Ship file viewer, editor improvements, and private package releases

packages/core/README.md

@@ -224,7 +224,7 @@ broadcasts and `toUser` cross the bridge.
 Config types: `SecurityConfig` (top-level), `CorsConfig`/`CorsOrigin`,
 `ContentSecurityPolicyConfig`/`CspDirectiveValue`, `HstsConfig`,
 `TrustedTypesConfig`, `PermissionsPolicyConfig`. WrNexus applies sensible
-defaults (self-only CSP, `frame-ancestors 'none'`, restrictive Permissions-Policy,
+defaults (self-only CSP, `frame-ancestors 'self'`, restrictive Permissions-Policy,
 HSTS in production, Trusted Types in production); each is individually
 overridable or disable-able via `false`.
 

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/core",
-  "version": "0.8.12",
+  "version": "0.8.13",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/core/src/headers.ts

@@ -91,7 +91,7 @@ export interface SecurityConfig {
   trustedTypes?: false | TrustedTypesConfig;
   /** Defaults to "same-origin". */
   crossOriginOpenerPolicy?: false | "same-origin" | "same-origin-allow-popups" | "unsafe-none";
-  /** Defaults to "DENY". */
+  /** Defaults to "SAMEORIGIN". */
   frameOptions?: false | "DENY" | "SAMEORIGIN";
   /** Defaults to "strict-origin-when-cross-origin". */
   referrerPolicy?: false | string;
@@ -116,7 +116,7 @@ const DEFAULT_CSP: Record<string, string[]> = {
   "connect-src": ["'self'", "ws:", "wss:"],
   "object-src": ["'none'"],
   "base-uri": ["'self'"],
-  "frame-ancestors": ["'none'"],
+  "frame-ancestors": ["'self'"],
   "form-action": ["'self'"],
 };
 
@@ -248,7 +248,7 @@ function applyBaseSecurityHeaders(
 ): void {
   headers.set("X-Content-Type-Options", "nosniff");
 
-  const frameOptions = security?.frameOptions ?? "DENY";
+  const frameOptions = security?.frameOptions ?? "SAMEORIGIN";
   if (frameOptions !== false) headers.set("X-Frame-Options", frameOptions);
 
   const coop = security?.crossOriginOpenerPolicy ?? "same-origin";
@@ -369,6 +369,7 @@ function serializeCsp(mode: Mode, security?: SecurityConfig, nonce?: string): st
     for (const [name, value] of Object.entries(DEFAULT_CSP)) {
       directives.set(name, [...value]);
     }
+    if (security?.frameOptions === "DENY") directives.set("frame-ancestors", ["'none'"]);
     if (mode === "development") {
       directives.set("script-src", ["'self'", "'unsafe-inline'"]);
     } else {

packages/core/test/framing.test.ts

@@ -0,0 +1,21 @@
+import { expect, test } from "bun:test";
+import { withSecurityHeaders } from "../src/headers.ts";
+test("default framing permits self but not cross-origin ancestors", () => {
+  const headers = withSecurityHeaders(
+    new Request("https://app.test"),
+    new Response("ok"),
+    "production",
+  ).headers;
+  expect(headers.get("x-frame-options")).toBe("SAMEORIGIN");
+  expect(headers.get("content-security-policy")).toContain("frame-ancestors 'self'");
+});
+test("explicit DENY keeps both framing policies restrictive", () => {
+  const headers = withSecurityHeaders(
+    new Request("https://app.test"),
+    new Response("ok"),
+    "production",
+    { frameOptions: "DENY" },
+  ).headers;
+  expect(headers.get("x-frame-options")).toBe("DENY");
+  expect(headers.get("content-security-policy")).toContain("frame-ancestors 'none'");
+});