Stop button, resizable terminal, grey Run, origin-checked APIs, distribute script

[vecnode]

What & why

Five things from this round.

1. build_and_distribute.bat

Implemented (was a stub). It sets up the MSVC environment, builds Release, then copies the build\Release folder — executable, icons/, and any runtime DLLs — to %USERPROFILE%\Desktop\neo-processing (replacing it if present, via robocopy).

2. Grey Run button

The top-left > (and the new Stop button) are now a neutral grey instead of blue.

3. Resizable terminal

Added a horizontal splitter (.h-splitter) between the preview area and the terminal, mirroring the existing editor/preview width splitter. Dragging it drives a --bottom-panel-size custom property on the layout grid (clamped 48px – 80% of the layout). The editor re-flows during the drag.

4. Stop button

A new ■ button beside Run. It removes the running sketch iframe so the sketch stops executing and rendering entirely, and resets capture state. (sketchFrame is cleared, so Record/Capture/Fullscreen then prompt "Run a sketch first".)

5. Security — isolate sketch JS from the C++ app (the main ask)

Reviewed how user JS could reach the native side. The sketch already runs in a sandbox="allow-scripts", opaque-origin iframe (no parent/DOM/storage access, can't read API responses). The one residual channel was a fire-and-forget request to the local write endpoints (whose response it can't read, but the side effect — writing to outputs/ — could still fire). Closed it:

• /api/save-script and /api/save-media now reject any request whose Origin header isn't the app's own page origin (http://127.0.0.1:<port>). The editor UI's POSTs carry that origin; the sketch's opaque-origin requests carry Origin: null → 403.
• Documented in SECURITY.md / AGENTS.md, plus guidance to treat every webview.bind as reachable by sketch code (the only bind, neoSetDesktopFullscreen, just toggles the window — reversible with Esc).

Reviewer notes

• node --check passes; Debug target builds and links.
• Verified the origin check at runtime: Origin: null → 403, foreign origin → 403, app origin → 200.
• build_and_distribute.bat wasn't auto-run here (it does a full Release build and writes a folder to the real Desktop) — run it when you want the distributable.
• WebView2-specific things to eyeball manually: the terminal drag feel, Stop clearing the canvas, and the grey buttons.

🤖 Generated with Claude Code