feat(browser): in-app browser tab with webview security hardening

[MattPua]

Problem

Working on web changes means bouncing between the app and an external browser. There's no way to view a page (docs, a local dev server, a PR) inside the app next to your task.

Changes

CleanShot.2026-07-06.at.13.12.17.mp4

Adds an embedded browser tab. The panel tab bar "+" is now a dropdown (Terminal / Browser); it stays a plain add-terminal button when the browser flag is off. Gated behind posthog-code-browser-tab (always on in dev).

• BrowserPanel (features/browser/): address bar with back/forward/reload over an Electron <webview>; host-agnostic via onUrlChange/onTitleChange callbacks
• Main-process hardening in window.ts (the authoritative boundary — guest pages can't script around it):
  • will-attach-webview strips preload/node access, forces context isolation
  • Navigation guard: http/https/about only, link-local metadata range (169.254.0.0/16) blocked
  • Device permissions (camera/mic/geo/USB/...) denied — the profile is shared and persisted, grants would stick
  • Popups denied and routed to the OS browser, http(s) targets only
• Address bar normalizes input: scheme passthrough, bare-host detection (loopback defaults to http), everything else becomes a search; disallowed schemes (file:, chrome:, javascript:...) become searches
• Loading feedback: indeterminate progress bar while a page loads; reload button becomes a stop button mid-load
• Blank tabs focus the address bar and show a placeholder instead of literal about:blank
• Last committed url persists on the tab for restore-on-reload; title becomes the tab label

Accepted residual risks (deliberate): loopback/LAN reachable (dev servers are a first-class target), shared authenticated profile across tabs, host blocking is literal-IPv4 (no resolved-IP/IPv6 filtering).

How did you test this?

• normalizeAddress unit tests (incl. disallowed schemes), panel transform tests
• Drove the running app over CDP: + dropdown opens Terminal/Browser and each adds a tab
• @posthog/ui + @posthog/core suites pass, typecheck + biome clean

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

---

Created with PostHog Code

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[greptile-apps]

Comments Outside Diff (1)

1. apps/code/src/main/window.ts, line 71-76 (link)

   Session-level handlers reset on every webview attach

   guest.session is the shared persist:browser session, so setPermissionRequestHandler / setPermissionCheckHandler are overwritten each time a new browser tab is opened. The logic is idempotent here so the behaviour is correct today, but it is worth noting that calling setPermissionRequestHandler again replaces the previous handler rather than composing with it — if the handler ever diverges between webviews this will silently drop the earlier one.

   Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

_{Reviews (1): Last reviewed commit: "feat(browser): in-app browser tab with w..." | Re-trigger Greptile}

[MattPua]

Addressed the review feedback (PostHog Code, on behalf of the author):

• Both P1 silent test bail-outs: explicit expect(...).toBe("leaf") assertions added before the type-narrowing guards
• P2 (session handlers reset on every attach): permission handlers now install once per session via a WeakSet guard (hardenWebviewSession), so a future per-guest divergence can't silently replace an earlier handler
• Rebased onto latest main — resolved conflicts with the new autoresearch tab type, conflicts are cleared

[github-actions]

React Doctor found 7 issues in 1 file · 7 warnings.

7 warnings

src/features/browser/BrowserPanel.tsx

• ⚠️ src/features/browser/BrowserPanel.tsx:46 Non-component export in component file only-export-components
• ⚠️ src/features/browser/BrowserPanel.tsx:88 Many related useState calls prefer-useReducer
• ⚠️ src/features/browser/BrowserPanel.tsx:92 Ref initializer runs on every render rerender-lazy-ref-init
• ⚠️ src/features/browser/BrowserPanel.tsx:97 Loading useState forces extra render rendering-usetransition-loading
• ⚠️ src/features/browser/BrowserPanel.tsx:134 Multiple setState calls in one effect no-cascading-set-state
• ⚠️ src/features/browser/BrowserPanel.tsx:245 Autofocus on an element no-autofocus
• ⚠️ src/features/browser/BrowserPanel.tsx:284 Unknown DOM property no-unknown-property

_{Reviewed by React Doctor for commit 675f339.}