10 Commits

Include renames

Author	SHA1	Message	Date
Classic298	42f5c3d6f7	Merge pull request #26914 from Classic298/srcdoc-embed-prompt-confirmation ... fix: restore prompt confirmation for sandboxed tool result embeds	2026-07-10 13:28:39 -05:00
Timothy Jaeryang Baek	3bba1c2270	feat: add IFRAME_CSP env var for srcdoc iframe content security policy ... Adds an IFRAME_CSP environment variable that injects a Content-Security-Policy <meta> tag into all srcdoc iframes rendering untrusted content: - Artifacts (LLM-generated HTML previews) - FullHeightIframe (tool/embed output) - FilePreview (user-uploaded HTML files) - CitationModal (RAG document HTML) Shared utility in src/lib/utils/csp.ts handles injection with HTML-safe attribute escaping. URL-based iframes (src=) are correctly excluded. Env-var only — no PersistentConfig, no admin UI, no DB. Set once at deploy time, requires restart. Empty string (default) means no CSP restriction.	2026-05-11 01:56:02 +09:00
Timothy Jaeryang Baek	3b3e12b43a	refac	2025-12-11 01:09:14 -05:00
Timothy Jaeryang Baek	f58fc753e3	feat/enh: embed citation	2025-09-28 22:15:47 -05:00
Timothy Jaeryang Baek	62517f01e5	refac: built-in chart js	2025-09-19 02:58:29 -05:00
Timothy Jaeryang Baek	293531549c	refac: alpine injection	2025-09-19 02:19:48 -05:00
Timothy Jaeryang Baek	60db9ec8ef	refac: built-in tools ui component support	2025-09-19 01:38:44 -05:00
Timothy Jaeryang Baek	a89ffccd7e	refac	2025-09-19 00:10:39 -05:00
Timothy Jaeryang Baek	a5d8882bba	refac	2025-09-18 21:25:26 -05:00
Timothy Jaeryang Baek	07c5b25bc8	feat: tool ui element support	2025-09-18 20:55:23 -05:00