[theogravity]

Subshells can preview their dev servers, browser frames, and Linux virtual displays in independent workspace tabs. Open the picker from the terminal or subshell header; each selected resource initially splits to the right of its terminal and appears beneath its subshell in the sidebar. Reopening it focuses the existing tab. Tabs can be moved, split, maximized, and restored without closing the terminal or sibling previews.

The compact viewer toolbar keeps status and refresh beside an action menu. Restore pane and Exit full screen appear directly while active. The picker uses compact rows, sorted ports, search for large lists, and a bounded app list. Virtual display launch checks the selected machine's platform, Preview setting, and Xvfb/x11vnc/xauth prerequisites before enabling the checkbox; missing programs show gold guidance. Preview supports enrolled nodes and the server's built-in node. Phone tabs preserve the desktop layout.

The website now introduces this workflow directly below the mobile video: a real Codex agent fixes and tests a website's category filters, then the developer checks the result beside the terminal. The 31.5-second silent recording, poster, and three guide screenshots come from a disposable sample stack. Public docs cover setup, workspace controls, browser compatibility, security, architecture, and protocol 23. Internal architecture and security docs record implementation boundaries and the audit evidence.

Security review

The targeted source and browser review found and fixed these issues:

• Isolate proxied website scripts from dashboard DOM, storage, cookies, service workers, and authenticated API responses, including direct browser tabs.
• Restrict view-only browser watches to the discovered CDP port, including an edit-to-view downgrade during opening. Repeat authorization if a revocation sweep overtakes its permission read.
• Strip dashboard HTTP/edge credentials and origin-wide target response policy headers; keep target cookies only in the server-side preview jar.
• Revoke previews before explicit terminate, delete, and restart, then sweep again after retiring the old row. Pending opens participate in share, account, pane, and node revocation and recheck current authorization before publication.
• Recheck live-screen subscriptions if revocation overtakes their permission read; refuse disabled accounts before their sockets finish closing.
• Clean up allocated node references after timed-out or malformed open replies.
• Refuse CDP discovery redirects and foreign loopback ports, cap discovery JSON, abort cancelled discovery, and count pending handshakes toward capacity.
• Bound HTTP reader queues, unread lane bytes, fragmented application WebSocket messages, browser WS debt, target TCP write queues, and target cookie jars; stream large HTTP chunks and reject malformed or truncated framing.
• Strip target reporting and client-hint headers that could install policies on the dashboard origin.
• Bound image dimensions before canvas allocation and JPEG/PNG decoding; guard noVNC rendering queues and consume unused clipboard messages without decompression.
• Check encrypted WebSocket buffer debt before sealing preview frames; close after a failed sealed write and never silently discard TCP bytes.
• Cap retained forwarding capabilities at 64 and pending opens at 32 per node; bound discovery caching.
• Skip occupied host X display numbers and verify saved process identity before display recovery or cleanup.
• Redact complete preview capability references from runtime diagnostics.

Preview URLs remain bearer capabilities. Closing a tab does not immediately revoke its copied URL, and switching Preview off blocks new operations without draining existing connections. The server can read preview traffic. Loopback RFB has no separate password, so virtual displays are unsuitable for hosts shared with untrusted local OS users. Opaque browser isolation limits storage, service workers, and some login flows; the node browser through Virtual display supplies a normal browser context. Custom edge authentication headers outside recognized families require operator filtering. These limits and review scope are documented in docs/security.md §11.15 and docs/security-actionable.md.

Validation

• Affected suites passed: 4,735 server tests, 1,254 node tests, 538 shared-runtime tests, 555 protocol tests, 3,055 web tests, and 170 docs tests. The aggregate run hit a frontend rebuild/test collision; the server suite passed independently after the build.
• Eight held-ack revocation regressions failed before the fix and passed afterward. Additional regressions cover publication reauthorization, CDP redirects and port pivots, cancellation, oversized discovery, slow readers, malformed chunk framing, fragmented WebSocket limits, cookie eviction, and response-policy filtering. Further regressions cover stale live-screen subscriptions, account disable before socket closure, bounded authorization retries, stalled target writes, and cleanup after uncertain replies.
• All 56 type/build dependency tasks passed. Website and docs static builds passed; all 122 documentation pages passed export verification.
• Chromium regressions passed for embedded and direct preview isolation, ES modules, JSON POST/preflight, application WebSockets, and immediate URL revocation after deletion.
• Real enrolled-node forwarding and browser-watch handshake passed end to end. A real Chromium screencast delivered 12 accepted frames; real PNG/JPEG captures passed the decoder guards, and noVNC rendered a real 1280×800 screen through the built-in node.
• Desktop and phone video placement, playback, pause/resume, overflow, and docs rendering without JavaScript checked. CUA checked the website player and guide; prior CUA coverage exercised app/screen tabs, sidebar leaves, splits, restore actions, simultaneous views, and persistence.
• Lint, license boundaries, design tokens, prose checks, and pre-push checks passed.

A fresh review after the fixes found no additional high- or medium-severity issues within the preview threat model. Two existing high dependency advisories remain in Expo tooling (node-forge 1.4.0 and Zod 3.25.76), outside the shipped preview runtime; the audit record includes their upstream links and follow-up constraints. The repository-wide dependency audit is not clean.

This is a targeted audit and regression pass, not an independent penetration test. Native macOS behavior, all browser engines, and every framework-specific HMR/login flow remain outside the tested scope.