Skip to content

fix: use browser hostname for dev server URLs instead of localhost#471

Merged
Shironex merged 2 commits intov0.11.0rcfrom
fix/dev-server-url
Jan 13, 2026
Merged

fix: use browser hostname for dev server URLs instead of localhost#471
Shironex merged 2 commits intov0.11.0rcfrom
fix/dev-server-url

Conversation

@Shironex
Copy link
Copy Markdown
Collaborator

@Shironex Shironex commented Jan 13, 2026 •
edited
Loading

Fixes #463

Summary

This PR fixes the dev server URL handling to use the browser's hostname instead of hardcoded localhost, enabling proper access when viewing the UI from remote machines.

Changes

Dev Server URL Handling

  • Implemented logic to dynamically rewrite dev server URL hostnames to match the current browser's hostname
  • Enables correct access to dev servers when UI is accessed from remote machines
  • Maintains localhost for local development

Accessibility Improvements

  • Added aria-label attributes to dev server link buttons and dropdown items
  • Used aria-hidden for decorative icons
  • Improved screen reader support for dev server actions

Security & Error Handling

  • Added comprehensive error handling for missing dev server information
  • Introduced URL protocol validation (only http: and https: allowed)
  • Improved handling of malformed URLs

ESLint Configuration

  • Updated ESLint config to recognize URL and URLSearchParams as global readonly objects

Testing

  • Verify dev server URLs open correctly on localhost
  • Verify dev server URLs open correctly when accessing UI from remote machine
  • Verify accessibility improvements with screen readers
  • Verify error handling for invalid URLs

@Shironex
feat: enhance dev server URL handling and improve accessibility
62af203 
- Added URL and URLSearchParams as readonly globals in ESLint configuration.
- Updated WorktreeActionsDropdown and WorktreeTab components to include aria-labels for better accessibility.
- Implemented error handling for dev server URL opening, ensuring only valid HTTP/HTTPS protocols are used and providing user feedback for errors.

These changes improve user experience and accessibility when interacting with the dev server functionality.
@gemini-code-assist
Copy link
Copy Markdown
Contributor

gemini-code-assist Bot commented Jan 13, 2026

Summary of Changes

Hello @Shironex, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on improving the functionality, accessibility, and security of opening development server URLs within the application. It introduces a crucial fix that allows dev server URLs to be correctly accessed when the UI is viewed from a remote machine by dynamically adjusting the hostname. Additionally, the changes enhance the user experience with better accessibility attributes and provide more robust error handling and security checks to ensure only valid and safe URLs are opened.

Highlights

  • Dev Server URL Handling: Implemented logic to dynamically rewrite dev server URL hostnames to match the current browser's hostname, enabling correct access from remote machines.
  • Enhanced Accessibility: Improved accessibility for dev server links by adding aria-label attributes to buttons and dropdown items, and using aria-hidden for decorative icons.
  • Robust Error Handling and Security: Added comprehensive error handling for cases where dev server information is missing or URLs are malformed, and introduced security checks to validate URL protocols (only http: and https: are allowed).
  • ESLint Configuration Update: Updated ESLint configuration to recognize URL and URLSearchParams as global readonly objects, preventing linting errors.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jan 13, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request effectively addresses the development server URL issue, enabling remote access by rewriting the hostname. The addition of security checks for URL protocols and improved error handling significantly enhances robustness. The accessibility improvements in the UI components are also a welcome change. I have one suggestion to further improve security by preventing potential tabnabbing vulnerabilities.

Comment thread apps/ui/src/components/views/board-view/worktree-panel/hooks/use-dev-servers.ts Outdated
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Jan 13, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@Shironex Shironex changed the title fix: dev server url fix: use browser hostname for dev server URLs instead of localhost Jan 13, 2026
@Shironex @claude
security: add noopener,noreferrer to window.open calls
f4390bc 
Add 'noopener,noreferrer' parameter to all window.open() calls with
target='_blank' to prevent tabnabbing attacks. This prevents the newly
opened page from accessing window.opener, protecting against potential
security vulnerabilities.

Affected files:
- use-dev-servers.ts: Dev server URL links
- worktree-actions-dropdown.tsx: PR URL links
- create-pr-dialog.tsx: PR creation and browser fallback links

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@Shironex Shironex self-assigned this Jan 13, 2026
@Shironex Shironex added the Enhancement Improvements to existing functionality or UI. label Jan 13, 2026
@Shironex Shironex merged commit 6f55da4 into v0.11.0rc Jan 13, 2026
6 checks passed
@Shironex Shironex deleted the fix/dev-server-url branch January 13, 2026 18:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@Shironex Shironex

Labels

Enhancement Improvements to existing functionality or UI.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Shironex