it was originally srcDoc, but that was causing problems...

there's definitely a regression for zero state...

yeah something did break here

it looks like it's using the old /download path instead of the new static file server

Yeah here's the real breakage

What changed Before (PR #284 + #0b2a317f),

staticUrl

was a real URL on the agent server:

https://<agent-server>/api/conversations/{id}/workspace/<path>

authenticated via the

oh_workspace_session_key

cookie minted by

startWorkspaceSession

. The iframe /

<img>

loaded it directly. After PR #278 ("Route agent-server calls through TypeScript client",

a0832610

, May 2026), the workspace static fileserver and cookie session were dropped.

useWorkspaceFileContent

now downloads the bytes via

FileClient.downloadFile

and constructs a local Blob URL:

function makePreviewUrl(buffer: ArrayBuffer, mimeType: string): string {
  return URL.createObjectURL(new Blob([buffer], { type: mimeType }));
}
…
staticUrl: makePreviewUrl(buffer, mimeType),

FileContentViewer

still hands that to

<iframe src={staticUrl} sandbox="allow-same-origin">

for HTML / SVG and to

<img src={staticUrl}>

for images.

ah ok so the fix will be to re-introduced what was in place before PR #278?