fix(web): address Copilot review round 1 on public addresses (#1862)

- Never echo a refused value into a warning: credentials, query and
  fragment are dropped, and an unparseable value is not shown at all.
- Do not adopt MCP_SANDBOX_FULL_ADDRESS / MCP_APP_ORIGIN_FULL_ADDRESS after
  the EADDRINUSE fallback: the reverse proxy still routes them to the pinned
  port, which another process holds.
- Refuse a public app origin equal to any trusted ancestor in the controller,
  where the real (possibly bind-derived, possibly fallback-port) sandbox
  origin is known; config time could not see it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HzuzRPJv7M8wGe3wyw5sSg
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/integration/server/app-origin-controller.test.ts

@@ -393,6 +393,54 @@ describe("createAppOriginController", () => {
     }
   });
 
+  it("does not use a public origin after falling back off its pinned port (#1862)", async () => {
+    const { port, release } = await claimPort();
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    try {
+      controller = createAppOriginController({
+        port,
+        host: "127.0.0.1",
+        publicOrigin: "https://apps.example.com",
+      });
+      const result = await controller.start();
+      expect(result.port).not.toBe(port);
+      expect(result.url).toBe(`http://127.0.0.1:${result.port}`);
+      expect(
+        controller.publish({ html: "<p>x</p>" })!.url.startsWith(result.url),
+      ).toBe(true);
+      expect(warnSpy).toHaveBeenCalledWith(
+        expect.stringContaining("not using MCP_APP_ORIGIN_FULL_ADDRESS"),
+      );
+    } finally {
+      warnSpy.mockRestore();
+      await release();
+    }
+  });
+
+  it("refuses a public origin equal to a trusted ancestor, including a bind-derived sandbox (#1862)", async () => {
+    // Config time cannot see the bind-derived sandbox origin; the callers pass
+    // it in embedderOrigins, so the controller is where the collision is caught.
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    try {
+      controller = createAppOriginController({
+        port: 0,
+        host: "127.0.0.1",
+        publicOrigin: "http://127.0.0.1:6275",
+        embedderOrigins: appDocumentEmbedders("http://127.0.0.1:6275/sandbox", [
+          "http://localhost:6274",
+        ]),
+      });
+      const result = await controller.start();
+      expect(result.url).toBe(`http://127.0.0.1:${result.port}`);
+      expect(controller.getOrigin()).not.toBe("http://127.0.0.1:6275");
+      expect(warnSpy).toHaveBeenCalledWith(
+        expect.stringContaining("must differ from both"),
+      );
+    } finally {
+      warnSpy.mockRestore();
+    }
+  });
+
   it("degrades to publish()===null when listen fails for a non-EADDRINUSE reason", async () => {
     // The backends await start() during boot; if it ever stopped resolving the
     // whole web server would hang. Instead it resolves empty and every publish

clients/web/src/test/integration/server/public-address.test.ts

@@ -72,6 +72,17 @@ describe("public addresses (#1862)", () => {
       expect(warned()).toContain(reason);
     });
 
+    it.each([
+      ["https://user:hunter2@sb.example.com/sandbox", "hunter2"],
+      ["https://sb.example.com/sandbox?token=hunter2", "hunter2"],
+      ["https://sb.example.com/sandbox#hunter2", "hunter2"],
+      ["not a url hunter2", "hunter2"],
+    ])("never echoes a secret from a refused value (%s)", (raw, secret) => {
+      expect(resolveSandboxPublicUrl(raw, UI)).toBeUndefined();
+      expect(warned()).toContain("MCP_SANDBOX_FULL_ADDRESS");
+      expect(warned()).not.toContain(secret);
+    });
+
     it("refuses an origin shared with the Inspector UI — the same-origin collapse", () => {
       // The natural reverse-proxy layout: one hostname, /sandbox routed to 6275.
       // The spec requires host != sandbox origin, so this must not be advertised.

clients/web/src/test/integration/server/sandbox-controller.test.ts

@@ -495,6 +495,31 @@ describe("createSandboxController", () => {
     }
   });
 
+  it("does not advertise a public URL after falling back off its pinned port (#1862)", async () => {
+    // The reverse proxy routes the public URL to the pinned port, which another
+    // process holds — so the public URL would reach the wrong listener.
+    const { port, release } = await claimPort();
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const controller = createSandboxController({
+      port,
+      host: "127.0.0.1",
+      publicUrl: "https://sb.example.com/sandbox",
+    });
+    try {
+      const result = await controller.start();
+      expect(result.port).not.toBe(port);
+      expect(result.url).toBe(`http://127.0.0.1:${result.port}/sandbox`);
+      expect(controller.getUrl()).toBe(result.url);
+      expect(warnSpy).toHaveBeenCalledWith(
+        expect.stringContaining("not advertising MCP_SANDBOX_FULL_ADDRESS"),
+      );
+    } finally {
+      warnSpy.mockRestore();
+      await controller.close();
+      await release();
+    }
+  });
+
   it("resolves with empty values when even the dynamic retry fails", async () => {
     // The Vite plugin awaits start() in configureServer; if start() ever stops
     // resolving, the entire dev backend hangs. This pins the resolve-on-error