fix(preview): harden sandbox and transformation

tests/test_smoke.py

@@ -533,3 +533,17 @@ def test_update_apply_spawns_detached_and_refuses_a_second_run(monkeypatch):
 
     # Double-click must not launch a second pull/rebuild over the first.
     assert client.post("/update/apply").json()["started"] is False
+
+
+def test_preview_iframe_cannot_navigate_to_a_network_url():
+    """The child CSP blocks resource loads; the parent CSP must separately
+    block a sandboxed frame from navigating its own browsing context."""
+    index = (REPO_ROOT / "interface" / "web" / "index.html").read_text(encoding="utf-8")
+    markdown = (REPO_ROOT / "interface" / "web" / "src" / "Markdown.jsx").read_text(
+        encoding="utf-8"
+    )
+    assert "frame-src data:" in index
+    assert 'sandbox="allow-scripts"' in markdown
+    assert "encodeURIComponent(doc)" in markdown
+    assert "src={frameUrl}" in markdown
+    assert "srcDoc={doc}" not in markdown

tests/test_tools.py

@@ -514,9 +514,25 @@ def test_asking_for_a_preview_language_or_pointer_interaction_offers_the_tool():
         assert tools.wants_render_preview(prompt), prompt
 
     # Still narrow: ordinary chat must not pay for a tool turn.
-    for prompt in ("what's the weather vibe today", "summarise this email thread"):
+    for prompt in (
+        "what's the weather vibe today",
+        "summarise this email thread",
+        "write a concise paragraph about caching",
+    ):
         assert not tools.wants_render_preview(prompt), prompt
 
+    assert tools.wants_render_preview("compare these graphs")
+
+
+def test_external_preview_resources_are_rejected_in_attributes_and_css():
+    for markup in (
+        '<img src=https://example.com/chart.png alt="chart">',
+        '<style>.chart { background: url("https://example.com/chart.png"); }</style>',
+        '<style>@import "https://example.com/chart.css";</style>',
+    ):
+        issues = tools._critique_shared(markup)
+        assert any("external http(s)" in issue for issue in issues), markup
+
 
 def test_every_preview_language_hints_for_itself():
     for lang in tools.PREVIEW_LANGS: