Test Terminal Follows Scrolling

components/terminal/terminal-display.tsx

@@ -45,9 +45,22 @@ export function TerminalDisplay({ ttydUrl, status, tabId }: TerminalDisplayProps
   // Listen to postMessage from ttyd iframe (autoscroll status updates)
   useEffect(() => {
     const handleMessage = (event: MessageEvent) => {
-      // Security: Verify message format
+      // Security: Verify message format and origin
       if (typeof event.data !== 'object' || !event.data) return;
 
+      // Verify message comes from ttyd iframe (check if origin matches ttydUrl)
+      if (ttydUrl) {
+        try {
+          const ttydOrigin = new URL(ttydUrl).origin;
+          if (event.origin !== ttydOrigin) {
+            // Silently ignore messages from other origins
+            return;
+          }
+        } catch {
+          // Invalid URL, skip origin check
+        }
+      }
+
       // Handle autoscroll status updates
       if (event.data.type === 'ttyd-scroll-status') {
         const newStatus = event.data.status;
@@ -62,7 +75,7 @@ export function TerminalDisplay({ ttydUrl, status, tabId }: TerminalDisplayProps
 
     window.addEventListener('message', handleMessage);
     return () => window.removeEventListener('message', handleMessage);
-  }, [tabId]);
+  }, [tabId, ttydUrl]);
 
   // Only show terminal iframe if status is RUNNING and URL is available
   if (status === 'RUNNING' && ttydUrl) {

sandbox/entrypoint.sh

@@ -37,7 +37,8 @@ THEME='theme={
 
 # Start ttyd with authentication wrapper, theme, and custom HTML for auto-scroll injection
 # -b: Set base path for serving static files (index.html and autoscroll script)
-# -I: Custom index.html path
+# -I: Custom index.html path (required for autoscroll to work)
 ttyd -T xterm-256color -W -a -t "$THEME" \
   -b /usr/local/share/ttyd \
+  -I /usr/local/share/ttyd/index.html \
   /usr/local/bin/ttyd-auth.sh