Repository navigation
DISCO-154: Add SDK Preview Command - #444
Merged
Philipp Koytek (philippkoytek) merged 14 commits intoNov 2, 2026
Merged
Conversation
Co-Authored-By: Claude <noreply@anthropic.com> Includes-AI-Code: true
Co-Authored-By: Claude <noreply@anthropic.com> Includes-AI-Code: true
Co-Authored-By: Claude <noreply@anthropic.com> Includes-AI-Code: true
Co-Authored-By: Claude <noreply@anthropic.com> Includes-AI-Code: true
Co-Authored-By: Claude <noreply@anthropic.com> Includes-AI-Code: true
…ine-scripts The preview now blocks inline scripts by default, like published apps, and warns about each one with a hint to pass --allow-inline-scripts. Co-Authored-By: Claude <noreply@anthropic.com> Includes-AI-Code: true
Co-Authored-By: Claude <noreply@anthropic.com> Includes-AI-Code: true
Moves the proxy's close() out of the listen callback, uses Sets for the loopback hostnames and bodiless statuses, parses --port without a nested ternary, and asserts that the disconnect test's target request closes. Co-Authored-By: Claude <noreply@anthropic.com> Includes-AI-Code: true
Philipp Koytek (philippkoytek)
marked this pull request as ready for review
October 28, 2026 14:55
Philipp Koytek (philippkoytek)
requested review from
a team,
andyo (aocelo) and
Siavash Safaei (siavash-celonis)
as code owners
October 28, 2026 14:55
Co-authored-by: Patrick Tamunjoh <38542007+patricktamunjoh@users.noreply.github.com>
Patrick Tamunjoh (patricktamunjoh)
previously approved these changes
Oct 30, 2026
|
Patrick Tamunjoh (patricktamunjoh)
approved these changes
Oct 30, 2026
Zgjim Haziri (ZgjimHaziri)
approved these changes
Nov 2, 2026
Philipp Koytek (philippkoytek)
deleted the
feature/DISCO-154-sdk-preview
branch
November 2, 2026 09:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds
content-cli sdk preview [--target http://localhost:4200] [--port 4300] [--allow-inline-scripts], a long-running local HTTPS proxy that serves a custom app's dev server to the Codespace Local preview (https://localhost:4300). Developers no longer configure HTTPS, CORS or a CSP meta tag on their own dev server, and the preview blocks inline scripts by default, matching published apps.preview-proxy.ts, Node built-ins only): listens onlocalhostonly and forwards every request and WebSocket upgrade to--target. It strips the target's CSP, report-only CSP,X-Frame-Optionsand CORS headers, then sets the local preview headers. When the target is down it answers 502 with a readable message, logs one warning, and recovers when the target is back. A busy port gives a clear error.preview-headers.ts): a verbatim copy oflocalPreviewHeaders()from ems-frontend (libs/common/fragments/sandbox/src/lib/policy.ts). That is the fragment gateway's sandbox policy with'self'sources andframe-ancestors https://*.celonis.cloud http://localhost:*. A spec in ems-frontend pins the object and fails when the gateway policy drifts.preview-inline-scripts.ts): blocked by default to match published apps. Some dev servers inject inline scripts required for development, such as React Fast Refresh's preamble.--allow-inline-scriptspermits them during local development by adding per-script SHA-256 hashes to the HTML response'sscript-src, computed from the script text with browser-style line-ending normalization. Both modes warn once per distinct script, explaining whether it is blocked or allowed. Move inline scripts of your own into separate files before publishing.preview-certificate.ts): a self-signedlocalhostcertificate (EC P-256; SANslocalhost,127.0.0.1,::1) fromselfsigned@5.5.0, the one new dependency. It is stored in~/.celonis-content-cli-preview, reused, and regenerated when missing, corrupt or expiring. The system trust store is never touched.sdk-preview.service.ts,module.ts): beta, needs no profile, validates--target(an http(s) origin) and--port, prints the URL and what to do about the certificate, and stops on Ctrl+C. Docs are indocs/user-guide/sdk-commands.mdanddocs/command-graph.html.Hot reload stays blocked (
connect-src 'none') on purpose, to match production; developers reload the preview instead.Relevant links
localPreviewHeaders()): https://github.com/celonis/ems-frontend/pull/75030Screen.Recording.2026-10-27.at.17.43.54.mov
Checklist
Co-Authored-By: Claude noreply@anthropic.com
Includes-AI-Code: true