Reuse canonical home and settings on Node and admit local K1 viewer

apps/node-agent/internal/node/server.go

@@ -24,6 +24,7 @@ type Server struct {
 	Access           *AccessStore
 	Tailscale        func() TailscaleStatus
 	Environment      func() EnvironmentStatus
+	Presentation     *PresentationStore
 	mu               sync.Mutex
 	logins           map[string]time.Time
 	sessions         map[string]time.Time
@@ -80,6 +81,9 @@ func reply(w http.ResponseWriter, status int, v any) {
 
 func (s *Server) Handler() http.Handler {
 	mux := http.NewServeMux()
+	if s.Presentation != nil {
+		s.presentationRoutes(mux)
+	}
 	if s.Sensors != nil {
 		s.Sensors.Routes(mux, s)
 	}
@@ -165,7 +169,11 @@ func (s *Server) Handler() http.Handler {
 		w.Header().Set("Cache-Control", "no-store")
 		w.Header().Set("X-Content-Type-Options", "nosniff")
 		w.Header().Set("Referrer-Policy", "no-referrer")
-		w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'")
+		ancestor, scripts := "'none'", "'self'"
+		if r.URL.Path == "/rerun-runtime.html" {
+			ancestor, scripts = "'self'", "'self' 'wasm-unsafe-eval'"
+		}
+		w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src "+scripts+"; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https: http:; media-src 'self' blob: https: http:; connect-src 'self'; frame-src 'self'; worker-src 'self' blob:; frame-ancestors "+ancestor+"; base-uri 'none'; form-action 'self'")
 		if "http://"+r.Host != s.Origin {
 			http.Error(w, "Invalid host", http.StatusForbidden)
 			return