Inbox: allow embedding the Inbox window in a trusted host (configurable frame-ancestors)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 45/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- electron, typescript
调研方向
Start with the Inbox server's response headers, where X-Frame-Options: DENY and frame-ancestors 'none' are set, and with the existing buildFrameAncestorsPolicy in the preview proxy as the pattern to follow. Add an opt-in value from PLANNOTATOR_INBOX_FRAME_ANCESTORS or --frame-ancestors, leaving the default unchanged. Done means that with the setting unset the headers are identical to today, and with it set frame-ancestors is sent and X-Frame-Options is dropped, while the same-origin write checks still pass.
由索引模型根据 Issue 内容生成。
描述
Problem
The Inbox server answers every page with X-Frame-Options: DENY and frame-ancestors 'none'. That is the right default, but it blocks a legit setup: showing the Inbox (and the Board, #board) inside a local agent desktop app, next to the chat that writes to it. Today the only way is a local reverse proxy that strips those headers and rewrites Origin/Host so the Inbox's same-origin check still passes. It works, but every user who wants this has to rebuild the Inbox's CSRF and DNS-rebinding checks in the proxy, which is easy to get wrong.
Plannotator already does this for editors: the preview proxy sets frame-ancestors <editor origins> (buildFrameAncestorsPolicy). The Inbox has no equivalent.
Proposal
An opt-in setting, for example PLANNOTATOR_INBOX_FRAME_ANCESTORS (env) or plannotator inbox --frame-ancestors "<origins>":
- when unset, nothing changes (
DENY/'none'); - when set, the Inbox sends
frame-ancestors <value>and dropsX-Frame-Options, and nothing else changes: the cross-origin check on writes stays as it is, because the framed page is still same-origin with the server.
Use case
Hermes desktop (Electron) plugin: an "Inbox" and a "Board" page that load http://plannotator.localhost:61738/#board in an iframe, so the person answers threads and moves cards without leaving the agent app. The UI stays the Inbox's own bundle, so it keeps up with plannotator update.
Happy to send a PR if the shape looks right.
- 主要语言
- TypeScript
- 星标
- 8.7k
- 派生
- 649
- 平均合并
- 10 小时 45 分钟
- 30 天内合并 PR
- 830
环境准备
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
backnotprop/plannotator 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 66/100
backnotprop/plannotator#3298 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 66/100
backnotprop/plannotator#2643 · 1 个 reaction ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
backnotprop/plannotator#2243 · 2 条评论 · 2 个 reaction ·
维护者通常 1 天内回复
-
Annotate documentation omits per-file version history and privacy controls可能重新可做 关联的 PR 已关闭且未合并。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
backnotprop/plannotator#1086 · 2 条评论 ·
维护者通常 1 天内回复
-
难度 3/5 半天 新手友好度 45/100
backnotprop/plannotator#3301 · 1 条评论 ·
维护者通常 1 天内回复
查看 backnotprop/plannotator 的全部 Issue
相似的 Issue
-
Resources: Update work of urumqi可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 65/100
railmapgen/rmp-gallery#4176 ·
维护者通常 2 天内回复
-
GraphQL custom headers duplicate differently cased default headers可能已有人在做 @yxr-2025 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 1 天内回复
-
enhancement sharing & sync
难度 1/5 1 小时以内 新手友好度 62/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 66/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
HelpCode-ai/anythingmcp#1659 · 1 条评论 ·
维护者通常 1 天内回复