fix(attachments): keep the Host token on the Host's origin - #178

Problem

Since #174 (in 0.7.2 and 0.7.3), HostImage attaches the Host bearer token to every http(s) image URL it fetches. It does not check that the URL belongs to the Host.

Image mentions are not limited to Host paths: @https://example.com/x.png matches the mention pattern, and resolveAttachmentImageSrc passes http(s) URLs through unchanged. On hosted web, the login session token is workspace.authToken, so attachmentAuthToken is always set. Rendering such a mention therefore sends the viewer's session token to that third-party origin, without a click. This also affects the owner or admin when they open a shared Session.

Two smaller issues on the same path:

• SVG as a blob URL. The bearer path wraps any response in a blob URL. A blob URL has the app's origin, and the sandbox CSP from /api/fs/file does not carry over. An SVG opened from it ("Open image in new tab") runs script on the app origin.
• No size limit. /api/fs/file reads the whole file into memory. The transcript requests every referenced image on render.

Change

• isAttachmentHostUrl(src, baseUrl) (src/lib/attachment-src.ts): true only when the image URL has the same http(s) origin as attachmentBaseUrl. HostImage fetches with the token only in that case. Every other URL keeps the plain <img> request, as before feat(transcript): show Host image files referenced in assistant replies #174, without a credential.
• Raster only for blobs: HostImage creates blob URLs only for png, jpeg, gif, webp, avif and bmp. Anything else (including SVG and text/html) shows the existing "Image unavailable" placeholder. SVG on Desktop Local and cookie Hosts is unchanged: those use plain <img>, and opening the file directly keeps the sandbox CSP.
• /api/fs/file answers 413 for files over 25 MB (MAX_FILE_PREVIEW_BYTES) before reading them. This route only serves attachment previews.

Tests

• HostImage.test.tsx
  • Token never sent to another origin. Cases: a foreign host, a lookalike subdomain, http instead of https, and another port.
  • No blob for SVG, HTML or a missing content type.
  • All 7 new cases fail on master and pass with this change.
• attachment-src.test.ts: origin helper with blob, relative, null and invalid base URLs.
• path-enforcement.routes.test.ts: a sparse file just over the limit returns 413; one exactly at the limit returns 200.

Results:

• pnpm run check and pnpm run slop-check pass.
• pnpm run test: 1,628 tests pass.

For review

• Releases: 0.7.2 and 0.7.3 are affected on hosted / token-authenticated Hosts. A patch release is recommended.
• Open question: whether third-party http(s) image mentions should render at all. They would still reveal the viewer's IP (as before feat(transcript): show Host image files referenced in assistant replies #174). This PR leaves that unchanged; blocking them like markdown remote images would be a small follow-up.

🤖 Generated with Claude Code