fix(server): HTML renders and PDFs load behind a proxy that forbids framing

[Andrey170170]

Summary

A client on one host (dev.…) frames asset documents served by the environment on another (code.…). The gateway in front of the environment adds X-Frame-Options: SAMEORIGIN, so every in-thread HTML render and PDF preview came up blank. Browsers ignore X-Frame-Options when the response names its own frame-ancestors, so the server now does.

 GET /api/assets/<signed token>/<file>   (inline, not download)
   text/html, *.html, *.htm
-    Content-Security-Policy: sandbox allow-scripts allow-forms allow-popups
+    Content-Security-Policy: sandbox allow-scripts allow-forms allow-popups; frame-ancestors *
   application/pdf, *.pdf
-    (no Content-Security-Policy)
+    Content-Security-Policy: frame-ancestors *

Downloads, SVGs, media and the app shell are unchanged.

Evidence

• Before: curl -I https://code.andrei-homelab.com/ shows x-frame-options: SAMEORIGIN from nginx and no frame-ancestors on asset documents, so the cross-origin frame is refused.
  After: vp test run apps/server/src/http.test.ts passes (28 tests), asserting the new header on HTML by mime type, HTML by path, PDF by mime type and PDF by path.
• Not yet checked in a browser against the real gateway; that happens after the Forgejo release is installed.

Merge Danger

Door: two-way

Reverting the commit restores the old headers; nothing is persisted.

Blast Radius: small

Asset documents had no framing restriction from the server before, so this only matters where a proxy imposed one. Those documents can now be framed by any site that holds the signed, expiring URL; HTML stays sandboxed to an opaque origin.

Claude Opus 5.5 (1M context) via Claude Code in T3 Code

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T00:05:27.875812Z	0a35443	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9df3ee01cd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Allow the desktop schemes as frame ancestors

In the desktop client, the parent document uses the custom t3code://app or t3code-dev://app origin, while signed asset URLs are resolved against the environment's HTTP base URL. CSP's * source matches HTTP(S) ancestors or ancestors using the protected resource's scheme, so it does not match either desktop scheme. Consequently, this newly enforced policy blocks every HTML and PDF iframe in desktop, even without a reverse proxy; include the two desktop schemes explicitly in the frame-ancestors list.

AGENTS.md reference: AGENTS.md:L23-L31

Useful? React with 👍 / 👎.

[Andrey170170]

Real: CSP's * does not match the desktop renderer's custom-scheme origins, so this would have blanked HTML and PDF frames in desktop. Fixed in 0a35443 by listing t3code://app and t3code-dev://app alongside *.