feat(chat): link previews for pasted URLs

Paste an http(s) link in a group's chat and it unfurls into an OpenGraph
card — title, description, site name, and image — the way WhatsApp/Signal/
Slack do it.

The fetch is the node's, never the browser's or the hub's. The browser
cannot: a strict img-src/connect-src and CORS block it, and a direct fetch
would leak every reader's IP to the linked host on each render. The hub must
not touch group content (draft-v6 §2.5). The node already fetches third-party
metadata for the Videos and Music apps, over the same authorised path.

Flow mirrors media_meta_req: the client sends `link_preview_req {url}`, the
node replies `link_preview_resp` with the card fields (or `ok: false`), and
any OG image is stored under its blake3 in the existing media_cache thumb
store — the client then fetches it via the normal file_req path, exactly like
a poster. Nothing durable is added: the card text lives in a bounded in-memory
TTL cache on the node (draft-v6 §2.7 — enrichment on demand, the asking device
caches), and MNP goes 0.11 → 0.12 (additive: an older node logs "unknown type"
and the client shows the bare link).

Because the URL is chosen by a *member* and triggers an outbound request from
the operator's machine, `linkpreview.safe_url` is an SSRF gate: http(s) only,
no credentials, and every resolved address must be globally routable — no
loopback, private, link-local, multicast or reserved range, cloud-metadata
included. Redirects are followed by hand so each hop is re-checked. Residual,
documented in the module: DNS rebinding between the check and connect, closed
properly by pinning the checked IP — a follow-up.

Also fixes a long-standing chat annoyance the preview cards made worse:
opening the Chat tab landed a screen or two above the newest message because
the scroll-to-bottom ran before attachment thumbnails and (now) preview cards
had loaded and grown the content. A ResizeObserver keeps the view pinned to
the bottom through late content growth, and does nothing once the reader
scrolls up.

Tests: test_linkpreview.py (the SSRF gate and the OpenGraph parse, incl.
redirect re-validation and image downscaling) and test_link_preview_request.py
(reply shape, the media_cache image round-trip, the result cache).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gKJ85aZyvEwarXMFzFEwi

1 files changed, 27 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index 9f85ee1..1a146ce 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -847,6 +847,20 @@ class MeshBayTransport {
   }
 
   /**
+   * Unfurl a URL pasted in chat. The node fetches it (the browser cannot —
+   * CSP and CORS — and would leak every reader's IP), parses an OpenGraph
+   * card, and caches any image in its thumb store; `image_thumb_hash` then
+   * rides the normal file_req path like a poster. `ok: false` means "no
+   * preview" (blocked, unreachable, not HTML) — the caller just shows the
+   * bare link. Keyed by url: a message with several links fires one each.
+   */
+  async fetchLinkPreview(url) {
+    const msg = await this._sendAndWait({ type: 'link_preview_req', v: '0.6', url });
+    if (msg.type === 'error') throw new Error(msg.detail);
+    return msg;
+  }
+
+  /**
    * One season's own overview/air_date/poster (docs/mediacenter.md §5.4's
    * per-season view) — a show's own tmdb_meta is one static field that does
    * not necessarily describe every season alike, found live: a 3-season
@@ -1854,6 +1868,9 @@ class MeshBayTransport {
           ? `chunk:${obj.file_id}:${obj.chunk_index}`
           : obj.type === 'ping' ? `ping:${obj.token}`
           : obj.type === 'media_meta_req' ? `media_meta:${obj.file_id}`
+          // One chat message can carry several links, each unfurled on its
+          // own; matching by arrival order would swap two cards.
+          : obj.type === 'link_preview_req' ? `link_preview:${obj.url}`
           // Same reordering hazard as media_meta_req: an album grid fires
           // one music_meta_req per visible tile, several at a time.
           : obj.type === 'music_meta_req' ? `music_meta:${obj.file_id}`
@@ -2171,6 +2188,16 @@ class MeshBayTransport {
       return;
     }
 
+    // Same reasoning as media_meta_resp: keyed by url, and "nobody's waiting"
+    // must not fall through.
+    if (msg.type === 'link_preview_resp') {
+      const key = `link_preview:${msg.url}`;
+      for (const [, handler] of this._pending) {
+        if (handler._key === key) { handler.resolve(msg); return; }
+      }
+      return;
+    }
+
     // Same reasoning as media_meta_resp: keyed, not arrival-order, and
     // "nobody's waiting any more" must not fall through either.
     if (msg.type === 'music_meta_resp') {