fix: harden HTTP trust boundaries (#1316)

src/ui/lib/base-path.ts

@@ -1,6 +1,10 @@
 export function getBasePath(): string {
-  const runtime = (window as unknown as Record<string, unknown>)
-    .__TERMIX_BASE_PATH__ as string | undefined;
+  const runtime =
+    document
+      .querySelector<HTMLMetaElement>('meta[name="termix-base-path"]')
+      ?.content.trim() ||
+    ((window as unknown as Record<string, unknown>).__TERMIX_BASE_PATH__ as
+      string | undefined);
   if (runtime) {
     return runtime.endsWith("/") ? runtime.slice(0, -1) : runtime;
   }

src/ui/tests/lib/base-path.test.ts

@@ -5,6 +5,7 @@ const win = window as unknown as Record<string, unknown>;
 
 afterEach(() => {
   delete win.__TERMIX_BASE_PATH__;
+  document.querySelector('meta[name="termix-base-path"]')?.remove();
 });
 
 describe("getBasePath", () => {
@@ -18,6 +19,15 @@ describe("getBasePath", () => {
     expect(getBasePath()).toBe("/termix");
   });
 
+  it("uses the CSP-safe runtime meta value when present", () => {
+    const meta = document.createElement("meta");
+    meta.name = "termix-base-path";
+    meta.content = "/gateway/termix";
+    document.head.append(meta);
+
+    expect(getBasePath()).toBe("/gateway/termix");
+  });
+
   it("strips a trailing slash from the runtime override", () => {
     win.__TERMIX_BASE_PATH__ = "/termix/";
     expect(getBasePath()).toBe("/termix");