultSession,
+    trustedRendererDocuments,
+    (m) => logger.warn(m, LogFileType.BACKEND)
+  );
   if (process.env.LOCAL_OPERATOR_UI_SMOKE_TEST === "true") {
     console.log(
       `LOCAL_OPERATOR_UI_READY electron=${process.versions.electron}`
@@ -43698,7 +44087,7 @@ electron.app.whenReady().then(async () => {
     } catch {
     }
   });
-  const rendererUrl = process.env.ELECTRON_RENDERER_URL || node_url.pathToFileURL(path$1.join(__dirname, "../renderer/index.html")).href;
+  const rendererUrl = rendererDocumentUrl();
   const consoleCaptureUrl = consoleCaptureUrlFor(rendererUrl);
   backendService.observeDesktopFeed(
     (frame) => {
@@ -43785,7 +44174,7 @@ electron.app.whenReady().then(async () => {
     windowMode: windowLaunch.mode
   });
   if (hotkeysAllowed(windowLaunch.mode) || miniViewExerciser) {
-    miniView = createMiniView({
+    const quickSend = createMiniView({
       url: miniViewUrlFor(rendererUrl),
       preloadPath: path$1.join(__dirname, "../preload/index.js"),
       show: windowLaunch.show,
@@ -43807,6 +44196,23 @@ electron.app.whenReady().then(async () => {
       }).mode,
       report: reportRaise
     });
+    miniView = quickSend;
+    guardNavigation(
+      quickSend.window.webContents,
+      trustedRendererDocuments,
+      (m) => logger.warn(m, LogFileType.BACKEND)
+    );
+    guardWindowOpen(
+      quickSend.window.webContents,
+      popupVerdict,
+      openExternalVetted,
+      authPopupWindowOptions,
+      (m) => logger.warn(m, LogFileType.BACKEND),
+      (url, reason) => quickSend.window.webContents.send(EXTERNAL_OPEN_REFUSED_CHANNEL, {
+        url,
+        reason
+      })
+    );
   }
   if (hotkeysAllowed(windowLaunch.mode)) {
     const initial = readQuickSendValue();
@@ -44017,13 +44423,7 @@ electron.app.whenReady().then(async () => {
       }
     }
   );
-  electron.ipcMain.handle("open-external", async (_, url) => {
-    try {
-      await electron.shell.openExternal(url);
-    } catch (error) {
-      console.error("Error opening URL:", error);
-    }
-  });
+  electron.ipcMain.handle("open-external", async (_, url) => openExternalVetted(url));
   electron.ipcMain.handle(
     "show-item-in-folder",
     async (_, filePath) => {
@@ -44330,7 +44730,7 @@ electron.app.whenReady().then(async () => {
     const windowId = mainWindow.webContents.id;
     claimParkedFor(
       mainWindow,
-      (session, request2) => openSessionInWindow(session, request2, { fromPark: true }),
+      (session2, request2) => openSessionInWindow(session2, request2, { fromPark: true }),
       parked
     );
     claimParkedConsentAttention(mainWindow);