fix preview sandbox and local analytics proxy

mindspace-chat-save.test.mjs

@@ -117,6 +117,24 @@ test('buildChatSavePreviewUrls use local api routes', () => {
   );
 });
 
+test('chat page previews keep generated scripts sandboxed and proxy analytics through Portal', async () => {
+  const [pageSavePreview, chatSharePreview, viteConfig] = await Promise.all([
+    fs.readFile(new URL('./src/components/PageSavePreviewPanel.tsx', import.meta.url), 'utf8'),
+    fs.readFile(new URL('./src/components/ChatSharePreviewModal.tsx', import.meta.url), 'utf8'),
+    fs.readFile(new URL('./vite.config.ts', import.meta.url), 'utf8'),
+  ]);
+
+  assert.match(pageSavePreview, /sandbox="allow-scripts allow-downloads"/);
+  assert.match(chatSharePreview, /sandbox="allow-scripts allow-popups allow-downloads"/);
+  for (const source of [pageSavePreview, chatSharePreview]) {
+    assert.doesNotMatch(
+      source,
+      /sandbox="[^"]*(?:allow-scripts[^"]*allow-same-origin|allow-same-origin[^"]*allow-scripts)[^"]*"/,
+    );
+  }
+  assert.match(viteConfig, /['"]\/analytics['"]\s*:\s*portalTarget/);
+});
+
 test('findPublishHtml resolves nested public html by basename', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'memind-chat-save-'));
   const publishDir = path.join(root, 'MindSpace', USER_ID, 'public');

src/components/ChatSharePreviewModal.tsx

@@ -139,7 +139,7 @@ export function ChatSharePreviewModal({
         <button type="button" className="chat-share-preview-close" onClick={onClose} aria-label="关闭">✕</button>
       </div>
       <div className="chat-share-preview-body">
-        <iframe src={previewUrl} title="页面预览" sandbox="allow-same-origin allow-scripts allow-popups allow-downloads" className="chat-share-preview-frame" />
+        <iframe src={previewUrl} title="页面预览" sandbox="allow-scripts allow-popups allow-downloads" className="chat-share-preview-frame" />
 
         <div className="chat-share-side-actions">
           {phase.kind === 'done' ? (

src/components/PageSavePreviewPanel.tsx

@@ -112,7 +112,7 @@ export function PageSavePreviewPanel({
               title="页面预览"
               src={pagePreviewUrl}
               className="page-save-mini-page-frame"
-              sandbox="allow-scripts allow-same-origin allow-downloads"
+              sandbox="allow-scripts allow-downloads"
               scrolling="yes"
               onError={() => setPreviewFailed(true)}
             />

vite.config.ts

@@ -17,6 +17,7 @@ export default defineConfig(({ mode }) => {
       proxy: {
         '/api': portalTarget,
         '/auth': portalTarget,
+        '/analytics': portalTarget,
         '/admin-api': adminTarget,
         '/MindSpace': portalTarget,
         '/dev': portalTarget,