feat(webui): sandboxed iframe panel primitive (#830 Phase 3) - #2640

Greptile Summary

This PR introduces the Phase 3 frontend primitive for sandboxed iframe plugin panels: type definitions, a strict security policy (isAllowedIframeSrc, resolveSandbox, iframeSrcOrigin), the SandboxedIframePanel React component, and 18 unit tests. Previously flagged issues (sandbox escape via allow-scripts+allow-same-origin, bootstrap spread order, fail-open origin gate, uncapped resize height) are all addressed in the latest commit.

• iframePanelPolicy.ts enforces an allowlist covering only localhost origins and server-relative paths, filters sandbox tokens, and unconditionally drops allow-same-origin when allow-scripts is also requested.
• SandboxedIframePanel.tsx manages the bootstrap handshake (origin-gated gptme:ready → gptme:bootstrap), auto-resize capped at 16 000 px, and a blocked-placeholder fallback for disallowed sources.
• Types (panel.ts) provide IframePanelDescriptor, GptmeIframeMessage, and a runtime type guard consumed by the component.

Confidence Score: 4/5

Safe to merge for the localhost-URL use case; server-relative-path panels with scripting will silently fail the bootstrap handshake and should be verified before that path is exercised in production.

The component derives expectedOrigin from descriptor.src alone. For server-relative paths, iframeSrcOrigin returns the host window origin, but resolveSandbox drops allow-same-origin when allow-scripts is present, leaving the iframe with an opaque origin. Every gptme:ready message arrives with event.origin of null which the gate rejects, so bootstrap never completes for that path. Localhost absolute-URL descriptors are unaffected.

The expectedOrigin derivation in SandboxedIframePanel.tsx and the interaction between resolveSandbox and iframeSrcOrigin in iframePanelPolicy.ts.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Host as SandboxedIframePanel
    participant Policy as iframePanelPolicy
    participant Frame as Plugin iframe

    Host->>Policy: isAllowedIframeSrc(src)
    Policy-->>Host: allowed / blocked
    alt src blocked
        Host-->>Host: render blocked placeholder
    else src allowed
        Host->>Policy: resolveSandbox(sandbox tokens)
        Policy-->>Host: filtered sandbox string
        Host->>Policy: iframeSrcOrigin(src)
        Policy-->>Host: expectedOrigin
        Host->>Frame: render iframe with sandbox and src
        Frame->>Host: gptme:ready
        Note over Host: validate origin and source
        Host->>Frame: gptme:bootstrap with conversation_id
        Frame->>Host: gptme:resize with height
        Note over Host: cap at min(height, 16000)
        Host-->>Host: setAutoHeight
    end

_{Reviews (2): Last reviewed commit: "fix(webui): address Greptile P1 security..." | Re-trigger Greptile}

@greptileai review

Re: Greptile 4/5 finding — server-relative path + opaque origin

Good catch. The analysis is correct: when allow-scripts is in the sandbox but allow-same-origin is dropped (by the dangerous-combination guard), a server-relative-path iframe sees its own origin as opaque, so gptme:ready's event.origin is the string "null" rather than the host origin — the gate rejects it and bootstrap never completes.

The primary intended use case for this phase is localhost absolute-URL tool servers (e.g. http://localhost:8080/panel), which are unaffected. Server-relative paths without scripted bootstrap also work fine (read-only embeds, static content).

The broken path: server-relative src + allow-scripts + bootstrap handshake. That combination requires allow-same-origin to give the iframe a real origin, but allow-same-origin + allow-scripts on a same-origin src is the exact sandbox escape we guard against. The two requirements are mutually exclusive under the current policy.

Follow-up (Phase 3c or iteration): add a test explicitly documenting this limitation and consider exposing a validation warning when a descriptor requests allow-scripts on a server-relative src, so tool authors get early feedback instead of a silent handshake failure.