Chat+ link previews: a link in a chat shows its page's title, text and picture, YouTube playable in place

X's web chat shows a link as a bare card. An X tab on a chat page may now ask native code
(link_preview, x-capture only, chat pages only) for one link's preview. Native code fetches it:
https and public hosts only (addresses checked and pinned), never X's hosts, no cookies or
referrer, redirects re-checked, page head <= 512 KB, images <= 1.5 MB by magic bytes as data:,
30 fetches a minute, memory-only cache. Only the link leaves the page. On by default (owner,
2026-10-10).

apps/desktop/tests/chat-link-previews.test.ts

@@ -0,0 +1,48 @@
+// Chat+ link previews (src/areas/chat/linkPreviews.ts; native side src-tauri/src/link_preview.rs):
+// which links are asked about, how a native answer is checked again before it becomes page text,
+// and which of X's cards a preview stands in for. Nothing here touches the network or x.com.
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+import { asPreview, isBareCard, previewable } from '../src/areas/chat/linkPreviews.ts';
+
+test('link previews: only plain https links to hosts that are not X\'s own', () => {
+  assert.equal(previewable('https://www.youtube.com/watch?v=dQw4w9WgXcQ'), 'https://www.youtube.com/watch?v=dQw4w9WgXcQ');
+  assert.equal(previewable('https://example.org/'), 'https://example.org/');
+  for (const bad of [
+    'http://example.com/', 'https://user:pw@example.com/', 'https://example.com:8443/', 'https://192.168.0.1/', 'https://[::1]/',
+    'https://intranet/', 'https://x.com/a/status/1', 'https://t.co/abc', 'https://pbs.twimg.com/media/a.jpg', 'javascript:alert(1)', '/i/chat/1-2', '', null,
+  ]) assert.equal(previewable(bad), null, String(bad));
+});
+
+test('link previews: a native answer is checked again: plain fields, capped, data: images of four types, an 11-character video id', () => {
+  const good = asPreview({ url: 'https://example.org/', site: 'Sample', title: 'The social aquarium', description: 'x'.repeat(400), image: 'data:image/png;base64,iVBORw0KGgo=' });
+  assert.ok(good);
+  assert.equal(good.description.length, 300);
+  assert.equal(good.image, 'data:image/png;base64,iVBORw0KGgo=');
+  assert.equal(asPreview({ url: 'https://a.example/', title: 't', image: 'data:image/svg+xml;base64,PHN2Zz4=' })?.image, undefined, 'no SVG');
+  assert.equal(asPreview({ url: 'https://a.example/', title: 't', image: 'https://tracker.example/p.gif' })?.image, undefined, 'no remote image');
+  assert.equal(asPreview({ url: 'https://youtu.be/x', title: 't', youtube: 'dQw4w9WgXcQ' })?.youtube, 'dQw4w9WgXcQ');
+  assert.equal(asPreview({ url: 'https://youtu.be/x', title: 't', youtube: 'a"onload="x' })?.youtube, undefined);
+  assert.equal(asPreview({ url: 'javascript:alert(1)', title: 't' }), null, 'the link itself is re-checked');
+  assert.equal(asPreview({ url: 'https://a.example/', title: '' }), null, 'nothing to show, no card');
+  assert.equal(asPreview('nope'), null);
+});
+
+test('link previews: X\'s bare card (a host name and an icon) is replaced; a card with its own picture or a sentence is not', () => {
+  const anchor = (text: string, media = false) => ({ textContent: text, querySelector: () => (media ? {} : null) }) as unknown as Element;
+  assert.equal(isBareCard(anchor('www.youtube.com')), true);
+  assert.equal(isBareCard(anchor('example.org')), true);
+  assert.equal(isBareCard(anchor('www.youtube.com', true)), false);
+  assert.equal(isBareCard(anchor('watch this video')), false);
+  assert.equal(isBareCard(anchor('www.youtube.com/watch?v=jNQXAC9IVRw')), false, 'a link in the text (live 2026-10-10) stays');
+  assert.equal(isBareCard(anchor('')), false);
+});
+
+test('link previews: page text only through textContent, the player only on YouTube\'s host X allows, no request from the page', () => {
+  const source = readFileSync(new URL('../src/areas/chat/linkPreviews.ts', import.meta.url), 'utf8');
+  assert.doesNotMatch(source, /innerHTML|insertAdjacentHTML|outerHTML|document\.write/);
+  assert.doesNotMatch(source, /\bfetch\(|XMLHttpRequest|WebSocket|sendBeacon/);
+  for (const match of source.matchAll(/https:\/\/([a-z0-9.-]+)\//g)) assert.ok(['i.ytimg.com', 'www.youtube.com'].includes(match[1]!), match[1]);
+  assert.match(source, /rel = 'noopener noreferrer'/);
+});