Repository navigation
feat: live campaign dashboard — Preview renders HTML, stays live, pops out (#2140) - #2145
Merged
Merged
Conversation
added 4 commits
November 6, 2026 13:44
#2141) .html/.htm open rendered with the markdown Preview/Edit toggle. The page runs in an iframe sandboxed allow-same-origin WITHOUT allow-scripts: scripts, inline handlers and meta refresh never run, while the host routes link clicks (https to the system browser, local links into Preview), applies zoom and keeps scroll across re-renders. Before display the host strips script/base/refresh/ link/embedding elements and inlines local images (relative, absolute, file://; img src and SVG image href) as data URIs read through the engine file API, within a count and size budget. Part of #2140.
The engine watcher only sees the project tree and the agent's own writes, so a dashboard a script rewrites in the personal vault never refreshed. While its pane is active and the window visible, the rendered page re-reads itself every 3 s (new text goes through the parent, which never clobbers unsaved Source edits) and, while the inlined total is under 8 MB, its images; a watcher change to any inlined image re-renders too. Re-renders keep scroll. Part of #2140.
Rendered HTML in Preview gets an 'Open in browser' control. It posts a new bridge kind, open-html-external, so open-external stays https-only; both webview shells forward it, and the extension opens the path with the system handler only when it is an absolute, existing, local .html/.htm file in a local window. Every refusal (relative path, wrong type, missing file, remote window) names itself in a warning; nothing opens. Part of #2140.
The research skill gains the dashboard contract: one static HTML page per campaign, a derived view of the ledger rewritten at kickoff and every record step - status line, needs-you, loop table (verdicts copied, never upgraded), key findings, plots as sibling files - static only (Preview renders it with no scripts), linked once in chat as a file:// link. In a Research Project it lives under reports/dashboards/, otherwise under ~/.amico/dashboards/ (never the synced vault). The mode card (and its legacy mirror) points the record step at the page instead of the nonexistent dashboard widget. Part of #2140.
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Live campaign dashboard (#2140): Preview renders HTML, keeps it live, and pops it out to the browser; the research loop writes the page.
Closes #2141 · Closes #2142 · Closes #2143 · Closes #2144 · Part of #2140
What changes
.html/.htm(Preview renders HTML files (sandboxed, scripts off, local images inlined) #2141). The page runs in an iframe sandboxedallow-same-originwithoutallow-scripts: scripts, inline handlers and meta refresh never run, while the host routes link clicks (https opens the system browser, local links open in Preview), applies zoom and keeps scroll. Before display the host strips script/base/refresh/link/embedding elements and inlines local images (relative, absolute,file://;img srcand SVGimage href) as data URIs read through the engine file API, within a count and size budget. Rendered/Source toggle as for Markdown.open-html-external, soopen-externalstays https-only. Both webview shells forward it. The extension opens the file only when it is an absolute, existing, local.html/.htmfile in a local window; every refusal shows a warning that says why.reports/dashboards/in a Research Project,~/.amico/dashboards/otherwise, never the synced vault. The mode card and its legacy mirror now point the record step at the page.Not in scope
allow-scriptson this frame.file://link already does it.campaign-digesttile (its feeds are not served by the engine server).Verification
./.notturno/gates(base origin/main): GREEN. Covers drift, typecheck, build, and vitest:extension (5801 tests).pnpm --filter amicode test: 345 files, 5815 tests passed.bun testforsrc/components/sessiongives 286 pass, 0 fail. session-ui routing and markdown-utils tests pass.tsgo -bis clean.vite buildsucceeds, and the bundle contains the view.build:binary: DONE.atd-mitten168/.../carried/status.html) with an injected script, meta refresh and a local plot, under the app's CSP. The page renders (17 table rows), the script did not run, the plot was inlined and decoded, meta refresh never reloaded the page (1 load), link clicks were intercepted and classified, and the frame stayed atabout:srcdoc. An earlier probe confirmed that the parent can read the frame and its listeners fire while inline scripts andonerrorhandlers in the frame stay inert.