Deny framing for Workshop UI

src/server.ts

@@ -384,6 +384,15 @@ function demoChatHtml(): string {
 export async function createServer(port: number) {
   const app = express();
   const server = http.createServer(app);
+
+  // Workshop is a local control plane with UI actions that can launch local
+  // agents. Do not allow a remote page to frame the UI and drive those actions.
+  app.use((_req, res, next) => {
+    res.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
+    res.setHeader("X-Frame-Options", "DENY");
+    next();
+  });
+
   const wss = new WebSocketServer({
     server,
     path: "/ws",

tests/security-headers.test.ts

@@ -0,0 +1,18 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import request from "supertest";
+import { createServer } from "../src/server";
+
+const { app, server } = await createServer(0);
+
+afterAll(() => {
+  server.close();
+});
+
+describe("security headers", () => {
+  test("prevents hostile pages from framing the Workshop UI", async () => {
+    const response = await request(app).get("/health").expect(200);
+
+    expect(response.headers["content-security-policy"]).toBe("frame-ancestors 'none'");
+    expect(response.headers["x-frame-options"]).toBe("DENY");
+  });
+});