chore: egress via pre-configured target urls

[maxy-shpfy]

TL;DR

Bundle UI components now reference Tangle API endpoints via logical target objects ({ target: "tangle", path: "..." }) instead of hardcoded absolute URLs. The server resolves the actual base URL from TANGLE_API_URL at runtime, and a new openTargetUrl UI command lets components open deployment-configured URLs without ever knowing the origin.

What changed?

• host.fetch now accepts HostFetchInput, a union of string | { target: "tangle"; path: string }. Components should use the logical target form; absolute URLs remain accepted only as a compatibility path for trusted internal tooling.
• A new resolveTargetUrl function builds the full URL from TANGLE_API_URL and validates that the path starts with / and is not protocol-relative.
• A new UICommand variant { type: "openTargetUrl", target: "tangle", path } lets components request that the host resolve and open a target URL in a new tab. The host calls the new POST /api/agent-bundles/ui-target-url endpoint to resolve the URL server-side before opening it.
• The hardcoded oasis.shopify.io origin rule has been removed from the egress allowlist; all Tangle egress now goes through the configurable TANGLE_API_URL.
• PI_PROXY_URL and TANGLE_API_URL are now validated as absolute URLs at startup via readAbsoluteUrl, throwing on misconfiguration rather than silently using a bad value.
• Default placeholder URLs (https://oasis.shopify.io, https://proxy.shopify.ai, https://tangle.example.com) have been replaced with generic https://api.example.com / https://proxy.example.com examples throughout config, docs, and examples.
• .env.example now documents server runtime variables (TANGLE_API_URL, TANGLE_TOKEN, PI_PROXY_URL, PI_PROXY_API_KEY, AUTH_JWT_TOKEN_COOKIE_NAME, INSTANCE_PROXY_URL), and the README clarifies that these should be injected via a process manager or secret manager rather than committed.
• AUTH_JWT_TOKEN_COOKIE_NAME is added to the Turbo env passthrough list.
• The security findings doc has been updated to remove the now-resolved hardcoded credential finding and replace it with a note on keeping TANGLE_TOKEN as a deployment secret.
• All example bundle UI components (pipeline-progress.tsx, pipeline-url-input.tsx, sample.js) have been updated to use the logical target form and openTargetUrl instead of hardcoded base URLs and openUrl.

How to test?

• Run the egress allowlist unit tests: pnpm test in apps/server. The new egressAllowlist.test.ts covers logical target resolution, credential injection, allowlist rejection of non-allowlisted paths, and rejection of malformed paths (missing leading slash, protocol-relative).
• Start the dev server and load the tangle or tangle-ml-pipeline-optimizer example bundle. Confirm that host.fetch({ target: "tangle", path: "/api/executions/<id>/state" }) proxies correctly and that clicking the pipeline title button resolves and opens the correct URL via openTargetUrl.
• Set TANGLE_API_URL to an invalid value and confirm the server throws on startup rather than silently using a bad URL.
• Confirm that POST /api/agent-bundles/ui-target-url with a valid target returns { url } and with an invalid path returns a 400.

Why make this change?

Hardcoding absolute API origins in bundle UI components couples them to a specific deployment environment and leaks internal hostnames into client-side code. By routing through logical targets resolved server-side from TANGLE_API_URL, the same bundle works across environments without modification, credentials and origins stay server-side, and the egress allowlist can enforce path patterns against a single configurable origin rather than a mix of hardcoded ones.

[maxy-shpfy]

• chore: remove vendor locked variables #52
• chore: clean up tangle-oss bundle #51
• chore: support instance-level default bundle id #50
• chore: egress via pre-configured target urls #49 👈 (View in Graphite)
• chore: replace proprietary terms #48
• chore: tidy up example bundles #47
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[maxy-shpfy]

Merge activity

• Jul 1, 9:40 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 1, 9:44 PM UTC: Graphite rebased this pull request as part of a merge.
• Jul 1, 9:44 PM UTC: @maxy-shpfy merged this pull request with Graphite.