feat: show the agent's artifacts — live, sandboxed, never on TeamWork's origin

[praxagent]

TeamWork's half of artifacts: the viewer. The agent makes and stores the pages; Prax's half is praxagent/prax (feat/artifacts).

What

• In chat and notes. A line that is exactly [artifact:<id>] renders the agent's page as a live card. It polls for new versions every 5 s and has a full-screen view (Esc closes it).
• Where the page comes from. GET /api/artifacts[/<id>][?meta=1] proxies to {PRAX_URL}/teamwork/artifacts….
  • It sits behind TeamWork's login, and is not on the exemption list.
  • Failures are HTTP failures: 503 when the agent is unreachable, 404 when the artifact is unknown.
  • A malformed id never reaches the agent.

Why it's safe to render agent-written pages

TeamWork's origin holds your session, and an artifact may have been written while the agent was reading untrusted content. So the page never runs on TeamWork's origin:

• The frame. srcdoc in an iframe with sandbox="allow-scripts" and no allow-same-origin, so it gets an opaque origin, and referrerpolicy=no-referrer.
• The policy. A CSP is injected first in its <head>: no network, no forms, no base changes. The page's own tags can't loosen it, because every policy applies and the strictest wins.
• Sizing. The frame sizes itself from a height message, accepted only from that frame's own window.

Verified in real headless Chromium (the prax-sandbox image), with the exact attribute and CSP: from inside the frame,

• parent.document, document.cookie and localStorage → SecurityError;
• self.origin → "null";
• fetch('https://example.com/') → blocked by connect-src 'none'; Chromium logged the CSP violation.

Tests

• Backend: 6 new router tests. make ci green: 500 passed.
• Frontend:
  • CSP injection, marker splitting (code blocks and bad ids left alone), frame sandbox attributes, and size messages ignored from foreign windows;
  • vitest 98/98, tsc clean, vite build OK.

Docs: docs/artifacts.md. Idea credit: Telepath's Television (see #80).