Until now a running instance was reachable only from inside the Docker network:
the browser-mcp could see it, a human could not. That was the hole under the
whole human-evaluation node - it asks somebody to judge software, with no
software to judge.
The route rides the gateway that already exists, on 443 with the certificate
already issued, rather than publishing a port per execution. Twenty open ports
on an institutional VM is the kind of thing a firewall refuses; one path does
not. The cost is that the previewed application lives under a prefix, which is
acceptable here because the agent writes it under our own instructions.
Authorisation is the part that needed care. A browser attaches no bearer token,
and the execution key is no secret - rootExecutionId is on screen in the editor
and in every event the flow logs - so each preview carries a token of its own,
issued when the service starts, swapped on first visit for an HttpOnly cookie
scoped to that one preview's path, and gone from the address bar afterwards so
it cannot travel onward in Referer. A restart invalidates the previous link,
because a port handed back to the allocator could be serving someone else.
One defect found by walking the whole path through the real gateway rather than
testing the proxy alone: the redirect pointed at the path the proxy receives,
which the gateway has already stripped, so the browser was sent out of the mount
into the gateway's own 404. The cookie had assumed the prefix and the redirect
had not. The mount is now one parameter feeding both, with a test on the
Location header that the first round had no reason to have.
Verified end to end against the stack: link opened, cookie set, navigation
inside the application arriving at the path it expects, and 403 for anyone
holding the key but not the link.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
They were three folders on one laptop: a coding agent with a git history of its
own, and two servers - a development server and a browser - with none at all.
What makes them a stack is what sits between them, and that lived nowhere: the
compose file, the gateway, the egress proxy and the networks that keep the worker
off the internet. So the whole thing is one repository, and the coding agent's
separate history is folded into it rather than kept alongside.
What is deliberately absent: .env, node_modules, and the live service
definitions. The .example files next to them say what belongs there.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Lucio Lelii