fix(ui): open app deep links from chat after confirmation (#2932)

* fix(ui): open app deep links from chat after confirmation DOMPurify's default URI policy stripped href from anchors with custom application schemes (obsidian://, vscode://, ...), so every app link rendered in chat was dead across web, desktop, VS Code, and mobile. - Classify safe app-link schemes in lib/url.ts (browser-handled, scriptable, webview-internal, network, and self-deep-link schemes stay excluded) and let openExternalUrl accept them - Keep app-link hrefs through the markdown sanitize hook - Intercept app-link clicks in the markdown renderer and route them through a confirmation dialog (Trust and open / Open once, dismiss to cancel) mounted in the desktop/web app root and the mobile shell - Persist per-device trusted schemes in a zustand store; trusted schemes open without asking again * feat(settings): manage trusted app link schemes in General Add an App links section to Settings > General listing the application schemes trusted on this device with a delete action; removing a scheme restores the confirmation dialog for it. Register the section in settings search. * fix(ui): enforce app link confirmation * fix(ui): handle app links by runtime * fix(vscode): keep app links unsupported * fix(settings): clarify trusted app links --------- Co-authored-by: Bohdan Triapitsyn <artmore@protonmail.com>
2026-08-23 01:53:21 +03:00
parent a5b0272f01
commit 3a78d86248
45 changed files with 909 additions and 53 deletions
@@ -0,0 +1,50 @@
+import { beforeEach, describe, expect, test } from 'bun:test';
+
+import { useAppLinkTrustStore, MAX_TRUSTED_SCHEMES } from './appLinkTrustStore';
+
+describe('app link trust store', () => {
+  beforeEach(() => {
+    useAppLinkTrustStore.setState({ trustedSchemes: [] });
+  });
+
+  test('trusts a scheme with case and whitespace normalization', () => {
+    const store = useAppLinkTrustStore.getState();
+
+    store.trustScheme('  Obsidian ');
+
+    expect(useAppLinkTrustStore.getState().trustedSchemes).toEqual(['obsidian']);
+    expect(useAppLinkTrustStore.getState().isSchemeTrusted('OBSIDIAN')).toBe(true);
+    expect(useAppLinkTrustStore.getState().isSchemeTrusted('linear')).toBe(false);
+  });
+
+  test('re-trusting moves the scheme to the front without duplicates', () => {
+    const store = useAppLinkTrustStore.getState();
+    store.trustScheme('obsidian');
+    store.trustScheme('linear');
+    store.trustScheme('obsidian');
+
+    expect(useAppLinkTrustStore.getState().trustedSchemes).toEqual(['obsidian', 'linear']);
+  });
+
+  test('removes a trusted scheme', () => {
+    const store = useAppLinkTrustStore.getState();
+    store.trustScheme('obsidian');
+    store.trustScheme('linear');
+
+    useAppLinkTrustStore.getState().removeTrustedScheme('obsidian');
+
+    expect(useAppLinkTrustStore.getState().trustedSchemes).toEqual(['linear']);
+    expect(useAppLinkTrustStore.getState().isSchemeTrusted('obsidian')).toBe(false);
+  });
+
+  test('caps the stored scheme list', () => {
+    const store = useAppLinkTrustStore.getState();
+    for (let index = 0; index < MAX_TRUSTED_SCHEMES + 5; index += 1) {
+      store.trustScheme(`scheme${index}`);
+    }
+
+    const schemes = useAppLinkTrustStore.getState().trustedSchemes;
+    expect(schemes).toHaveLength(MAX_TRUSTED_SCHEMES);
+    expect(schemes[0]).toBe(`scheme${MAX_TRUSTED_SCHEMES + 4}`);
+  });
+});
@@ -0,0 +1,48 @@
+import { create } from 'zustand';
+import { persist } from 'zustand/middleware';
+
+import { createDeferredSafeJSONStorage } from '@/stores/utils/safeStorage';
+
+export const MAX_TRUSTED_SCHEMES = 64;
+
+interface AppLinkTrustState {
+  /** Application deep-link schemes (obsidian, vscode, ...) the user chose to always allow. */
+  trustedSchemes: string[];
+  trustScheme: (scheme: string) => void;
+  removeTrustedScheme: (scheme: string) => void;
+  isSchemeTrusted: (scheme: string) => boolean;
+}
+
+const normalizeScheme = (scheme: string): string => scheme.trim().toLowerCase();
+
+/**
+ * Per-device trust for application deep links rendered in chat. Security
+ * decisions do not roam, so this persists locally through the shared safe
+ * storage rather than server-synced settings.
+ */
+export const useAppLinkTrustStore = create<AppLinkTrustState>()(
+  persist(
+    (set, get) => ({
+      trustedSchemes: [],
+      trustScheme: (scheme) => {
+        const normalized = normalizeScheme(scheme);
+        if (!normalized) return;
+        set((state) => {
+          const next = [normalized, ...state.trustedSchemes.filter((entry) => entry !== normalized)];
+          return { trustedSchemes: next.slice(0, MAX_TRUSTED_SCHEMES) };
+        });
+      },
+      removeTrustedScheme: (scheme) => {
+        const normalized = normalizeScheme(scheme);
+        set((state) => ({ trustedSchemes: state.trustedSchemes.filter((entry) => entry !== normalized) }));
+      },
+      isSchemeTrusted: (scheme) => get().trustedSchemes.includes(normalizeScheme(scheme)),
+    }),
+    {
+      name: 'app-link-trust-store',
+      storage: createDeferredSafeJSONStorage(),
+      version: 1,
+      partialize: (state) => ({ trustedSchemes: state.trustedSchemes }),
+    },
+  ),
+);