Hosted Artifact Resource Read

Traceability

• Spec ID: hosted-artifact-resource-read
• Status: Implemented

Intent

Allow a trusted external-hosted Artifact renderer to read revision-scoped binary resources through Studio's existing /viewer/* resource route. This enables large geometry and media to remain outside JSON projections while the Host continues to own provider selection, route confinement, and response headers.

Acceptance Scenarios

• AC-1: A hosted iframe may fetch a resource from its own revision-scoped /viewer/ origin, and the Host returns only bytes supplied by the selected provider runtime.
• AC-2: The hosted document CSP continues to reject cross-origin network connections, plugins, navigation authority, and same-origin DOM access from the parent; only same-origin resource reads are added.
• AC-3: Existing hosted modules, source maps, and provider resource routes keep their current response behavior.

Non-goals

• No arbitrary network access, cookie forwarding, filesystem paths, or new provider activation authority.
• No change to iframe sandbox flags or hosted selection/mutation protocols.
• No format-specific 3D behavior in Better Harness.

Plan and Tasks

• Change the common hosted-document CSP from connect-src 'none' to the narrowly scoped connect-src 'self' required by its existing resource route.
• Extend the hosted provider server test with an observable same-origin resource fetch contract and a negative assertion against broad network allowances.
• Run focused server tests and a browser smoke using a Homology FBX provider.

Test and Review Evidence

• AC-1/AC-3: Node 24 npm exec vitest run test/artifact-provider-server.test.ts passed 1 file / 3 tests from packages/harness-studio.
• AC-2: the focused test verified connect-src 'self' without any HTTP(S) origin; the mounted Studio frame retained sandbox="allow-scripts".
• Browser evidence: the live Homology fixture selected exact revision 9351731f...56acb9; Studio displayed the shared Scene 3D tree and viewport, the frame reported homology.viewer.scene-3d/v1, host-read-resource-v1, and a ready Canvas. Tree and viewport selection both highlighted node:200; console reported 0 errors and 0 warnings. At 390x844, document client and scroll widths were both 390 pixels.
• Host evidence: verify-studio.mjs fetched the selected provider's scene.json and scene.bin through the revision-scoped hosted-resource route, matched manifest geometry length, and returned HTTP 200 for catalog, snapshot, document, module, and resource endpoints.