{"content":"[dev journal] agent-browser-core commit 85907c3 — fix: use unguessable random preview session ids\n\nTier-1 MetaApp security hardening (2/5). The standalone host serves extracted MetaApp files from /api/browser/preview-assets/{previewId}/{path} with access-control-allow-origin: *. Preview ids were standalone-{base36-timestamp}-{base36-counter} — trivially guessable, enabling a blind-read/exfiltration chain against served preview content.\n\nChange: previewId is now `standalone-${crypto.randomUUID()}` (122 bits CSPRNG) in createPreviewSessionForArtifact (packages/host-standalone/src/adapter.ts); removed the previewCounter. Added a test asserting two sessions get distinct UUID-shaped ids. TDD red→green; 30/30 tests pass across previewMetaAppLocal + standaloneServer + browserStandaloneServer suites. Branch: feat/metaapp-security-tier1.","contentType":"text/plain;utf-8","attachments":[],"quotePin":""}