fix(web): preserve explicit preview navigation URLs

[nateEc]

Fixes #8885.

Explicit preview URLs, including loopback URLs, were rewritten to the environment host before navigation. That can direct a valid client-local URL to an unreachable address and report misleading success.

Keep explicit URL targets unchanged; discovered local-server entries continue to use the explicit environment-port resolution path.

Verification: focused browser target resolver tests (19 passing). Web typecheck remains blocked by existing missing optional modules and unrelated Clerk type errors.

Model and harness: GPT-5 Codex via Codex CLI.

---

Note

Medium Risk
Splits URL resolution between user-entered navigation and discovered servers; a mistake in either path would break remote previews or reintroduce unreachable loopback rewrites.

Overview
Fixes incorrect rewriting of explicit preview navigation targets (loopback URLs, credentials, schemeless localhost) to the remote environment host, which could send client-local addresses to unreachable hosts.

resolveBrowserNavigationTarget now returns kind: "url" targets unchanged with resolutionKind: "direct". Environment-port resolution and private-network mapping are unchanged.

Loopback-to-remote-host mapping moves to resolveDiscoveredServerUrl only (server-picker / discovered dev servers), so picking localhost:3000 on a remote environment still resolves to that host’s IP while typed URLs stay as entered.

Tests are updated to match; explicit http://localhost:5173 against a public relay base no longer throws the authenticated-gateway error.

^{Reviewed by Cursor Bugbot for commit 49a7407. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Preserve explicit loopback URLs in resolveBrowserNavigationTarget

• resolveBrowserNavigationTarget now returns all url-kind targets unchanged with resolutionKind: 'direct', instead of remapping loopback hosts (e.g. localhost, 127.0.0.1) to the environment host via resolveEnvironmentPortTarget
• resolveDiscoveredServerUrl no longer delegates to resolveBrowserNavigationTarget; it independently normalizes the URL, maps loopback hosts to the environment host via resolveEnvironmentPortTarget, and returns non-loopback URLs as-is
• Tests updated to verify explicit loopback URLs (including credentialed, schemeless, and IPv4 forms) stay unchanged across remote, private-network, and relay environments
• Behavioral Change: explicit navigation to a loopback URL no longer redirects through the environment host; discovered server URLs still do. Reviewers should check resolveBrowserNavigationTarget in browserTargetResolver.ts for any remaining callers that relied on loopback remapping for explicit URLs

^{Macroscope summarized 49a7407.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a5b64176-26b7-4a75-aa8e-da8280dbab2c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can activate Security or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved at 49a7407

Macroscope's review found this PR approvable — This narrowly scoped web fix preserves explicitly requested preview URLs while retaining host mapping for discovered loopback servers and environment-port targets. The behavior is isolated to the resolver, clearly covered by tests, and does not change schemas, deployment, security-sensitive code, or product defaults.

^{You can add or adjust custom eligibility rules. Learn more.}

[nateEc]

@juliusmarminge All checks are green and Macroscope approved the latest commit. Could you take a human review when you have a moment?