revert: interactive web-thread playgrounds

Reverts the changes merged through #701.

Author: 16francej

plugins/portal/README.md

@@ -6,11 +6,10 @@ fronts every surface. It does provider-neutral **OIDC** sign-in (Google Workspac
 is the email-first deployment default) and reverse-proxies — over Fly's private 6PN — to the
 surfaces, which all stay **private** (no public `[http_service]` of their own):
 
-| Path          | → upstream        | Notes                                                                         |
-| ------------- | ----------------- | ----------------------------------------------------------------------------- |
-| `/*` (root)   | `<prefix>-web-ui` | Pi web UI SPA, root-mounted (`/web-ui/*` 308-redirects to root for old links) |
-| `/admin/*`    | `<prefix>-admin`  | governance — admin access derived from the core (`canAdminister`)             |
-| `/m/:id/:key` | core              | public bearer HTML playgrounds (miniapps); no session; CSP-sandboxed          |
+| Path        | → upstream        | Notes                                                                         |
+| ----------- | ----------------- | ----------------------------------------------------------------------------- |
+| `/*` (root) | `<prefix>-web-ui` | Pi web UI SPA, root-mounted (`/web-ui/*` 308-redirects to root for old links) |
+| `/admin/*`  | `<prefix>-admin`  | governance — admin access derived from the core (`canAdminister`)             |
 
 User deployments are never served on this authenticated origin; they use the dedicated apps domain.
 
@@ -28,12 +27,10 @@ surfaces, and it does **not** import the core.
    the subject from userinfo. The verified `sub` **is** the core principal id. It mints a
    signed `portal_session` cookie (`{sub, org, auth, exp}`, HMAC, 8h sliding lifetime with a
    24h absolute maximum by default).
-3. **Proxy** — inbound webhooks, OAuth callbacks, and miniapp playgrounds (`GET /m/:id/:key`)
-   pass through to core without a session. Every other path requires a valid session. The portal
-   picks the upstream by the **exact first path segment**, strips the prefix, and proxies to the
-   private upstream, synthesizing the surface cookie for compatibility and attaching a short-lived
-   signed portal identity. Surfaces pass that identity to core, which verifies it before any
-   user-scoped action.
+3. **Proxy** — every other path requires a valid session. The portal picks the upstream by the
+   **exact first path segment**, strips the prefix, and proxies to the private upstream,
+   synthesizing the surface cookie for compatibility and attaching a short-lived signed portal
+   identity. Surfaces pass that identity to core, which verifies it before any user-scoped action.
 
 ## Security model (the parts that must be right)
 

plugins/portal/src/index.ts

@@ -959,11 +959,6 @@ async function handle(req: IncomingMessage, res: ServerResponse): Promise<void>
     return proxyToUpstream(req, res, { baseUrl: CORE, path: pathname, search: url.search }, FORWARD_WEBHOOK_HEADERS);
   }
 
-  if (method === "GET" && /^\/m\/[^/]+\/[^/]+$/.test(pathname)) {
-    res.removeHeader("x-frame-options");
-    return proxyToUpstream(req, res, { baseUrl: CORE, path: pathname, search: url.search }, ["accept"]);
-  }
-
   const consentBounce = (): void => {
     res.writeHead(302, { location: `/auth/login?returnTo=${encodeURIComponent(`${pathname}${url.search}`)}` });
     return void res.end();

plugins/portal/test/router.test.ts

@@ -230,21 +230,6 @@ test("the webhook passthrough is exact-shape + POST-only (no widening of /v1)",
   assert.equal((await fetch(`${base}/v1/webhooks`, { method: "POST" })).status, 404);
 });
 
-test("miniapps pass through to the core with NO session so Slack buttons and iframes work", async () => {
-  const r = await fetch(`${base}/m/aa/bb`, { headers: { accept: "text/html" }, redirect: "manual" });
-  assert.equal(r.status, 200);
-  const body = (await r.json()) as { url: string; cookie: string | null };
-  assert.equal(body.url, "/m/aa/bb");
-  assert.equal(body.cookie, null);
-  assert.equal(r.headers.get("x-frame-options"), null);
-});
-
-test("the miniapp passthrough is GET /m/:id/:key only", async () => {
-  assert.equal((await fetch(`${base}/m/aa`, { redirect: "manual" })).status, 401);
-  assert.equal((await fetch(`${base}/m/aa/bb/cc`, { redirect: "manual" })).status, 401);
-  assert.equal((await fetch(`${base}/m/aa/bb`, { method: "POST", redirect: "manual" })).status, 401);
-});
-
 test("the provider callback still passes through publicly with NO session/cookie", async () => {
   const cb = await fetch(`${base}/v1/connectors/oauth/google/callback?code=c&state=s`, { redirect: "manual" });
   assert.equal(cb.status, 200);

plugins/web-ui/server/index.ts

@@ -2346,27 +2346,6 @@ const routeRequest = async (req: IncomingMessage, res: ServerResponse) => {
     return found.route.handle({ req, res, url, user, params: found.params });
   }
 
-  if (method === "GET" && path.startsWith("/m/")) {
-    const rest = path.slice("/m/".length);
-    const slash = rest.indexOf("/");
-    if (slash === -1) return json(res, 404, { error: "not_found" });
-    const id = decodeURIComponent(rest.slice(0, slash));
-    const key = decodeURIComponent(rest.slice(slash + 1).split("/")[0] ?? "");
-    const corePath = `/m/${encodeURIComponent(id)}/${encodeURIComponent(key)}${url.search}`;
-    const up = await fetch(`${CORE}${corePath}`, { method: "GET", redirect: "manual" });
-    const buf = Buffer.from(await up.arrayBuffer());
-    res.removeHeader("x-frame-options");
-    res.writeHead(up.status, {
-      "content-type": up.headers.get("content-type") ?? "text/html; charset=utf-8",
-      "content-length": String(buf.length),
-      "content-security-policy": up.headers.get("content-security-policy") ?? UNTRUSTED_CONTENT_SANDBOX_CSP,
-      "x-content-type-options": "nosniff",
-      "referrer-policy": "no-referrer",
-      "cache-control": up.headers.get("cache-control") ?? "private, no-cache",
-    });
-    return res.end(buf);
-  }
-
   if (method === "GET" && path.startsWith("/deployments/")) {
     const user = cookieUser(req);
     if (!user) return unauthorized(res, req);

plugins/web-ui/src/chat.ts

@@ -6,15 +6,13 @@ import "./marked-dedupe";
 import "@mariozechner/mini-lit/dist/MarkdownBlock.js";
 import "@mariozechner/mini-lit/dist/CodeBlock.js";
 import { html, nothing, render, type TemplateResult } from "lit";
-import { unsafeHTML } from "lit/directives/unsafe-html.js";
 import {
   Activity,
   Ban,
   Brain,
   Check,
   ChevronRight,
   Clock3,
-  Code2,
   Copy,
   FileImage,
   FileText,
@@ -71,16 +69,6 @@ import {
 } from "./core-bridge";
 import { buildTimeline, toolRowKind, type TimelineItem, type ToolPayload, type ToolRowModel } from "./timeline";
 import { CONNECTOR_NAMES, connectorLinksIn, stripConnectorLinks, type ConnectorLink } from "./connector-link";
-import {
-  miniappsIn,
-  miniappFrameSrc,
-  miniappSourceSrc,
-  formatMiniappHtml,
-  currentMiniappTheme,
-  stripMiniappDirectives,
-  type MiniappEmbed,
-} from "./miniapp";
-import hljs, { whenHighlightReady } from "./lazy-hljs";
 import { deepLinkPath, UI_BASE } from "./deep-link";
 import type { ChatSurface, ConvCtx } from "./conv-types";
 import { errMessage, swallow } from "../../chassis/src/errors";
@@ -129,53 +117,11 @@ interface SettledRowKey {
   approvalDecision: unknown;
   sendFailure: unknown;
   forkable: boolean;
-  miniappKey: string;
   tpl: TemplateResult | typeof nothing;
 }
 const settledRowCache = new WeakMap<object, SettledRowKey>();
 const connectedConnectors = new Set<string>();
-const miniappPaneByUrl = new Map<string, "play" | "code">();
-const miniappSourceByUrl = new Map<string, string>();
-const miniappBootByPath = new Map<string, { ok: boolean; error?: string }>();
-const miniappBootTimerByPath = new Map<string, number>();
 const redrawHooks = new Set<() => void>();
-
-function miniappPathOf(src: string): string {
-  try {
-    return new URL(src, location.origin).pathname;
-  } catch {
-    return src;
-  }
-}
-
-function noteMiniappBoot(path: string, boot: { ok: boolean; error?: string }): void {
-  if (miniappBootByPath.get(path)?.ok && boot.ok) return;
-  miniappBootByPath.set(path, boot);
-  const timer = miniappBootTimerByPath.get(path);
-  if (timer !== undefined) window.clearTimeout(timer);
-  miniappBootTimerByPath.delete(path);
-  for (const hook of redrawHooks) hook();
-}
-
-window.addEventListener("message", (event) => {
-  const data = event.data as { source?: string; path?: string; ok?: boolean; error?: string } | null;
-  if (!data || data.source !== "qm-miniapp" || typeof data.path !== "string") return;
-  noteMiniappBoot(data.path, {
-    ok: Boolean(data.ok),
-    ...(typeof data.error === "string" && data.error ? { error: data.error } : {}),
-  });
-});
-
-function armMiniappBoot(src: string): void {
-  const path = miniappPathOf(src);
-  if (miniappBootByPath.has(path) || miniappBootTimerByPath.has(path)) return;
-  miniappBootTimerByPath.set(
-    path,
-    window.setTimeout(() => {
-      if (!miniappBootByPath.has(path)) noteMiniappBoot(path, { ok: true });
-    }, 1500),
-  );
-}
 let proactiveOpenerStarted = false;
 
 export const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
@@ -563,13 +509,8 @@ export function createChatSurface(
     if (chatState.agent) drawActiveChat();
   }
 
-  function redrawForMiniapp(): void {
-    redrawTranscript();
-  }
-
   function dispose(): void {
     redrawHooks.delete(redrawForConnector);
-    redrawHooks.delete(redrawForMiniapp);
     teardownActiveChat();
   }
 
@@ -1296,13 +1237,6 @@ export function createChatSurface(
       (!work || ((work.status === "complete" || work.status === "failed") && !work.pendingApprovals?.length));
     if (!cacheable) return chatMessage(message, index, isStreaming);
     const forkable = Boolean(chatState.threadRef && chatState.sessionId && chatState.agent);
-    const miniappKey = miniappsIn(messageText(message))
-      .map((app) => {
-        const src = miniappFrameSrc(app.url, withBase, currentMiniappTheme());
-        const boot = miniappBootByPath.get(miniappPathOf(src));
-        return `${app.url}:${miniappPaneByUrl.get(app.url) ?? "play"}:${miniappSourceByUrl.get(app.url) ?? ""}:${boot ? `${boot.ok}:${boot.error ?? ""}` : "pending"}`;
-      })
-      .join("\n");
     const hit = settledRowCache.get(message as object);
     if (
       hit &&
@@ -1315,8 +1249,7 @@ export function createChatSurface(
       hit.errorMessage === msg.errorMessage &&
       hit.approvalDecision === msg.approvalDecision &&
       hit.sendFailure === msg.sendFailure &&
-      hit.forkable === forkable &&
-      hit.miniappKey === miniappKey
+      hit.forkable === forkable
     ) {
       return hit.tpl;
     }
@@ -1332,7 +1265,6 @@ export function createChatSurface(
       approvalDecision: msg.approvalDecision,
       sendFailure: msg.sendFailure,
       forkable,
-      miniappKey,
       tpl,
     });
     return tpl;
@@ -1525,112 +1457,19 @@ export function createChatSurface(
     </a>`;
   }
 
-  function loadMiniappSource(url: string, sourceSrc: string): void {
-    if (miniappSourceByUrl.has(url)) return;
-    miniappSourceByUrl.set(url, "");
-    void fetch(sourceSrc, { cache: "reload" })
-      .then(async (r) => {
-        miniappSourceByUrl.set(url, r.ok ? await r.text() : "Couldn't load the source.");
-        redrawTranscript();
-      })
-      .catch(() => {
-        miniappSourceByUrl.set(url, "Couldn't load the source.");
-        redrawTranscript();
-      });
-  }
-
-  function miniappSourceView(source: string | undefined): TemplateResult {
-    if (!source) return html`<pre class="miniapp-source" tabindex="0">Loading source…</pre>`;
-    const formatted = formatMiniappHtml(source);
-    if (!hljs.getLanguage("html") && !hljs.getLanguage("xml")) {
-      void whenHighlightReady().then(() => redrawTranscript());
-    }
-    return html`<pre class="miniapp-source" tabindex="0">
-${unsafeHTML(hljs.highlight(formatted, { language: "html" }).value)}</pre>`;
-  }
-
-  function miniappBootState(
-    pane: "play" | "code",
-    boot: { ok: boolean; error?: string } | undefined,
-  ): TemplateResult | typeof nothing {
-    if (pane !== "play") return nothing;
-    if (!boot) return html`<div class="miniapp-boot" role="status">Starting…</div>`;
-    if (!boot.ok)
-      return html`<div class="miniapp-boot err" role="alert">${boot.error || "Playground hit an error."}</div>`;
-    return nothing;
-  }
-
-  function miniappCard(app: MiniappEmbed): TemplateResult {
-    const src = miniappFrameSrc(app.url, withBase, currentMiniappTheme());
-    const sourceSrc = miniappSourceSrc(src);
-    const pane = miniappPaneByUrl.get(app.url) ?? "play";
-    if (pane === "code") loadMiniappSource(app.url, sourceSrc);
-    const source = miniappSourceByUrl.get(app.url);
-    const path = miniappPathOf(src);
-    if (pane === "play") armMiniappBoot(src);
-    const boot = miniappBootByPath.get(path);
-    return html`<div class="miniapp-card">
-      <header class="miniapp-card-bar">
-        <span class="miniapp-card-icon">${icon(Files, 16)}</span>
-        <strong class="miniapp-card-title">${app.title}</strong>
-        <nav class="miniapp-tabs" aria-label="Playground views">
-          <button
-            class="miniapp-tab ${pane === "play" ? "on" : ""}"
-            type="button"
-            aria-pressed=${pane === "play"}
-            @click=${() => {
-              miniappPaneByUrl.set(app.url, "play");
-              redrawTranscript();
-            }}
-          >
-            Play
-          </button>
-          <button
-            class="miniapp-tab ${pane === "code" ? "on" : ""}"
-            type="button"
-            aria-pressed=${pane === "code"}
-            @click=${() => {
-              miniappPaneByUrl.set(app.url, "code");
-              loadMiniappSource(app.url, sourceSrc);
-              redrawTranscript();
-            }}
-          >
-            ${icon(Code2, 13)} Code
-          </button>
-        </nav>
-        <a class="miniapp-card-open" href=${src} target="_blank" rel="noreferrer" title="Open in a new tab"
-          >${icon(Maximize2, 14)} Open</a
-        >
-      </header>
-      <div class="miniapp-stage">
-        <iframe
-          class="miniapp-frame ${pane === "code" ? "is-hidden" : ""}"
-          src=${src}
-          title=${app.title}
-          sandbox="allow-scripts allow-forms allow-pointer-lock allow-modals allow-popups"
-          referrerpolicy="no-referrer"
-        ></iframe>
-        ${miniappBootState(pane, boot)} ${pane === "code" ? miniappSourceView(source) : nothing}
-      </div>
-    </div>`;
-  }
-
   function assistantContent(message: AssistantMessage, isStreaming = false, hasWork = false): TemplateResult[] {
     const parts: TemplateResult[] = [];
     for (const chunk of message.content) {
       if (chunk.type === "text" && chunk.text.trim()) {
         const links = connectorLinksIn(chunk.text, location.origin);
-        const apps = miniappsIn(chunk.text);
-        let body = stripMiniappDirectives(chunk.text);
-        if (links.length) body = stripConnectorLinks(body);
+        const body = links.length ? stripConnectorLinks(chunk.text) : chunk.text;
         if (body.trim())
           parts.push(
             html`<div class="streaming-text ${isStreaming ? "live-stream" : ""}">
               ${isStreaming ? streamingMarkdown(body) : markdown(body)}
             </div>`,
           );
         for (const link of links) parts.push(connectorWidget(link));
-        if (!isStreaming) for (const app of apps) parts.push(miniappCard(app));
       }
       if (chunk.type === "thinking" && chunk.thinking.trim()) {
         parts.push(
@@ -2460,7 +2299,6 @@ ${unsafeHTML(hljs.highlight(formatted, { language: "html" }).value)}</pre>`;
   }
 
   redrawHooks.add(redrawForConnector);
-  redrawHooks.add(redrawForMiniapp);
 
   return {
     state: chatState,

plugins/web-ui/src/lazy-hljs.ts

@@ -8,13 +8,6 @@ type Hljs = {
 
 let real: Hljs | null = null;
 let loading: Promise<void> | null = null;
-const readyWaiters: Array<() => void> = [];
-
-export function whenHighlightReady(): Promise<void> {
-  if (real) return Promise.resolve();
-  ensureLoading();
-  return new Promise((resolve) => readyWaiters.push(resolve));
-}
 
 const LANGS = ["javascript", "typescript", "python", "xml", "css", "json", "bash", "sql", "markdown"] as const;
 const LANG_ALIASES: Record<string, string> = { html: "xml" };
@@ -54,8 +47,6 @@ function ensureLoading(): void {
       }
       real = hljs;
       rerenderMountedBlocks();
-      const waiters = readyWaiters.splice(0);
-      for (const fn of waiters) fn();
     })
     .catch(() => {
       loading = null;