fix(desktop): allow browser agent localhost navigation

Author: Sg312

apps/desktop/src/main/browser-agent/session.test.ts

@@ -1085,6 +1085,39 @@ describe('reopening a closed tab', () => {
     expect((reopened?.view as unknown as MockView).webContents.loadURL).not.toHaveBeenCalled()
   })
 
+  it('duplicates a tab by loading the same URL in a new one', () => {
+    session.ensureTab()
+    const source = session.addTab()
+    ;(source.view as unknown as MockView).webContents.getURL.mockReturnValue(
+      'https://example.com/inbox'
+    )
+
+    const copy = session.duplicateTab(source.id)
+
+    expect(copy?.id).not.toBe(source.id)
+    expect((copy?.view as unknown as MockView).webContents.loadURL).toHaveBeenCalledWith(
+      'https://example.com/inbox'
+    )
+  })
+
+  it('never copies a URL carrying embedded credentials into a duplicate', () => {
+    session.ensureTab()
+    const source = session.addTab()
+    ;(source.view as unknown as MockView).webContents.getURL.mockReturnValue(
+      'https://user:pass@example.com/'
+    )
+
+    const copy = session.duplicateTab(source.id)
+
+    // Falls back to a blank tab rather than re-sending the credentials.
+    expect((copy?.view as unknown as MockView).webContents.loadURL).not.toHaveBeenCalled()
+  })
+
+  it('returns null when duplicating a tab that is not open', () => {
+    session.ensureTab()
+    expect(session.duplicateTab('no-such-tab')).toBeNull()
+  })
+
   it('drops a non-http scheme from the reopen list', () => {
     session.ensureTab()
     const closing = session.addTab()

apps/desktop/src/main/browser-agent/url-guard.test.ts

@@ -25,13 +25,38 @@ describe('checkAgentUrl', () => {
   })
 
   it('blocks private IP literals without resolving', async () => {
-    expect((await checkAgentUrl('http://127.0.0.1/')).ok).toBe(false)
     expect((await checkAgentUrl('http://169.254.169.254/latest/meta-data')).ok).toBe(false)
     expect((await checkAgentUrl('http://10.0.0.5/')).ok).toBe(false)
-    expect((await checkAgentUrl('http://[::1]/')).ok).toBe(false)
+    expect((await checkAgentUrl('http://192.168.1.1/')).ok).toBe(false)
+    expect((await checkAgentUrl('http://[fd00::1]/')).ok).toBe(false)
     expect(mockLookup).not.toHaveBeenCalled()
   })
 
+  it('allows loopback, so a local dev server can be opened', async () => {
+    // The panel exists to browse from this machine, and the agent already has
+    // an unrestricted shell on it. The LAN and the metadata endpoint above are
+    // a different matter and stay blocked.
+    expect((await checkAgentUrl('http://127.0.0.1:3000/')).ok).toBe(true)
+    expect((await checkAgentUrl('http://[::1]:3000/')).ok).toBe(true)
+    expect(mockLookup).not.toHaveBeenCalled()
+  })
+
+  it('allows localhost, which resolves to loopback', async () => {
+    mockLookup.mockResolvedValue([
+      { address: '::1', family: 6 },
+      { address: '127.0.0.1', family: 4 },
+    ])
+    expect((await checkAgentUrl('http://localhost:3000/app')).ok).toBe(true)
+  })
+
+  it('still blocks a host that resolves to the LAN alongside loopback', async () => {
+    mockLookup.mockResolvedValue([
+      { address: '127.0.0.1', family: 4 },
+      { address: '192.168.0.9', family: 4 },
+    ])
+    expect((await checkAgentUrl('http://sneaky.test/')).ok).toBe(false)
+  })
+
   it('allows public IP literals without resolving', async () => {
     expect((await checkAgentUrl('https://8.8.8.8/')).ok).toBe(true)
     expect(mockLookup).not.toHaveBeenCalled()
@@ -77,10 +102,15 @@ describe('checkAgentUrl', () => {
 describe('isBlockedRequestUrl', () => {
   it('blocks literal private/reserved hosts', () => {
     expect(isBlockedRequestUrl('http://169.254.169.254/latest/meta-data')).toBe(true)
-    expect(isBlockedRequestUrl('http://127.0.0.1:8080/x')).toBe(true)
+    expect(isBlockedRequestUrl('http://10.0.0.5/x')).toBe(true)
     expect(isBlockedRequestUrl('https://[fd00::1]/')).toBe(true)
   })
 
+  it('allows loopback subresources, so a local page can load its own assets', () => {
+    expect(isBlockedRequestUrl('http://127.0.0.1:8080/app.js')).toBe(false)
+    expect(isBlockedRequestUrl('http://[::1]:8080/app.css')).toBe(false)
+  })
+
   it('allows public literals and hostnames (classified at nav time)', () => {
     expect(isBlockedRequestUrl('https://8.8.8.8/')).toBe(false)
     expect(isBlockedRequestUrl('https://example.com/x')).toBe(false)

apps/desktop/src/main/browser-agent/url-guard.ts

@@ -1,6 +1,12 @@
 import dns from 'node:dns/promises'
 import { createLogger } from '@sim/logger'
-import { isIpLiteral, isPrivateIp, isPrivateIpHost, unwrapIpv6Brackets } from '@sim/security/ssrf'
+import {
+  isIpLiteral,
+  isLoopbackIp,
+  isPrivateIp,
+  isPrivateIpHost,
+  unwrapIpv6Brackets,
+} from '@sim/security/ssrf'
 import { getErrorMessage } from '@sim/utils/errors'
 import { parseHttpUrl } from '@/main/navigation'
 
@@ -37,6 +43,25 @@ export interface UrlGuardResult {
 }
 
 const OK: UrlGuardResult = { ok: true }
+
+/**
+ * Whether an address is off limits to the embedded browser.
+ *
+ * Loopback is deliberately allowed: it is the user's own machine, and opening
+ * a dev server on localhost is one of the most ordinary things to do in this
+ * panel — the URL bar already assumes `http://` for it. Nothing is given away
+ * by it either, since the desktop app hands the same agent an unrestricted
+ * shell on that machine, so a blocked `http://localhost:3000` is one
+ * `curl http://localhost:3000` away regardless.
+ *
+ * Every other private range stays blocked. Those are a different matter: the
+ * LAN is other people's machines, and `169.254.169.254` is link-local rather
+ * than loopback, so the cloud-metadata endpoint this guard exists for is
+ * unaffected.
+ */
+function isBlockedAddress(ip: string): boolean {
+  return isPrivateIp(ip) && !isLoopbackIp(ip)
+}
 const BLOCKED: UrlGuardResult = {
   ok: false,
   error: 'That address points to a private or internal network and was blocked.',
@@ -48,7 +73,8 @@ const BLOCKED: UrlGuardResult = {
  * loopback/RFC1918/link-local host (e.g. the `169.254.169.254` cloud-metadata
  * endpoint) would let a page's contents be read back through the read/snapshot
  * tools. This resolves the host the same way `apps/sim` does for outbound
- * fetches and blocks any that land on a private/reserved address.
+ * fetches and blocks any that land on a private/reserved address — except
+ * loopback, which is allowed (see {@link isBlockedAddress}).
  *
  * IP literals are classified directly; hostnames are DNS-resolved and every
  * returned address is checked. Resolution failure fails CLOSED (blocks): we
@@ -69,7 +95,7 @@ export async function checkAgentUrl(rawUrl: string): Promise<UrlGuardResult> {
 
   // IP literal: classify directly, no DNS lookup needed.
   if (isIpLiteral(host)) {
-    if (isPrivateIp(host)) {
+    if (isBlockedAddress(host)) {
       logger.warn('Blocked agent navigation to private IP literal', { host })
       return BLOCKED
     }
@@ -78,7 +104,7 @@ export async function checkAgentUrl(rawUrl: string): Promise<UrlGuardResult> {
 
   try {
     const resolved = await resolveHost(host)
-    if (resolved.some(({ address }) => isPrivateIp(address))) {
+    if (resolved.some(({ address }) => isBlockedAddress(address))) {
       logger.warn('Blocked agent navigation resolving to private IP', { host })
       return BLOCKED
     }
@@ -105,8 +131,10 @@ export async function checkAgentUrl(rawUrl: string): Promise<UrlGuardResult> {
  */
 export function isBlockedRequestUrl(rawUrl: string): boolean {
   try {
-    // isPrivateIpHost strips IPv6 brackets itself.
-    return isPrivateIpHost(new URL(rawUrl).hostname)
+    // isPrivateIpHost strips IPv6 brackets itself; unwrap again for the
+    // loopback carve-out, which takes a bare address.
+    const host = new URL(rawUrl).hostname
+    return isPrivateIpHost(host) && !isLoopbackIp(unwrapIpv6Brackets(host))
   } catch {
     return false
   }