From 54637beffb2e344e706e2ed44ee8ec2bb127cabd Mon Sep 17 00:00:00 2001
From: john <cynell@139.com>
Date: Fri, 24 Jul 2026 14:21:06 +0800
Subject: [PATCH] fix preview sandbox and local analytics proxy

---
 mindspace-chat-save.test.mjs             | 18 ++++++++++++++++++
 src/components/ChatSharePreviewModal.tsx |  2 +-
 src/components/PageSavePreviewPanel.tsx  |  2 +-
 vite.config.ts                           |  1 +
 4 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/mindspace-chat-save.test.mjs b/mindspace-chat-save.test.mjs
index d35c292..09f1706 100644
--- a/mindspace-chat-save.test.mjs
+++ b/mindspace-chat-save.test.mjs
@@ -117,6 +117,24 @@ test('buildChatSavePreviewUrls use local api routes', () => {
   );
 });
 
+test('chat page previews keep generated scripts sandboxed and proxy analytics through Portal', async () => {
+  const [pageSavePreview, chatSharePreview, viteConfig] = await Promise.all([
+    fs.readFile(new URL('./src/components/PageSavePreviewPanel.tsx', import.meta.url), 'utf8'),
+    fs.readFile(new URL('./src/components/ChatSharePreviewModal.tsx', import.meta.url), 'utf8'),
+    fs.readFile(new URL('./vite.config.ts', import.meta.url), 'utf8'),
+  ]);
+
+  assert.match(pageSavePreview, /sandbox="allow-scripts allow-downloads"/);
+  assert.match(chatSharePreview, /sandbox="allow-scripts allow-popups allow-downloads"/);
+  for (const source of [pageSavePreview, chatSharePreview]) {
+    assert.doesNotMatch(
+      source,
+      /sandbox="[^"]*(?:allow-scripts[^"]*allow-same-origin|allow-same-origin[^"]*allow-scripts)[^"]*"/,
+    );
+  }
+  assert.match(viteConfig, /['"]\/analytics['"]\s*:\s*portalTarget/);
+});
+
 test('findPublishHtml resolves nested public html by basename', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'memind-chat-save-'));
   const publishDir = path.join(root, 'MindSpace', USER_ID, 'public');
diff --git a/src/components/ChatSharePreviewModal.tsx b/src/components/ChatSharePreviewModal.tsx
index 4362bfc..82d5b62 100644
--- a/src/components/ChatSharePreviewModal.tsx
+++ b/src/components/ChatSharePreviewModal.tsx
@@ -139,7 +139,7 @@ export function ChatSharePreviewModal({
         <button type="button" className="chat-share-preview-close" onClick={onClose} aria-label="关闭">✕</button>
       </div>
       <div className="chat-share-preview-body">
-        <iframe src={previewUrl} title="页面预览" sandbox="allow-same-origin allow-scripts allow-popups allow-downloads" className="chat-share-preview-frame" />
+        <iframe src={previewUrl} title="页面预览" sandbox="allow-scripts allow-popups allow-downloads" className="chat-share-preview-frame" />
 
         <div className="chat-share-side-actions">
           {phase.kind === 'done' ? (
diff --git a/src/components/PageSavePreviewPanel.tsx b/src/components/PageSavePreviewPanel.tsx
index 007963d..65fb3ac 100644
--- a/src/components/PageSavePreviewPanel.tsx
+++ b/src/components/PageSavePreviewPanel.tsx
@@ -112,7 +112,7 @@ export function PageSavePreviewPanel({
               title="页面预览"
               src={pagePreviewUrl}
               className="page-save-mini-page-frame"
-              sandbox="allow-scripts allow-same-origin allow-downloads"
+              sandbox="allow-scripts allow-downloads"
               scrolling="yes"
               onError={() => setPreviewFailed(true)}
             />
diff --git a/vite.config.ts b/vite.config.ts
index 7ac703c..628f2e5 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -17,6 +17,7 @@ export default defineConfig(({ mode }) => {
       proxy: {
         '/api': portalTarget,
         '/auth': portalTarget,
+        '/analytics': portalTarget,
         '/admin-api': adminTarget,
         '/MindSpace': portalTarget,
         '/dev': portalTarget,