Merge pull request #273 from closedloop-ai/hotfix-design-renderer-assets

HOTFIX: Serve design dashboard assets

Author: mikeangstadt

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "desktop",
-  "version": "0.15.113",
+  "version": "0.15.114",
   "description": "ClosedLoop Desktop",
   "author": "ClosedLoop AI <support@closedloop.ai>",
   "private": true,

apps/desktop/src/main/window.ts

@@ -8,6 +8,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 const RENDERER_DIR = path.resolve(__dirname, "..", "renderer");
 const DESIGN_RENDERER_DIR = path.join(RENDERER_DIR, "design-system");
+const ASSETS_RENDERER_DIR = path.join(RENDERER_DIR, "assets");
 const DESIGN_RENDERER_URL = "app://renderer/design-system/index.html";
 const APP_PROTOCOL = "app";
 const EXTERNAL_LINK_HOSTS = new Set([
@@ -89,11 +90,12 @@ function serveAppProtocolAsset(request: Request): Response {
     return new Response("Bad request", { status: 400 });
   }
 
-  if (
-    !decodedPathname.startsWith("/design-system/") ||
-    decodedPathname.includes("\0") ||
-    decodedPathname.includes("\\")
-  ) {
+  if (decodedPathname.includes("\0") || decodedPathname.includes("\\")) {
+    return new Response("Not found", { status: 404 });
+  }
+
+  const assetRoot = resolveAppProtocolRoot(decodedPathname);
+  if (!assetRoot) {
     return new Response("Not found", { status: 404 });
   }
 
@@ -104,7 +106,7 @@ function serveAppProtocolAsset(request: Request): Response {
   }
 
   const filePath = path.resolve(RENDERER_DIR, relativePath);
-  if (!isPathInside(filePath, DESIGN_RENDERER_DIR)) {
+  if (!isPathInside(filePath, assetRoot)) {
     return new Response("Forbidden", { status: 403 });
   }
 
@@ -120,7 +122,7 @@ function serveAppProtocolAsset(request: Request): Response {
   let realRoot: string;
   let realFile: string;
   try {
-    realRoot = realpathSync(DESIGN_RENDERER_DIR);
+    realRoot = realpathSync(assetRoot);
     realFile = realpathSync(filePath);
     if (!statSync(realFile).isFile() || !isPathInside(realFile, realRoot)) {
       return new Response("Forbidden", { status: 403 });
@@ -136,6 +138,16 @@ function serveAppProtocolAsset(request: Request): Response {
   });
 }
 
+function resolveAppProtocolRoot(pathname: string): string | null {
+  if (pathname.startsWith("/design-system/")) {
+    return DESIGN_RENDERER_DIR;
+  }
+  if (pathname.startsWith("/assets/")) {
+    return ASSETS_RENDERER_DIR;
+  }
+  return null;
+}
+
 export class DesktopWindow {
   private browserWindow: BrowserWindow | null = null;
   private disposing = false;

apps/desktop/test/agent-dashboard-boundary.test.ts

@@ -255,9 +255,10 @@ test("design-system BrowserWindow protocol and navigation guards are fail-closed
   assert.match(windowSource, /url\.hostname !== "renderer"/);
   assert.match(windowSource, /decodeURIComponent\(url\.pathname\)/);
   assert.match(windowSource, /startsWith\("\/design-system\/"\)/);
+  assert.match(windowSource, /startsWith\("\/assets\/"\)/);
   assert.match(windowSource, /pathParts\.includes\("\.\."\)/);
   assert.match(windowSource, /APP_PROTOCOL_EXTENSIONS\.has\(ext\)/);
-  assert.match(windowSource, /realpathSync\(DESIGN_RENDERER_DIR\)/);
+  assert.match(windowSource, /realpathSync\(assetRoot\)/);
   assert.match(windowSource, /statSync\(realFile\)\.isFile\(\)/);
   assert.match(windowSource, /isPathInside\(realFile, realRoot\)/);
   assert.match(windowSource, /new URL\(url\)\.href === this\.allowedRendererUrl/);