Fix(mobile) terminal replay, reset artifacts, and preview detection (#1383)

* fix terminal rendering and preview detection

* Fix bot comments

* fix: protect terminal preview URL probe

---------

Co-authored-by: Konstantin Zolin <zolin_ka@vk.com>
Co-authored-by: Bohdan Triapitsyn <artmore@protonmail.com>

packages/web/server/lib/opencode/core-routes.js

@@ -1,3 +1,27 @@
+const parseLoopbackUrl = (rawUrl) => {
+  if (typeof rawUrl !== 'string') {
+    return null;
+  }
+
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return null;
+  }
+
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    return null;
+  }
+
+  const host = url.hostname;
+  if (host !== 'localhost' && host !== '127.0.0.1' && host !== '::1' && host !== '0.0.0.0') {
+    return null;
+  }
+
+  return url;
+};
+
 export const registerServerStatusRoutes = (app, dependencies) => {
   const {
     express,
@@ -239,16 +263,26 @@ export const registerServerStatusRoutes = (app, dependencies) => {
       return res.status(500).json({ error: (error && error.message) || 'Failed to allocate port' });
     }
   });
+
 };
 
 export const registerAuthAndAccessRoutes = (app, dependencies) => {
   const {
+    express,
     tunnelAuthController,
     uiAuthController,
     readSettingsFromDiskMigrated,
     normalizeTunnelSessionTtlMs,
   } = dependencies;
 
+  const requireApiAuth = async (req, res, next) => {
+    const requestScope = tunnelAuthController.classifyRequestScope(req);
+    if (requestScope === 'tunnel' || requestScope === 'unknown-public') {
+      return tunnelAuthController.requireTunnelSession(req, res, next);
+    }
+    return uiAuthController.requireAuth(req, res, next);
+  };
+
   app.get('/auth/session', async (req, res) => {
     const requestScope = tunnelAuthController.classifyRequestScope(req);
     if (requestScope === 'tunnel' || requestScope === 'unknown-public') {
@@ -398,13 +432,33 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
     }
   });
 
+  app.post('/api/system/probe-url', express.json({ limit: '16kb' }), async (req, res, next) => {
+    try {
+      await requireApiAuth(req, res, async () => {
+        const url = parseLoopbackUrl(req.body?.url);
+        if (!url) {
+          return res.status(400).json({ ok: false, error: 'Invalid loopback URL' });
+        }
+
+        try {
+          const response = await fetch(url.toString(), {
+            method: 'GET',
+            redirect: 'manual',
+            signal: AbortSignal.timeout(1500),
+          });
+          return res.json({ ok: response.ok, status: response.status });
+        } catch (error) {
+          return res.json({ ok: false, error: error?.message || 'Probe failed' });
+        }
+      });
+    } catch (error) {
+      next(error);
+    }
+  });
+
   app.use('/api', async (req, res, next) => {
     try {
-      const requestScope = tunnelAuthController.classifyRequestScope(req);
-      if (requestScope === 'tunnel' || requestScope === 'unknown-public') {
-        return tunnelAuthController.requireTunnelSession(req, res, next);
-      }
-      await uiAuthController.requireAuth(req, res, next);
+      await requireApiAuth(req, res, next);
     } catch (err) {
       next(err);
     }