fix(shared): use HTTP for schemeless loopback previews#29710

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

normalizePreviewUrl now selects HTTP for recognized schemeless IPv4 loopback inputs. Tests cover alternate loopback forms, non-loopback hosts, and explicit schemes.

Changes: Preview URL normalization

Layer / File(s)	Summary
Implicit scheme selection and validation packages/shared/src/preview.ts, packages/shared/src/preview.test.ts	The normalizer records whether the input has an explicit scheme. For recognized schemeless IPv4 loopback hosts that initially default to HTTPS, it returns the input with http://. Tests cover alternate loopback forms, non-loopback hosts, and explicit schemes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Possibly related PRs

• pingdotgg/t3code#29720: Both PRs address schemeless 127.x.x.x preview URLs, using different loopback matching approaches.
• pingdotgg/t3code#29614: Both PRs modify scheme handling in normalizePreviewUrl.
• pingdotgg/t3code#27876: Both PRs apply HTTP defaults to schemeless local addresses.

Suggested labels: bugfix

Suggested reviewers: juliusmarminge

The loopback scheme fix is suitable for merge with no identified material risk.

Check name	Status	Explanation
Title check	Passed	The title "fix(shared): use HTTP for schemeless loopback previews" names the main change. The changeset makes schemeless IPv4 loopback inputs (such as 127.0.0.2:) default to HTTP in normalizePre…
Linked Issues check	Passed	Issue #29702 requires schemeless IPv4 loopback addresses to use HTTP and explicit schemes to remain authoritative. normalizePreviewUrl first parses the input, then uses isLocalLoopbackHost for par…
Out of Scope Changes check	Passed	The supplied change summary identifies only packages/shared/src/preview.ts and packages/shared/src/preview.test.ts. The source change implements implicit scheme selection. The tests cover the issu…
Description check	Passed	The description follows the repository template and covers the problem, change, scope and approval, and verification. It links the linked issue #29702 and describes the fix: recognizing canonical IPv4…

Full details: Title check

Explanation

The title "fix(shared): use HTTP for schemeless loopback previews" names the main change. The changeset makes schemeless IPv4 loopback inputs (such as 127.0.0.2:<port>) default to HTTP in normalizePreviewUrl, and adds regression tests for that case. The title follows conventional commit format and is specific.

Full details: Linked Issues check

Explanation

Issue #29702 requires schemeless IPv4 loopback addresses to use HTTP and explicit schemes to remain authoritative. normalizePreviewUrl first parses the input, then uses isLocalLoopbackHost for parsed 127.* hostnames and reparses the original input with http://. This preserves ports and paths, including port 443. resolveAddressBarInput uses this normalizer for address inputs. Tests cover 127.0.0.2, other IPv4 loopback forms, port 443, explicit schemes, and non-loopback hosts.

Full details: Out of Scope Changes check

Explanation

The supplied change summary identifies only packages/shared/src/preview.ts and packages/shared/src/preview.test.ts. The source change implements implicit scheme selection. The tests cover the issue and preserved behavior. No UI, settings, workflow, port-discovery, or remote-host rewriting change is identified. The repository diff was unavailable, so this scope result relies on the supplied whole-PR summary and the inspected file contents.

Full details: Description check

Explanation

The description follows the repository template and covers the problem, change, scope and approval, and verification. It links the linked issue #29702 and describes the fix: recognizing canonical IPv4 loopback hosts for implicit-scheme selection and reparsing the original input as HTTP so explicit ports such as 443 are kept. The scope section explains why no prior issue approval is needed for a small, focused fix of an obvious normalization bug, and it cites CONTRIBUTING.md. Verification gives concrete focused test commands, observed results (11 selected cases passing, 23 not selected), a real HTTP server check against 127.0.0.2, format and diff checks, and a clear statement of what was not checked (full-workspace check, build, and native desktop/mobile). The author also adds a later takeover verification with a Blacksmith CI run and Chrome browser check. The template asks for an agent model and harness at the end; the author includes 'Verified by gpt-6.1-sol through the Codex harness', which satisfies this. The illustrative infographic is clearly labeled as non-evidence. Minor issues: the Problem section gives no explicit expected-behavior statement beyond the failure, and the verification section mixes two sets of results, which could confuse a reviewer, but neither omission is critical.

Generate unit tests (beta)

• Create a new PR