Fix review findings: secrets in snapshots, URL spoofing, migration data loss

Adversarial review of the branch produced findings across four areas.
This addresses them, plus the Windows CI environment.

Secrets. commit_container_snapshot baked the container's full env into
the per-project snapshot image, so the shared OAuth token — and the AWS
keys, git token and gateway master key — outlived revocation and were
readable via docker inspect. Verified against Engine 29.6 that a commit
body's config merges over the container's: keys cannot be dropped but
can be overwritten, so all of them now commit as KEY=. clear_claude_token
additionally rewrites images from earlier builds and reports honestly
when a tag could not be rewritten.

The recommendation to move the token out of env entirely was not taken,
with reasoning: apiKeyHelper is a different auth method that outranks
CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no
file-based delivery exists. The durable exposure — the image — is what
is closed here. Separately noted, not fixed: entrypoint.sh captures the
token into the scheduler's .env inside the persisted volume.

URL spoofing. Three call sites reached openUrl with container-controlled
strings, one of which the review missed (the WebLinksAddon handler).
The sign-in URL was scraped from container output with a longest-match
tie-break and no userinfo check, so claude.ai@evil.tld rendered as
"claude.ai…" in a truncating element. There is now one sanitizer in
front of every sink — scheme allowlist, no userinfo, C0/C1 and quote
rejection, host allowlist for the sign-in case, first-match — and the
origin renders un-truncated. The toast is keyed so a changed URL
remounts, closing a bait-and-switch where the user read one URL and
clicked another.

Migration. The rollback pin was best-effort: a tag failure was logged
and the migration continued past remove_container, after which the
final commit overwrote the only copy of the old system layer. It now
aborts before anything destructive and reads the tag back. /var was
destroyed while the ordinary recreate path preserves it — making the
"safe" alternative to Reset more destructive than Reset's alternative;
data-bearing subtrees are now detected and disclosed in the pre-flight
rather than copied, since tarring a live database onto a different
base's packages is a corruption risk. resume_migration now verifies the
migration-state label instead of reporting success for a container that
never swapped. dismiss actually resolves the record rather than leaving
the feature permanently refusing to migrate. Start and Reset are guarded
while a migration is live.

Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and
advertised URL are derived together so they cannot drift. Disabling it
now stops it. App exit runs teardown concurrently under a budget with a
visible shutting-down state instead of blocking for minutes. Auto-starts
retry when Docker is not up yet, and the polling-recovery path now
reconciles, so interrupted migrations are still recovered. Auth-bridge
forwards are capped, closing a container-driven fd exhaustion.

Windows CI. build-windows failed on this branch with "linker link.exe
not found". The runner had no MSVC build tools and the workflow assumed
a hand-provisioned machine, so a bare runner registers, accepts jobs and
fails at link time after downloading the whole crate graph. The job now
installs the VC++ workload when vswhere cannot find it, matching how it
already conditionally installs Rust and Node.

192 Rust tests, 274 frontend tests, both builds clean, zero warnings.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/src/lib/tauri-commands.ts

@@ -1,5 +1,5 @@
 import { invoke } from "@tauri-apps/api/core";
-import type { Project, ProjectPath, ContainerInfo, SiblingContainer, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, WebTerminalInfo, SttStatus, GatewayStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, ScheduledTaskInput, SchedulerNotification, AuthBridgeStatus, BrowserViewStatus, PlaywrightDetection, ContainerStaleness, MigrationOptions, MigrationReport, MigrationState } from "./types";
+import type { Project, ProjectPath, ContainerInfo, SiblingContainer, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, WebTerminalInfo, SttStatus, GatewayStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, ScheduledTaskInput, SchedulerNotification, AuthBridgeStatus, BrowserViewStatus, PlaywrightDetection, ContainerStaleness, MigrationOptions, MigrationReport, MigrationState, ClearTokenOutcome } from "./types";
 
 // Docker
 export const checkDocker = () => invoke<boolean>("check_docker");
@@ -199,7 +199,10 @@ export const submitClaudeTokenCode = (code: string) =>
 /** Abort an in-flight acquisition and release the single-flight guard. No-op if nothing is running. */
 export const cancelClaudeToken = () => invoke<void>("cancel_claude_token");
 export const hasClaudeToken = () => invoke<boolean>("has_claude_token");
-export const clearClaudeToken = () => invoke<void>("clear_claude_token");
+/** Revoke the shared token. Also rewrites any snapshot image that still has it
+ *  baked into its env — see `ClearTokenOutcome` for what may be left behind. */
+export const clearClaudeToken = () =>
+  invoke<ClearTokenOutcome>("clear_claude_token");
 
 // Container base-image migration — move a project onto the current base image
 // without deleting its volumes. Reset is the destructive alternative: it wipes

app/src/lib/types.ts

@@ -466,6 +466,29 @@ export interface BrowserViewChangedEvent {
 
 /** Payload of the `claude-token-progress` event: milestones during
  *  `acquire_claude_token`. Never contains the token. */
+/**
+ * Result of `clear_claude_token`.
+ *
+ * Revoking is not one action but three: delete the keychain entry (always
+ * succeeds or throws), let container recreation clear the env var, and rewrite
+ * any snapshot image that still has the token baked into its `Config.Env`.
+ * Only the last one can partly fail, and when it does the user has to be told
+ * — a token sitting in an image is readable by `docker image inspect` for as
+ * long as the image exists.
+ */
+export interface ClearTokenOutcome {
+  /** Snapshot images that were holding the token and have been rewritten. */
+  snapshots_scrubbed: string[];
+  /** Images still holding it, each with the reason. Non-empty = incomplete. */
+  snapshots_failed: string[];
+  /** Rewritten, but the pre-rewrite image object could not be deleted because a
+   *  container still runs off it. Clears itself when that container is
+   *  recreated — worth mentioning, not worth alarming about. */
+  snapshots_superseded: string[];
+  /** Set when Docker could not be reached, so nothing is known. */
+  docker_unavailable: string | null;
+}
+
 export interface ClaudeTokenProgressEvent {
   project_id: string;
   message: string;
@@ -507,6 +530,23 @@ export interface PackageFailure {
   reason: string;
 }
 
+/** A data-bearing directory a migration destroys and cannot put back.
+ *
+ *  Service state lives under /var — a database's files in /var/lib/<service>,
+ *  a site in /var/www — and none of it is carried across: replaying the apt
+ *  delta reinstalls the *package* onto the new base and hands back an empty
+ *  data directory. The ordinary recreate path does not have this problem
+ *  because it creates from the project's own snapshot, so migration has to say
+ *  so out loud before anything is touched. */
+export interface UnpreservedData {
+  /** Absolute path, e.g. `/var/lib/postgresql`. */
+  path: string;
+  /** Total size of the non-package files beneath it. */
+  bytes: number;
+  /** How many non-package files it holds. */
+  file_count: number;
+}
+
 /** Why a project is worth migrating, and what migrating would carry across.
  *
  *  An empty array always means "nothing found", never "not checked" —
@@ -535,6 +575,9 @@ export interface ContainerStaleness {
    *  be carried across. Empty when nothing user-authored was found — which is
    *  the common case. */
   verbatim_paths: string[];
+  /** Data under /var that the migration destroys and cannot restore. Empty on
+   *  an ordinary container; when it is not, the pre-flight has to lead with it. */
+  unpreserved_data: UnpreservedData[];
   /** dpkg packages the base carries at a different version. A drift measure,
    *  not a promise that every one is newer. */
   outdated_package_count: number;
@@ -599,6 +642,9 @@ export interface MigrationPlan {
   npm_packages: string[];
   verbatim_paths: string[];
   missing_paths: string[];
+  /** What the pre-flight found under /var that the migration would destroy,
+   *  frozen so the finished report can still name it. */
+  unpreserved_data: UnpreservedData[];
 }
 
 /** Persisted host-side migration record. Present only while a migration is in

app/src/lib/urlDetector.ts

@@ -70,8 +70,16 @@ export class UrlDetector {
 
     if (!flat) return;
 
-    // 3. Match URLs on the flattened string — spans across wrapped lines naturally
-    const urlRe = /https?:\/\/[^\s'"<>\x07]+/g;
+    // 3. Match URLs on the flattened string — spans across wrapped lines naturally.
+    //    The negated class stops at anything illegal in a URL, which must
+    //    include the *whole* C0 range and DEL, not just BEL: an escape or a NUL
+    //    swallowed into the middle of a match becomes a URL that renders as one
+    //    thing in the toast and resolves as another. Everything emitted here is
+    //    still re-validated by `sanitizeRelayUrl` before it can reach `openUrl`;
+    //    stopping the match early only means the legitimate prefix survives
+    //    instead of the whole candidate being thrown away.
+    // eslint-disable-next-line no-control-regex
+    const urlRe = /https?:\/\/[^\s'"`<>\x00-\x20\x7f]+/g;
     let m: RegExpExecArray | null;
 
     while ((m = urlRe.exec(flat)) !== null) {

app/src/lib/urlRelay.embedded.test.ts

@@ -0,0 +1,131 @@
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { sanitizeRelayUrl, MAX_RELAY_URL_LENGTH } from "./urlRelay";
+
+/**
+ * The web terminal (`src-tauri/src/web_terminal/terminal.html`) is embedded
+ * into the Rust binary with `include_str!()` and served as one standalone
+ * file, so it cannot import `urlRelay.ts`. It therefore carries a hand-copied
+ * duplicate of `sanitizeRelayUrl` — and a hand-copied security check that no
+ * test can reach is a check that quietly rots.
+ *
+ * This test reaches it: it pulls the marked block straight out of the HTML,
+ * evaluates it, and asserts it agrees with the TypeScript original on every
+ * case. Divergence fails here rather than shipping.
+ */
+
+// Vitest runs with `app/` as its root; `import.meta.url` is an http URL under
+// the jsdom environment, so resolve from the working directory instead.
+const HTML_PATH = resolve(
+  process.cwd(),
+  "src-tauri/src/web_terminal/terminal.html",
+);
+
+const START_MARKER = "─── shared-url-sanitizer ";
+const END_MARKER = "─── end shared-url-sanitizer ";
+
+/** Extract and evaluate the embedded copy. */
+function loadEmbeddedSanitizer(): (raw: unknown) => string | null {
+  const html = readFileSync(HTML_PATH, "utf8");
+
+  const start = html.indexOf(START_MARKER);
+  const end = html.indexOf(END_MARKER);
+  if (start === -1 || end === -1 || end < start) {
+    throw new Error(
+      `Could not find the shared-url-sanitizer markers in ${HTML_PATH}. ` +
+        "If the block was renamed or removed, update this test — do not delete it.",
+    );
+  }
+
+  const block = html.slice(html.indexOf("\n", start) + 1, end);
+  if (!block.includes("function sanitizeRelayUrl(")) {
+    throw new Error(
+      "The shared-url-sanitizer block no longer defines sanitizeRelayUrl().",
+    );
+  }
+
+  // `RELAY_MAX_URL` is declared elsewhere in the page; supply it here with the
+  // same value the TypeScript module uses, which is also what the page sets.
+  const factory = new Function(
+    "RELAY_MAX_URL",
+    `${block}\nreturn sanitizeRelayUrl;`,
+  );
+  return factory(MAX_RELAY_URL_LENGTH) as (raw: unknown) => string | null;
+}
+
+const embeddedSanitize = loadEmbeddedSanitizer();
+
+/**
+ * Every case both copies must agree on. Deliberately the union of the two
+ * threat models, not the easy half.
+ */
+const CASES: unknown[] = [
+  // Accepted.
+  "https://example.com/",
+  "http://example.com/x",
+  "https://EXAMPLE.com",
+  "https://my-host.example.com/a-b_c~d/e.f?g=h-i#j-k",
+  "http://127.0.0.1:41703/callback?code=abc",
+  "  https://example.com/padded  ",
+  "https://example.com/x\n",
+  "https://claude.ai/oauth/authorize?code=true&client_id=abc",
+
+  // Scheme.
+  "javascript:alert(1)",
+  "JavaScript:alert(1)",
+  "data:text/html,<script>alert(1)</script>",
+  "file:///etc/passwd",
+  "vscode://x",
+  "java\nscript:alert(1)",
+
+  // Malformed / hostile.
+  "",
+  "   ",
+  "example.com",
+  "https://",
+  "https:///etc/passwd",
+  "https://user:pass@example.com/",
+  "https://claude.ai@evil.tld/oauth/authorize",
+  "https://example.com/a b",
+  "https://example.com/a\r\nb",
+  "https://example.com/\u001b]0;pwned\u0007",
+  "https://example.com/a\u0000b",
+  "https://example.com/a\u007fb",
+  "https://example.com/a\u0085b",
+  "https://example.com/a\u00a0b",
+  'https://example.com/a"b',
+  "https://example.com/a'b",
+  "https://example.com/a`b",
+  `https://example.com/${"a".repeat(MAX_RELAY_URL_LENGTH)}`,
+
+  // Non-strings.
+  null,
+  undefined,
+  42,
+  {},
+];
+
+describe("terminal.html's embedded sanitizer", () => {
+  it("is present and extractable", () => {
+    expect(typeof embeddedSanitize).toBe("function");
+  });
+
+  it("agrees with lib/urlRelay.ts on every case", () => {
+    for (const input of CASES) {
+      expect(
+        embeddedSanitize(input),
+        `embedded copy disagrees for input: ${JSON.stringify(input)?.slice(0, 120)}`,
+      ).toEqual(sanitizeRelayUrl(input));
+    }
+  });
+
+  it("rejects the userinfo spoof that reads as an Anthropic origin", () => {
+    expect(embeddedSanitize("https://claude.ai@evil.tld/oauth/authorize")).toBeNull();
+  });
+
+  it("rejects quote characters, which the OS opener may treat as syntax", () => {
+    expect(embeddedSanitize('https://example.com/a"b')).toBeNull();
+    expect(embeddedSanitize("https://example.com/a`b")).toBeNull();
+  });
+});

app/src/lib/urlRelay.test.ts

@@ -1,10 +1,12 @@
 import { describe, it, expect } from "vitest";
 import {
+  ANTHROPIC_SIGN_IN_HOSTS,
   MAX_RELAY_URL_LENGTH,
   RelayRateLimiter,
   URL_RELAY_OSC,
   parseUrlRelayOsc,
   sanitizeRelayUrl,
+  urlOrigin,
 } from "./urlRelay";
 
 /** Build the OSC 7777 payload the container shim emits for `url`. */
@@ -153,6 +155,86 @@ describe("sanitizeRelayUrl — rejects malformed and hostile input", () => {
   });
 });
 
+describe("sanitizeRelayUrl — quote characters", () => {
+  // Latent today, because the only path that would exploit it is behind a
+  // feature flag. Latent is not the same as absent: the character class is the
+  // thing standing between a container-supplied string and an OS opener that
+  // on Windows has historically been reached through a command interpreter.
+  it("rejects a double quote", () => {
+    expect(sanitizeRelayUrl('https://example.com/a"b')).toBeNull();
+    expect(sanitizeRelayUrl('https://example.com/?q="&x=1')).toBeNull();
+  });
+
+  it("rejects a single quote and a backtick", () => {
+    expect(sanitizeRelayUrl("https://example.com/a'b")).toBeNull();
+    expect(sanitizeRelayUrl("https://example.com/a`b")).toBeNull();
+  });
+
+  it("still accepts the percent-encoded forms", () => {
+    expect(sanitizeRelayUrl("https://example.com/a%22b")).toBe(
+      "https://example.com/a%22b",
+    );
+  });
+
+  it("rejects C1 controls and exotic whitespace new URL() would keep", () => {
+    expect(sanitizeRelayUrl("https://example.com/a\u0085b")).toBeNull();
+    expect(sanitizeRelayUrl("https://example.com/a\u00a0b")).toBeNull();
+    expect(sanitizeRelayUrl("https://example.com/a\u3000b")).toBeNull();
+  });
+});
+
+describe("sanitizeRelayUrl — host allowlist", () => {
+  const opts = { allowHosts: ANTHROPIC_SIGN_IN_HOSTS };
+
+  it("accepts the domain itself and its subdomains", () => {
+    expect(sanitizeRelayUrl("https://claude.ai/oauth/authorize", opts)).toBe(
+      "https://claude.ai/oauth/authorize",
+    );
+    expect(
+      sanitizeRelayUrl("https://platform.claude.com/oauth/code/callback", opts),
+    ).toBe("https://platform.claude.com/oauth/code/callback");
+  });
+
+  it("rejects a lookalike that merely contains the domain", () => {
+    expect(sanitizeRelayUrl("https://claude.ai.evil.tld/oauth", opts)).toBeNull();
+    expect(sanitizeRelayUrl("https://notclaude.ai/oauth", opts)).toBeNull();
+    expect(sanitizeRelayUrl("https://evil.tld/claude.ai/oauth", opts)).toBeNull();
+  });
+
+  it("rejects the userinfo spoof even though it reads as an allowed host", () => {
+    expect(
+      sanitizeRelayUrl("https://claude.ai@evil.tld/oauth/authorize", opts),
+    ).toBeNull();
+  });
+
+  it("is case-insensitive about the host", () => {
+    expect(sanitizeRelayUrl("https://CLAUDE.AI/oauth", opts)).toBe(
+      "https://claude.ai/oauth",
+    );
+  });
+
+  it("allows any host when no allowlist is given — the relay's whole point", () => {
+    expect(sanitizeRelayUrl("https://github.com/login/device")).toBe(
+      "https://github.com/login/device",
+    );
+  });
+});
+
+describe("urlOrigin", () => {
+  it("returns the part that decides where credentials go", () => {
+    expect(urlOrigin("https://claude.ai/oauth/authorize?code=true")).toBe(
+      "https://claude.ai",
+    );
+    expect(urlOrigin("http://127.0.0.1:41703/callback")).toBe(
+      "http://127.0.0.1:41703",
+    );
+  });
+
+  it("returns null rather than guessing at unparseable input", () => {
+    expect(urlOrigin("not a url")).toBeNull();
+  });
+});
+
 describe("parseUrlRelayOsc", () => {
   it("decodes the sequence the container shim emits", () => {
     const url = "https://github.com/login/device";

app/src/lib/urlRelay.ts

@@ -1,5 +1,6 @@
 /**
- * URL relay — host side of `container/triple-c-open`.
+ * URL relay — host side of `container/triple-c-open` — and the single URL
+ * validator every `openUrl` call site in the app is required to go through.
  *
  * A CLI inside the container has no browser. When it wants to open a URL
  * (`gh auth login`, `aws sso login`, `gcloud auth login`, anything honouring
@@ -29,6 +30,19 @@
  *
  * Opening is never automatic — see `RelayRateLimiter` and the confirmation
  * toast in TerminalView.
+ *
+ * The relay is not the only route from the container to the host's browser.
+ * The heuristic long-URL detector (`urlDetector.ts`) and the `claude
+ * setup-token` sign-in link (`useClaudeAuth.ts`) both scrape the same
+ * untrusted PTY byte stream, so they use this validator too — with an added
+ * host allowlist in the sign-in case, where exactly one origin is legitimate.
+ * Keep this the only implementation: a second copy is a second place for a
+ * rule to go missing.
+ *
+ * `web_terminal/terminal.html` is the one unavoidable duplicate — it is
+ * embedded standalone via `include_str!()` and cannot import this module.
+ * `urlRelay.embedded.test.ts` extracts that copy and runs it against the same
+ * table of cases, so the two cannot drift silently.
  */
 
 /** Private OSC identifier used by the relay. Chosen to avoid the numbers in
@@ -39,22 +53,79 @@ export const URL_RELAY_OSC = 7777;
 export const MAX_RELAY_URL_LENGTH = 8192;
 
 /**
- * Validate a URL the container asked the host to open.
+ * Whether `candidate` contains a character that disqualifies it before it is
+ * ever parsed.
+ *
+ * Whitespace and C0/DEL matter most: `new URL()` silently *strips* tab, LF and
+ * CR, so `"java\nscript:alert(1)"` would otherwise parse as a `javascript:`
+ * URL. Quote characters are rejected on top of that: `"`, `'` and a backtick
+ * are all illegal in a URL per RFC 3986, and this string ends up as an
+ * argument to an OS-level opener — a path that on Windows has historically
+ * run through a command interpreter, where a quote ends the argument and
+ * whatever follows is the next command. Nothing legitimate loses out; a URL
+ * that really needs one carries it percent-encoded.
+ *
+ * Written as a scan rather than a regex literal so the C0 range is expressed
+ * as code points and cannot be quietly mangled by an editing tool.
+ */
+function hasForbiddenChar(candidate: string): boolean {
+  for (const ch of candidate) {
+    const code = ch.codePointAt(0) ?? 0;
+    // C0 controls, space, and DEL.
+    if (code <= 0x20 || code === 0x7f) return true;
+    // C1 controls — not stripped by `new URL()`, invisible in the toast.
+    if (code >= 0x80 && code <= 0x9f) return true;
+    if (ch === '"' || ch === "'" || ch === "`") return true;
+    // Any other Unicode whitespace (NBSP, ideographic space, ...).
+    if (ch.trim() === "") return true;
+  }
+  return false;
+}
+
+/**
+ * Registrable domains the Anthropic sign-in flow may send the user to.
+ *
+ * `claude setup-token` prints a `claude.ai` authorize URL and redirects to
+ * `platform.claude.com`; `anthropic.com` covers the console. Anything else in
+ * the transcript is not a sign-in link, whatever it claims.
+ */
+export const ANTHROPIC_SIGN_IN_HOSTS = [
+  "claude.ai",
+  "claude.com",
+  "anthropic.com",
+] as const;
+
+export interface SanitizeUrlOptions {
+  /**
+   * Registrable domains the URL's host must match — either exactly, or as a
+   * subdomain (`platform.claude.com` matches `claude.com`). Omit to allow any
+   * host: the relay deliberately does, because opening a third-party OAuth
+   * page is the entire point of it.
+   */
+  allowHosts?: readonly string[];
+}
+
+/** True when `host` is `domain` itself or a subdomain of it. */
+function hostMatches(host: string, domain: string): boolean {
+  return host === domain || host.endsWith(`.${domain}`);
+}
+
+/**
+ * Validate a URL that something untrusted asked the host to open.
  *
  * @returns the normalized URL, or `null` if it must not be opened.
  */
-export function sanitizeRelayUrl(raw: unknown): string | null {
+export function sanitizeRelayUrl(
+  raw: unknown,
+  options: SanitizeUrlOptions = {},
+): string | null {
   if (typeof raw !== "string") return null;
 
   const candidate = raw.trim();
   if (candidate.length === 0) return null;
   if (candidate.length > MAX_RELAY_URL_LENGTH) return null;
 
-  // No whitespace or control characters anywhere. Rejecting these before
-  // parsing matters: `new URL()` silently strips tabs/newlines, so
-  // "java\nscript:alert(1)" would otherwise parse as a javascript: URL.
-  // eslint-disable-next-line no-control-regex
-  if (/[\s\u0000-\u0020\u007f]/.test(candidate)) return null;
+  if (hasForbiddenChar(candidate)) return null;
 
   let parsed: URL;
   try {
@@ -70,15 +141,43 @@ export function sanitizeRelayUrl(raw: unknown): string | null {
   // resolves in surprising ways.
   if (parsed.hostname === "") return null;
 
-  // Embedded credentials spoof the displayed origin.
+  // Embedded credentials spoof the displayed origin: `https://claude.ai@evil.tld/x`
+  // reads as claude.ai in anything that truncates, and navigates to evil.tld.
   if (parsed.username !== "" || parsed.password !== "") return null;
 
+  if (options.allowHosts) {
+    const host = parsed.hostname.toLowerCase();
+    if (!options.allowHosts.some((domain) => hostMatches(host, domain))) {
+      return null;
+    }
+  }
+
   const normalized = parsed.toString();
   if (normalized.length > MAX_RELAY_URL_LENGTH) return null;
 
   return normalized;
 }
 
+/**
+ * The origin of an already-sanitized URL, for display.
+ *
+ * The origin is the only part of a URL that decides where the user's
+ * credentials end up, so it is the one part an ellipsis must never eat. Every
+ * place that shows a URL the user is about to open shows this separately, at
+ * full length, next to the truncatable remainder.
+ *
+ * Returns `null` for input that does not parse — callers pass
+ * {@link sanitizeRelayUrl} output, so that would be a bug rather than an
+ * attack.
+ */
+export function urlOrigin(url: string): string | null {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Parse the payload of an OSC 7777 sequence (everything between `ESC]7777;`
  * and the terminator).