feat(desktop): add favicons to the Browser panel

[chrisdeeming]

What Changed

Capture favicons from desktop preview sessions and show them in recently used sites and browser tabs, with the existing fallback when no captured icon is available.

Why

External favicon lookups cannot resolve local or private sites. Capturing the favicon from the browser keeps those icons accurate and available across sessions.

UI Changes

Recently used sites and browser tabs now show captured site favicons. Screenshots show the state before #5270 (history tracking) was merged, the state before the favicons are displayed, and the state after this PR is merged.

Before #5270	Before #5644	After #5644

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Prepared with GPT-5.6 Codex in T3 Code.

---

Note

Medium Risk
New untrusted image fetch/decode paths in Electron and stricter hostname gating for external favicon URLs; behavior is heavily tested but touches preview navigation and webview attachment edge cases.

Overview
Adds end-to-end favicon capture for the desktop browser preview: Electron listens for page-favicon-updated, fetches or decodes candidates through FaviconCapture (size limits, format validation, timeouts, rasterization to bounded PNG), and PreviewManager publishes icons into tab state with navigation/webview lifecycle guards.

The web app persists captured icons in a Zustand store keyed by project scope and origin (with environment-host aliases), mirrors live favicons through the preview bridge, and shows them in browser tabs, recent URLs, and local server cards via FaviconImage (captured first, then public fallback).

isPublicFaviconHost and expanded private-network checks block Google’s S2 favicon URL for local, special-purpose, and malformed hostnames so private sites are not leaked to a third party.

^{Reviewed by Cursor Bugbot for commit 143c2a3. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add favicons to the Browser panel tab bar and empty state cards

• Captures favicons from Electron WebContents via page-favicon-updated, fetches and normalizes the image, and publishes it into desktop preview tab state through FaviconCapture.ts and Manager.ts.
• Stores favicons in a persisted Zustand store (browserFaviconStore.ts) keyed by project scope and URL origin, with alias support for loopback/environment hosts, bounded eviction, and localStorage fallback.
• Renders captured favicons in the tab bar (RightPanelTabs.tsx), recent URL cards, and local server cards, falling back to a public Google S2 provider URL (blocked for private hosts) and then a globe icon.
• Adds isPublicFaviconHost to browserTargetResolver.ts with comprehensive IPv4/IPv6 and special-purpose range checks; faviconUrlForOrigin now returns null for private/local hosts.
• Risk: RightPanelTabs and PreviewEmptyState now require new props (desktopByTabId, threadRef) — callers that don't pass them will have type errors.

^{Macroscope summarized 143c2a3.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: af89d8d7-0454-4ebc-bbf6-829dd38edb1c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for favicon capture and display with significant scope (~2000+ lines of new logic), security-sensitive hostname classification for determining what data is sent to external favicon providers, and new image processing/network handling capabilities. New features of this magnitude warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[t3-code]

the requested aspect-ratio repair is in place for ordinary landscape and portrait images, and the nat64 and stale-tab-origin follow-ups are fixed. one privacy edge case still blocks approval. focused lint, desktop/web typechecks, diff check, and 139 targeted tests pass at this head.

[t3-code]

the trailing-dot privacy bypass is fixed at this head, including repeated dots and shorthand numeric hosts. one aspect-ratio edge case remains in the desktop rasterizer: exif-oriented jpeg favicons use stored jpeg dimensions for scaling, while createImageBitmap applies orientation metadata before the forced resize. this stretches rotated non-square images. the focused 143-test suite, typechecks, lint, diff check, and ci otherwise pass.

[t3-code]

one additional storage-fallback blocker from the independent exact-head pass. the privacy repair itself remains verified.

[t3-code]

the prior single-exif orientation and storage-shadow blockers are fixed, and the multi-sof rejection is in place. one valid multiple-exif case still breaks the display aspect-ratio guarantee. 147 focused tests, desktop/web typechecks, lint, diff check, and required ci pass.

[t3-code]

the conflicting-valid EXIF precedence case is fixed, but the new invalid-first behavior diverges from Chromium and still permits aspect-ratio inversion. 150 focused tests, desktop/web typechecks, lint, diff check, and required ci pass.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6d1b3fd. Configure here.}

[t3-code]

approved exact head 143c2a3ec0d45f99e049abee7da91aa609956ffd. all previously reported favicon privacy, image safety, aspect-ratio, tab race, and storage fallback blockers are resolved. the repeated invalid-first EXIF APP1 case now matches Electron/Chromium behavior. 177 focused tests across 11 suites, scoped desktop/web typechecks, focused lint, diff check, all required CI, and independent Electron/Chromium adversarial probes pass. the only red status is the unrelated, non-required Vercel marketing authorization check.