fix(desktop): allow clipboard writes in the preview browser#3889

Problem

Built-in copy-to-clipboard buttons inside the preview browser don't work. The clearest example is the Next.js / Vercel error overlay's copy button, which surfaces:

i.e. the DOMException Failed to execute 'writeText' on 'Clipboard': Write permission denied. Any preview page calling navigator.clipboard.writeText() (or .write()) hits the same wall.

Root cause

apps/desktop/src/preview/BrowserSession.ts configured only a setPermissionRequestHandler, and its allow-list granted "clipboard-write":

Two bugs:

1. clipboard-write is not a valid Electron permission name. The async Clipboard write API maps to clipboard-sanitized-write (Electron session docs), so the intended grant never matched.
2. The write is gated by the permission check handler, which was never set. Per the docs: "you must also implement setPermissionRequestHandler to get complete permission handling. Most web APIs do a permission check and then make a permission request if the check is denied." Async clipboard.writeText() performs a synchronous clipboard-sanitized-write check; with no setPermissionCheckHandler, Electron's default denies it — hence "Write permission denied".

Fix

• Add a setPermissionCheckHandler alongside the existing request handler.
• Use the correct permission name clipboard-sanitized-write.
• Share a single ALLOWED_PREVIEW_PERMISSIONS set between both handlers so they can't drift.

The granted set is unchanged in intent (clipboard-read, clipboard write, notifications, geolocation) — this only corrects the write permission and wires up the check path. No new capabilities are exposed.

Test

Extends BrowserSession.test.ts (adds setPermissionCheckHandler to the electron mock) with a case asserting both handlers grant clipboard-sanitized-write (plus the other allowed permissions) and deny the stale clipboard-write name and unrelated permissions like midi.

Verification

• tsgo --noEmit (apps/desktop): 0 errors
• vitest run src/preview/BrowserSession.test.ts: 6/6 passed
• vp lint on the changed files: clean

🤖 Generated with Claude Code