open-design/apps
zqyaym b22c7713db
fix(web): prevent preview iframe from stealing focus on load (#2792)
* Fix preview iframe focus stealing

* Fix preview focus guard for URL-loaded HTML previews

Focus guard was only injected via the srcdoc path, but the default
URL-load path bypasses buildSrcdoc entirely. Add htmlNeedsFocusGuard
detection so focus-stealing HTML is routed through srcdoc where the
guard can suppress window.focus/element.focus calls.

* Widen focus guard detector to cover all .focus() call patterns

The previous regex only matched window.focus() and document.focus(),
missing document.body.focus(), querySelector().focus(), and other
chained focus calls. Broaden to match any `.focus(` so the default
URL-loaded preview path is forced to srcDoc for all focus-stealing HTML.

* Conservatively force srcDoc for HTML with external script references

When the HTML contains <script src=...>, we cannot inspect the linked
file for focus-stealing calls. Force the srcDoc path so the focus guard
intercepts any .focus() calls from external scripts.

---------

Co-authored-by: JoeyZhu <15500388+acthenknow@user.noreply.gitee.com>
2026-05-24 14:37:08 +00:00
..
daemon fix(daemon): close # Instructions block with an explicit do-not-echo guard (#2827) 2026-05-24 14:30:58 +00:00
desktop Fix release updater smoke recovery (#2687) 2026-05-22 16:18:33 +08:00
landing-page fix(landing-page): drop trailing slash from preview iframe URLs (#2790) 2026-05-23 05:22:35 +00:00
packaged fix(packaged): honor OD_DATA_DIR in desktop runtime (#2162) 2026-05-24 14:21:54 +00:00
telemetry-worker chore: pin dependency versions and harden CI caches (#2189) 2026-05-19 13:58:27 +08:00
web fix(web): prevent preview iframe from stealing focus on load (#2792) 2026-05-24 14:37:08 +00:00
AGENTS.md refactor(daemon): split agent runtime definitions (#1063) 2026-05-11 15:01:55 +08:00