fix(web): break redirect-loop scripts that freeze the HTML preview (#5469)

* fix(web): break redirect-loop scripts that freeze the HTML preview

A generated or hand-edited artifact carrying a self-redirecting directive
— most reliably a `<meta http-equiv="refresh">` that reloads the same
document, or a cycle of meta refreshes (A -> B -> A -> ...) — reloads the
preview iframe forever and pegs the main thread until the whole design
workspace freezes. There was no loop detection or hop limit, so the
preview stayed unusable.

Add an in-iframe circuit breaker (`injectPreviewRedirectGuard`, always
injected by `buildSrcdoc`) that counts meta-refresh hops in `window.name`
— the one store that survives an iframe navigating itself — resets the
count once a full window elapses with no further refresh (timeout
safeguard so a slow legitimate auto-refresh never accumulates), and once
the hop budget is exceeded, or immediately for a near-instant
self-refresh, strips the offending `<meta>`, stops the frame, and posts
`od:redirect-loop-blocked` to the host. The host parks the srcDoc iframe
on a static "loop detected" placeholder, the reliable stop the browser's
unforgeable `window.location` otherwise denies.

Route any self-redirecting source onto the srcDoc path
(`htmlNeedsRedirectGuard`) so the guard is always present instead of the
URL-load path serving the document raw and unguarded.

Covered by a runtime spec that runs the real injected guard through a VM
modelling a sandboxed iframe reloading itself (hop budget, window reset,
immediate self-refresh kill, chain-break, host message) plus render-mode
detection specs.

Source: https://plane.powerformer.net/open-design/projects/49832a02-3158-4faf-bf2f-d0e39c40c7e6/issues/94709b20-f403-4ed7-a960-1e26572fa394

Generated-By: looper 0.0.0-dev (runner=worker, agent=claude-code)

* fix(web): cover srcdoc redirect guard gaps

* fix(web): avoid redirect guard false positives

Author: lefarcen

apps/web/src/components/FileViewer.tsx

@@ -117,7 +117,13 @@ import { copyToClipboard } from '../lib/copy-to-clipboard';
 import { buildReactComponentSrcdoc } from '../runtime/react-component';
 import { shouldConsumeSlideNav } from '../runtime/slide-nav';
 import { findHtmlEntriesReferencing } from '../runtime/jsx-module-refs';
-import { buildLazySrcdocTransport, buildSrcdoc, canActivateSrcDocTransport } from '../runtime/srcdoc';
+import {
+  buildLazySrcdocTransport,
+  buildRedirectLoopBlockedDoc,
+  buildSrcdoc,
+  canActivateSrcDocTransport,
+  PREVIEW_REDIRECT_LOOP_MESSAGE,
+} from '../runtime/srcdoc';
 import { DeckThumbnailRail } from './DeckThumbnailRail';
 import { parseDeckThumbnails } from '../runtime/deck-thumbnail-parser';
 import {
@@ -135,6 +141,7 @@ import {
   hasUrlModeBridge,
   htmlNeedsFocusGuard,
   htmlNeedsPoweredPreview,
+  htmlNeedsRedirectGuard,
   htmlNeedsSandboxShim,
   parseForceInline,
   shouldUrlLoadHtmlPreview,
@@ -7058,6 +7065,19 @@ function HtmlViewer({
     const s = routingHtmlSource;
     return s != null && htmlNeedsFocusGuard(s);
   }, [passiveLargeHtmlPreview, routingHtmlSource]);
+  // A self-redirecting artifact must render through srcDoc so buildSrcdoc's
+  // redirect-loop guard is present; on the raw URL-load path the iframe reloads
+  // itself forever and freezes the workspace (nexu-io/open-design#710).
+  const needsRedirectGuard = useMemo(() => {
+    if (passiveLargeHtmlPreview) return false;
+    const s = routingHtmlSource;
+    return s != null && htmlNeedsRedirectGuard(s);
+  }, [passiveLargeHtmlPreview, routingHtmlSource]);
+  // Set by the injected guard's `od:redirect-loop-blocked` postMessage. The
+  // browser makes `window.location` unforgeable, so a runaway reload can only be
+  // stopped host-side — parking the srcDoc iframe on static content below. File-
+  // scoped: reset whenever the file, project, or reload key changes.
+  const [redirectLoopBlocked, setRedirectLoopBlocked] = useState(false);
   // Project file paths, for confirming root-relative asset refs
   // (`/reference-assets/main.css`) against real files instead of guessing
   // from path shape. `null` while the list is in flight — the detection memo
@@ -7106,6 +7126,7 @@ function HtmlViewer({
     drawMode: drawOverlayOpen,
     forceInline: (forceInline || needsSandboxShim) && !needsPowered,
     needsFocusGuard: needsFocusGuard && !needsPowered,
+    needsRedirectGuard: needsRedirectGuard && !needsPowered,
     projectRootAssetRefs,
   };
   const useUrlLoadPreview = shouldUrlLoadHtmlPreview(urlLoadDecision) && !manualEditRequiresSrcDoc;
@@ -7184,6 +7205,28 @@ function HtmlViewer({
   useEffect(() => {
     iframeRef.current = useUrlLoadPreview ? urlPreviewIframeRef.current : srcDocPreviewIframeRef.current;
   }, [useUrlLoadPreview]);
+  // Clear a redirect-loop park whenever the artifact changes or the user hits
+  // reload (reloadKey bump): the previewed content is fresh, so give it a clean
+  // run rather than staying pinned on the "loop detected" placeholder.
+  useEffect(() => {
+    setRedirectLoopBlocked(false);
+  }, [projectId, file.name, reloadKey]);
+  // The injected redirect guard posts `od:redirect-loop-blocked` when a preview
+  // reloads itself past its hop budget. Only trust our own two preview frames,
+  // then park the srcDoc iframe on static content so the loop cannot continue.
+  useEffect(() => {
+    function onMessage(ev: MessageEvent) {
+      const fromPreview =
+        ev.source === srcDocPreviewIframeRef.current?.contentWindow ||
+        ev.source === urlPreviewIframeRef.current?.contentWindow;
+      if (!fromPreview) return;
+      const data = ev.data as { type?: string } | null;
+      if (data?.type !== PREVIEW_REDIRECT_LOOP_MESSAGE) return;
+      setRedirectLoopBlocked(true);
+    }
+    window.addEventListener('message', onMessage);
+    return () => window.removeEventListener('message', onMessage);
+  }, []);
 
   // Resolve the cross-origin powered-preview URL for artifacts that need it.
   // `resolved:false` means the (cached) daemon isolation probe is still in
@@ -7414,7 +7457,16 @@ function HtmlViewer({
   // re-load. Direct-mount path (no #2361/#2791 postMessage race).
   const useLazySrcDocTransport =
     !manualEditRequiresSrcDoc && !captureModeActive && useUrlLoadPreview && !srcDocMaterialized;
-  const srcDocTransportContent = useLazySrcDocTransport ? lazySrcDocTransport : srcDoc;
+  // Park on a static "loop detected" document once the guard reports a runaway
+  // redirect. A self-redirecting artifact is forced onto the srcDoc iframe by
+  // `needsRedirectGuard`, so swapping this content is the reliable stop — the
+  // placeholder carries no redirect, so the frame settles the moment it loads.
+  const redirectLoopBlockedDoc = useMemo(() => buildRedirectLoopBlockedDoc(), []);
+  const srcDocTransportContent = redirectLoopBlocked
+    ? redirectLoopBlockedDoc
+    : useLazySrcDocTransport
+      ? lazySrcDocTransport
+      : srcDoc;
   // Materialize the srcDoc iframe the first time it actually becomes the active
   // (visible) transport — i.e. the first Mark/Edit/Comment/Inspect entry. We do
   // NOT pre-render it while hidden/idle: that ran a second live copy during

apps/web/src/components/file-viewer-render-mode.ts

@@ -64,6 +64,14 @@ export interface UrlLoadDecision {
    * so `injectPreviewFocusGuard` can suppress the focus grab.
    */
   needsFocusGuard?: boolean;
+  /**
+   * The HTML source contains a self-redirecting directive (a
+   * `<meta http-equiv="refresh">`, or a load-time `location` navigation /
+   * `location.reload()`) that can loop forever and freeze the preview. When
+   * true, forces the srcDoc path so `injectPreviewRedirectGuard` (injected by
+   * buildSrcdoc) is present to detect and break the loop.
+   */
+  needsRedirectGuard?: boolean;
 }
 
 /**
@@ -105,6 +113,10 @@ export function shouldUrlLoadHtmlPreview(d: UrlLoadDecision): boolean {
   if (d.tweaksBridge) return false;
   if (d.forceInline) return false;
   if (d.needsFocusGuard) return false;
+  // A self-redirecting document must go through srcDoc so buildSrcdoc's
+  // redirect-loop guard is in place; URL-load serves it raw with no guard and
+  // the iframe reloads itself forever (nexu-io/open-design#710).
+  if (d.needsRedirectGuard) return false;
   // Root-relative project asset refs only resolve after the srcDoc pipeline
   // normalizes them (normalizeRootRelativeProjectAssetRefs); the URL-load
   // path serves the document untouched and the browser 404s each asset.
@@ -257,3 +269,40 @@ export function htmlNeedsSandboxShim(source: string): boolean {
   if (/<script\s[^>]*?\bsrc\s*=/i.test(source)) return true;
   return false;
 }
+
+/**
+ * Return true when the HTML source contains a self-redirecting directive that
+ * can loop forever and freeze the preview iframe (nexu-io/open-design#710).
+ * When true, FileViewer forces the srcDoc path so buildSrcdoc's
+ * `injectPreviewRedirectGuard` is present to detect and break the loop — the
+ * URL-load path serves the document untouched and has no such guard.
+ *
+ * Detection covers the two families that produce the freeze:
+ *
+ *   1. `<meta http-equiv="refresh">` — the canonical HTML redirect; a
+ *      self-target or a cycle reloads the frame endlessly.
+ *   2. Load-time `location` navigation — `location.reload()`,
+ *      `location.replace(...)`, `location.assign(...)`, or assigning
+ *      `location`/`location.href`/`window.location`. Any of these run at parse
+ *      time can re-navigate the frame in a loop. External `<script src=...>`
+ *      already routes through srcDoc via `htmlNeedsSandboxShim` /
+ *      `htmlNeedsFocusGuard`, so a redirect hidden in a linked file is covered
+ *      too.
+ *
+ * Pure string scan over the same `source` already fetched for preview — no
+ * extra I/O. Heuristic by design: a false positive just takes the (guarded,
+ * slightly slower) srcDoc path, which is the safe direction; a false negative
+ * is the same unguarded preview as before.
+ */
+export function htmlNeedsRedirectGuard(source: string | null | undefined): boolean {
+  if (!source) return false;
+  // <meta http-equiv="refresh" ...> in any attribute order / quoting.
+  if (/<meta\b[^>]*\bhttp-equiv\s*=\s*["']?\s*refresh\b/i.test(source)) return true;
+  // location.reload() / location.replace(...) / location.assign(...).
+  if (/\blocation\s*\.\s*(?:reload|replace|assign)\s*\(/i.test(source)) return true;
+  // location.href = ...  (an assignment, not a read — `=` not followed by `=`).
+  if (/\blocation\s*\.\s*href\s*=[^=]/i.test(source)) return true;
+  // window.location = ... / document.location = ... / self|top|parent.location = ...
+  if (/\b(?:window|document|self|top|parent)\s*\.\s*location\s*=[^=]/i.test(source)) return true;
+  return false;
+}