From 900bf141b8aec27d1e0a8d189cbdb09ac71e19d4 Mon Sep 17 00:00:00 2001
From: Kelvin Amoaba <97001695+AmoabaKelvin@users.noreply.github.com>
Date: Fri, 13 Nov 2026 10:15:34 +0000
Subject: [PATCH] fix(browser): don't offer to open a streamed page's server
 loopback URL on this machine

The streamed pane's context menu opened the page or link URL as-is in
the desktop's default browser, so a server's localhost page opened this
machine's localhost. Use resolveRemoteFailureExternalUrl, as the
streamed error page already does, and leave the items out when it
refuses.
---
 .../remote-browser-page-context-menu.tsx      | 69 ++++++++++---------
 1 file changed, 38 insertions(+), 31 deletions(-)

diff --git a/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-context-menu.tsx b/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-context-menu.tsx
index 0c35b2407ea..ee5b265cdcb 100644
--- a/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-context-menu.tsx
+++ b/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-context-menu.tsx
@@ -3,8 +3,8 @@ import { createPortal } from 'react-dom'
 import { callRuntimeRpc } from '@/runtime/rpc/calls/runtime-rpc-call'
 import { useTranslate } from '@/i18n/use-translate'
 import {
-  normalizeExternalBrowserUrl,
-  redactKagiSessionToken
+  redactKagiSessionToken,
+  resolveRemoteFailureExternalUrl
 } from '../../../../../shared/browser-url'
 import { isRemoteBrowserPageMissingError } from './remote-browser-stream-errors'
 import type { RemoteBrowserStreamLifecycle } from './remote-browser-stream-lifecycle'
@@ -171,6 +171,12 @@ export function RemoteBrowserPageContextMenu({
     el.style.top = `${Math.max(0, renderY) + offsetY}px`
   }, [contextMenu])
 
+  // The server's loopback address would open this machine's, not the page's.
+  const linkExternalUrl = contextMenu.linkUrl
+    ? resolveRemoteFailureExternalUrl(contextMenu.linkUrl)
+    : null
+  const pageExternalUrl = resolveRemoteFailureExternalUrl(contextMenu.pageUrl)
+
   return createPortal(
     <>
       <div className="fixed inset-0 z-50" onPointerDown={onDismiss} />
@@ -193,22 +199,21 @@ export function RemoteBrowserPageContextMenu({
                 'Open Link In Orca Browser'
               )}
             </button>
-            <button
-              role="menuitem"
-              className="relative flex w-full cursor-default items-center gap-2 rounded-[7px] px-2 py-0.5 text-[12px] leading-5 font-medium outline-none select-none hover:bg-black/8 dark:hover:bg-white/14"
-              onClick={() => {
-                const targetUrl = normalizeExternalBrowserUrl(contextMenu.linkUrl!)
-                if (targetUrl) {
-                  void window.api.shell.openUrl(targetUrl)
-                }
-                onDismiss()
-              }}
-            >
-              {t(
-                'auto.components.browser.pane.BrowserPane.8ce4f6b12e',
-                'Open Link In Default Browser'
-              )}
-            </button>
+            {linkExternalUrl ? (
+              <button
+                role="menuitem"
+                className="relative flex w-full cursor-default items-center gap-2 rounded-[7px] px-2 py-0.5 text-[12px] leading-5 font-medium outline-none select-none hover:bg-black/8 dark:hover:bg-white/14"
+                onClick={() => {
+                  void window.api.shell.openUrl(linkExternalUrl)
+                  onDismiss()
+                }}
+              >
+                {t(
+                  'auto.components.browser.pane.BrowserPane.8ce4f6b12e',
+                  'Open Link In Default Browser'
+                )}
+              </button>
+            ) : null}
             <button
               role="menuitem"
               className="relative flex w-full cursor-default items-center gap-2 rounded-[7px] px-2 py-0.5 text-[12px] leading-5 font-medium outline-none select-none hover:bg-black/8 dark:hover:bg-white/14"
@@ -259,19 +264,21 @@ export function RemoteBrowserPageContextMenu({
           {t('auto.components.browser.pane.BrowserPane.0e080d820e', 'Reload')}
         </button>
         <div className="my-1 h-px bg-border/70" />
-        <button
-          role="menuitem"
-          className="relative flex w-full cursor-default items-center gap-2 rounded-[7px] px-2 py-0.5 text-[12px] leading-5 font-medium outline-none select-none hover:bg-black/8 dark:hover:bg-white/14"
-          onClick={() => {
-            const targetUrl = normalizeExternalBrowserUrl(contextMenu.pageUrl)
-            if (targetUrl) {
-              void window.api.shell.openUrl(targetUrl)
-            }
-            onDismiss()
-          }}
-        >
-          {t('auto.components.browser.pane.BrowserPane.f7ab83f7ed', 'Open Page In Default Browser')}
-        </button>
+        {pageExternalUrl ? (
+          <button
+            role="menuitem"
+            className="relative flex w-full cursor-default items-center gap-2 rounded-[7px] px-2 py-0.5 text-[12px] leading-5 font-medium outline-none select-none hover:bg-black/8 dark:hover:bg-white/14"
+            onClick={() => {
+              void window.api.shell.openUrl(pageExternalUrl)
+              onDismiss()
+            }}
+          >
+            {t(
+              'auto.components.browser.pane.BrowserPane.f7ab83f7ed',
+              'Open Page In Default Browser'
+            )}
+          </button>
+        ) : null}
         <button
           role="menuitem"
           className="relative flex w-full cursor-default items-center gap-2 rounded-[7px] px-2 py-0.5 text-[12px] leading-5 font-medium outline-none select-none hover:bg-black/8 dark:hover:bg-white/14"