feat: add web previews and virtual displays to workspace tabs

.changeset/apps-screens-label.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": patch
+"@internal/docs": patch
+"@internal/website": patch
+---
+
+Name the dashboard entry point Apps & screens and its picker Open app or screen, with matching setup guidance and documentation. Keep API and MCP identifiers stable. Simplify the website demonstration and support private development hostnames through local environment settings.

.changeset/compact-dialog-titles.md

@@ -0,0 +1,5 @@
+---
+"@internal/server": patch
+---
+
+Reduce standard dialog titles to 18px and align the close button with the title. Reduce dialog padding to 18px on all sides.

.changeset/compact-rows-one-grammar.md

@@ -0,0 +1,5 @@
+---
+"@internal/server": patch
+---
+
+Use 13px text, 2px vertical padding, and 28px minimum rows for action-menu items.

.changeset/display-provider-abstraction.md

@@ -0,0 +1,9 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+"@internal/docs": patch
+---
+
+Separate virtual display providers from viewer connections and launch settings. Allow node owners to enable multiple display providers and choose a default, with Xvfb + VNC as the initial option. Persist per-subshell provider choices for restart and preserve display requests in presets. Check requirements for the selected provider and preserve existing displays when the selection changes.
+
+Order provider allocation and cleanup per subshell, recheck permission after asynchronous prerequisites, and verify VNC listener ownership during allocation and recovery. Reserve viewer ports before probing to prevent concurrent displays from selecting the same port.

.changeset/explain-disabled-mcp-displays.md

@@ -0,0 +1,6 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+---
+
+Explain when node settings disable a virtual display requested through MCP, and verify independent preview permissions for dashboard and agent access.

.changeset/fix-action-menu-viewport-clamp.md

@@ -0,0 +1,5 @@
+---
+"@internal/server": patch
+---
+
+Fix action menus running past the bottom of the screen. A menu taller than the space available (the subshell actions menu on a phone or short window) is now clamped to the viewport and scrolls within it, instead of its last items falling off the bottom where nothing could reach them.

.changeset/node-feature-documentation-links.md

@@ -0,0 +1,5 @@
+---
+"@internal/docs": patch
+---
+
+Document independent node preview permissions in node management, architecture, MCP, and protocol references.

.changeset/node-view-prerequisites.md

@@ -0,0 +1,5 @@
+---
+"@internal/server": patch
+---
+
+Show Apps & screens prerequisite checks in node settings, including missing virtual display programs, setup guidance, and a Recheck action. Explain platform limitations and make the disabled state visible beside the node's switch.

.changeset/pane-maximize-menu.md

@@ -0,0 +1,5 @@
+---
+"@internal/server": patch
+---
+
+Remove the terminal tab bar’s standalone maximize control and action menu. Keep Restore available for maximized groups.

.changeset/pane-preview.md

@@ -0,0 +1,13 @@
+---
+"@internal/server": major
+"@internal/node": major
+"@internal/docs": patch
+---
+
+Add web previews, browser watching, saved web services, and virtual displays to subshell workspaces. Open each view in its own draggable tab beside the terminal, move it between splits, or use full screen. Closing a preview leaves its terminal and sibling views running.
+
+Node settings independently control web previews and virtual displays. Enabling web previews makes them available to the node’s subshells. Nodes can enable multiple display providers and choose a default. Virtual displays are requested at launch, use the default or a selected enabled provider, and check prerequisites before starting. Xvfb + VNC is the initial provider and requires Linux with Xvfb, x11vnc, and xauth. Presets can save a provider choice. Each subshell keeps its resolved provider and display size on restart, even when the node default changes. Disabling a provider prevents new displays and restarts without stopping existing displays. The server’s built-in node uses the same runtime as enrolled nodes.
+
+Expose feature permissions, display-provider selection, prerequisites, and view controls through MCP. The UI explains disabled features and links to setup documentation. Switching nodes clears incompatible agent and display selections, resets the working directory, and explains the corrections. Preview choices use compact rows with plain port numbers, and phone previews preserve the desktop workspace layout.
+
+Isolate web-preview scripts from dashboard credentials and browser storage, restrict viewers to authorized resources, and revoke views when access changes or subshells stop. Keep target cookies on the server, bound transport buffers and image dimensions, verify display process ownership before cleanup, and redact preview capability references from diagnostics.

.changeset/preview-allocation-authorization.md

@@ -0,0 +1,9 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+"@internal/docs": patch
+---
+
+Close a preview permission-downgrade race, bound image decoding and retained
+resources, and check transport backpressure before encryption. Verify display
+process identity before cleanup and document the additional security review.

.changeset/preview-guide-media.md

@@ -0,0 +1,5 @@
+---
+"@internal/docs": patch
+---
+
+Document website previews, virtual displays, browser isolation, private preview links, and the preview architecture and protocol. Add screenshots captured from an isolated sample project.

.changeset/preview-macos-guide.md

@@ -0,0 +1,6 @@
+---
+"@internal/docs": patch
+---
+
+Explain how Mac users can use Preview with a Linux node, where to install
+virtual-display prerequisites, and which macOS features are unavailable.

.changeset/preview-mcp-capabilities.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+"@internal/docs": patch
+---
+
+Add MCP Preview discovery, private connections, browser watching, and virtual-display launches. Include harness health, SSH/Preview settings, and live display prerequisite checks in node discovery, with owner-only access preserved. Document the workflow and capability-link security boundary.

.changeset/preview-review-fixes.md

@@ -0,0 +1,6 @@
+---
+"@internal/server": patch
+"@internal/docs": patch
+---
+
+Require an authorized browser-watch registration before delivering frames and revoke watches that no longer meet view-only browser restrictions. Preserve virtual-display dimensions across restarts and refuse disabled displays before stopping a live subshell. Buffer early target greetings within bounded lane limits so virtual-display connections cannot lose their handshake.

.changeset/preview-security-followup.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+"@internal/docs": patch
+---
+
+Cancel pending preview opens when access is revoked, and recheck authorization before publishing them. Keep CDP discovery on its requested loopback endpoint. Bound proxy response buffers, fragmented WebSocket messages, and target cookies, and prevent preview targets from installing dashboard reporting policies.

.changeset/preview-subscription-revocation.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+"@internal/docs": patch
+---
+
+Recheck live-screen subscriptions when revocation overtakes their permission check. Limit queued writes to preview targets that stop reading, and clean up node resources after uncertain preview-open replies.

.changeset/rename-web-previews.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+"@internal/docs": patch
+---
+
+Rename apps and browsers to Web previews throughout the dashboard, API and MCP permission fields, node protocol, and documentation.

.changeset/saved-browser-services.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": minor
+"@internal/node": minor
+"@internal/docs": patch
+---
+
+Save HTTP or HTTPS services in Apps & screens, including services started outside a subshell. Open each in its own workspace tab, and remove saved connections without stopping their services. Manual connections work without a virtual display, including on macOS nodes. Node protocol 24 adds explicit destinations and certificate-verified HTTPS.

.changeset/separate-node-preview-permissions.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": minor
+"@internal/node": minor
+"@internal/docs": patch
+---
+
+Separate node permissions for apps and browsers from virtual displays. Apps and browser features apply to every subshell when enabled; virtual displays still require an explicit launch choice. Preserve existing grants, show feature-specific readiness, and enforce both switches on the server and node.

.changeset/sidebar-picker-sizing.md

@@ -0,0 +1,5 @@
+---
+"@internal/server": patch
+---
+
+Match sidebar workspace and grouping dropdown rows to their compact triggers, using 28px rows and 13px text.

.changeset/sticky-launch-actions.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": patch
+---
+
+Keep Cancel and Start subshell visible while scrolling the new subshell form. Cancel and Close discard the draft before the dialog is reopened.
+
+Opening a new subshell no longer automatically reapplies the previous subshell’s preset.

.changeset/subshell-view-api-names.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+"@internal/docs": patch
+---
+
+Name the unreleased Apps & screens API resources views and expose MCP tools list_subshell_views, open_subshell_view, and watch_subshell_browser. Rename node readiness and enablement discovery, align viewer controls and permission labels, and document the persisted and protocol identifiers retained for compatibility.

.changeset/update-zod-validation.md

@@ -0,0 +1,8 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+"@internal/docs": patch
+"@internal/website": patch
+---
+
+Update Zod to 4.6.7 and override Expo CLI’s older Zod dependency to remove the vulnerable version from the dependency tree.

.changeset/view-review-lifecycle.md

@@ -0,0 +1,6 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+---
+
+Prevent late browser-watch requests from reactivating closed or changed views, preserve selected virtual displays during same-node rechecks, and clarify disabled settings and setup guidance. Reject conflicting MCP app/display arguments before creating a connection.

.changeset/virtual-display-explanation.md

@@ -0,0 +1,5 @@
+---
+"@internal/server": patch
+---
+
+Explain when a virtual display is useful and its resource cost beside the launch checkbox.

.changeset/virtual-display-setup-link.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": patch
+"@internal/docs": patch
+---
+
+Link missing virtual-display prerequisites to the setup guide instead of
+listing installation instructions in the launch form.

.changeset/website-preview-demo.md

@@ -0,0 +1,5 @@
+---
+"@internal/website": patch
+---
+
+Add a website preview demonstration directly below the mobile video, showing a real coding agent fixing project filters and checking the result beside its terminal.

apps/client/desktop/ui/src/styles.css

@@ -159,6 +159,8 @@
      not quietly resolve to it. `detail` (13px) is the floor. */
   --text-display: 30px;
   --text-display--line-height: 1.2;
+  --text-dialog-title: 18px;
+  --text-dialog-title--line-height: 1.2;
   --text-heading: 20px;
   --text-heading--line-height: 1.2;
   --text-label: 15px;

apps/client/mobile/AGENTS.md

@@ -67,6 +67,21 @@ exact-pin rule.
 native build works at the repo's pins. Don't "fix" them by guessing; the real
 constraint is the one below.
 
+**Forge carries a security patch.** `patches/node-forge@1.4.0.patch` applies
+the nested DigestAlgorithm validation proposed in
+[digitalbazaar/forge#1152](https://github.com/digitalbazaar/forge/pull/1152).
+No patched release is published yet. The dependency security tests exercise
+Expo’s installed copies under Node, rejecting malformed signatures and
+checking valid signatures and certificates. Replace the patch and remove its
+audit exception when upstream publishes a fixed release.
+
+**Expo CLI uses the root Zod override.** `@expo/cli>zod` pins 4.6.7 because
+Expo 57 still requests Zod 3, which is covered by GHSA-mrhx-c7xc-m3w5.
+Its plugin manifest, plugin output, and MCP command schemas were checked with
+Zod 4, including invalid inputs and JSON Schema conversion. Keep this scoped
+override until Expo requests a patched version itself; when updating the CLI,
+check those schemas as well as the mobile export.
+
 **⚠️ Never let a `*` peer resolve freely.** `expo-router` declares
 `react-native-reanimated: "*"`, so bun installed reanimated 4.6.0, which needs
 `react-native-worklets@0.12.x`, and 0.12 removed

apps/docs/content/docs/automation/rest-api.mdx

@@ -82,3 +82,24 @@ Check both HTTP status and the structured response. After an ambiguous create ti
 ## Next steps
 
 Read [Build an API integration](/automation/integrations) and [Access model](/concepts/access).
+
+## Saved app services
+
+Use these endpoints for services started outside a subshell. A virtual display
+isn't required; the subshell must be running to open the connection.
+
+| Action | Endpoint | Body |
+| --- | --- | --- |
+| List saved connections | `GET /api/subshells/:id/services` | None |
+| Save a connection | `POST /api/subshells/:id/services` | `port`, `protocol` (`http` or `https`), optional `name` and `host` |
+| Open a saved connection | `POST /api/subshells/:id/views/open` | `{ "serviceId": "saved-service-uuid" }` |
+| Remove a saved connection | `DELETE /api/subshells/:id/services/:serviceId` | None |
+
+Host defaults to `localhost` on the subshell's node. HTTPS certificates must be
+trusted by that node. Reading requires subshell view access; saving, opening,
+and removing require edit access and `subshells:execute` for a scoped system key.
+Machine credentials retain their owner-only scope. Removing a saved connection
+revokes its open capabilities without stopping the service. The returned
+`proxyBase` is a private bearer capability; don't put it in logs or public links.
+
+See [Web previews & screens](/guides/preview#add-a-service-started-elsewhere) for the UI flow.

apps/docs/content/docs/concepts/architecture.mdx

@@ -44,6 +44,67 @@ MCP runs beside the agent as a stdio child, using the pane's scoped identity. It
 
 The server relays ciphertext, but terminal output and channel metadata have different security properties.
 
+## Web previews and virtual displays
+
+Web previews & screens brings a subshell's dev server, browser frames, or virtual display into
+the workspace. Your browser connects to the server; it doesn't need direct
+network access to the node's ports.
+
+```mermaid
+%% The dashboard authenticates to the server. App HTTP and WebSocket traffic use a capability URL and a node-side tunnel; CDP JPEG frames return through the authorized live feed. The built-in node uses the same runtime in process.
+flowchart LR
+  B[Dashboard browser] -->|Open preview with user access| S[Server preview broker]
+  B -->|HTTP or WS capability URL| P[Server preview proxy]
+  P <-->|Encrypted preview lanes| N[Node runtime]
+  N <-->|HTTP/S service or loopback RFB| A[Dev server or virtual display]
+  N -->|CDP JPEG frames| S
+  S -->|Authorized live feed| B
+  S -->|In-process adapter| L[Built-in node runtime]
+```
+
+The server checks subshell access and the node's separate web-preview or virtual-display permission before opening
+a view. App forwarding and screen input need edit access. Watching browser
+frames needs view access; view-only shares are restricted to the browser
+discovered for their subshell.
+
+The REST resource is `/api/subshells/:id/views`. Clients open a connection at
+`/views/open` and start or stop browser watching at `/views/browser/watch`.
+Node responses expose `webPreviewsEnabled` for web previews and `virtualDisplayEnabled` for virtual displays.
+Node configuration uses `/views-enabled` with `feature: "web-previews"` or `feature: "display"`,
+and display prerequisites use `/display-readiness`. The corresponding MCP tools
+are `list_subshell_views`, `open_subshell_view`, and `watch_subshell_browser`.
+See the [MCP tool reference](/mcp/tools#list_subshell_views) for their arguments.
+
+For web previews, the server creates a private capability URL and forwards each
+HTTP or WebSocket connection through a lane to loopback or the saved service destination on the execution
+machine. Proxied documents have an opaque browser origin so website scripts
+don't inherit dashboard authority. Target cookies stay in a server-side jar.
+The server's built-in node uses the same discovery, forwarding, CDP, and display
+runtime through an in-process adapter.
+
+Browser watches use Chrome DevTools Protocol to emit JPEG frames. Virtual
+displays use a shared provider interface for requirements, allocation, launch
+settings, recovery, and cleanup. Node owners enable providers and choose a
+default; each subshell can request an enabled provider and saves that choice
+for restarts. Both the server and the node enforce the selection.
+
+The only bundled provider today is **Xvfb + VNC** on Linux. It creates a private
+Xvfb display and loopback x11vnc listener; a separate VNC viewer adapter renders
+and controls the RFB stream with noVNC. Other providers can reuse that viewer
+if they expose VNC. Providers are bundled with Subshell, rather than installed
+through the harness-plugin manager. Local launch credentials stay on the node;
+the server receives only the display identifier and viewer connection. These are separate from the agent's
+terminal stream and from encrypted agent-to-agent channels. The trusted server
+can read preview bytes and frames.
+
+Each app port, browser watch, and display is a separate workspace tab with a
+parent subshell. Desktop previews initially split to the right. The phone tab
+strip leaves the desktop split layout unchanged. Saved layouts retain only
+previews whose parent pane is still authorized and present.
+
+See [Web previews & screens](/guides/preview), [Preview transport](/reference/node-protocol#preview-transport),
+and [Preview security](/concepts/security#preview-security).
+
 ## See also
 
 [MCP and agent communication](/mcp), [Access model](/concepts/access), and [Security model](/concepts/security).

apps/docs/content/docs/concepts/security.mdx

@@ -69,6 +69,44 @@ A view grant can expose credentials printed in terminal output. An edit grant le
 
 Sharing a node is a separate decision: even a view grant on a node permits the recipient to launch their own sessions there. The execution account and machine can access those processes and their files. Sharing a node doesn't automatically share every session on it. See [Access model](/concepts/access), [Share a subshell](/guides/sharing), and [Share a node](/nodes/sharing).
 
+### Preview security
+
+Web previews and virtual displays have separate opt-in settings on each node.
+The node owner also controls which display providers are allowed. A successful
+requirements check doesn't enable a feature or grant permission. App forwarding
+and virtual-screen input need edit access to the subshell. View access permits browser-frame
+watching, restricted to the browser discovered for that shared subshell.
+
+Forwarded websites run in an opaque-origin browser sandbox, including when
+opened in a separate browser tab. Their scripts can't read the dashboard DOM,
+storage, or authenticated API responses. Target cookies stay in a per-preview
+server-side jar rather than being installed on the dashboard origin. Browser
+storage, service workers, and some website login flows need the node's normal
+browser context; use **Virtual display** for those checks.
+
+The preview URL is a bearer access link. Anyone who obtains it can use it while
+it remains valid. Keep it out of public issues, shared browser history, and
+reverse-proxy access logs. Closing the tab releases its connections but doesn't
+immediately revoke a copied link. Forward sessions expire after 15 minutes
+without traffic; grant removal, account disable, subshell death, and node loss
+also cut off affected access. Switching Web previews & screens off prevents new operations,
+but isn't an emergency close for existing connections.
+
+The server sees forwarded website bytes and browser frames. The node link is
+encrypted, but this is not end-to-end encryption from your browser to the app.
+Automatically discovered apps use loopback. Saved services can reach an explicit host from the node, with edit access and node opt-in required. HTTPS connections validate the destination certificate on the node. Saving a service does not expose a new public listener.
+Edit access retains the execution account's authority over its local services;
+port discovery isn't an OS isolation boundary.
+
+Linux virtual displays use a private Xauthority file and a loopback-only RFB
+listener. That RFB listener has no separate password, so other local users able
+to reach it can control the screen. Don't enable virtual displays on a host
+shared with untrusted local OS users. GUI apps and agents retain their normal
+execution-account permissions.
+
+Follow [Web previews & screens](/guides/preview) for setup and the
+[preview architecture](/concepts/architecture#web-previews-and-virtual-displays) for the data path.
+
 ### Machine credentials
 
 Credentials serve different purposes:

apps/docs/content/docs/guides/meta.json

@@ -5,6 +5,7 @@
     "navigation",
     "launch",
     "ssh",
+    "preview",
     "lifecycle",
     "workspaces",
     "clone",