SDK v2 Phase 4 (3/4): build pipeline, sandbox shell, and the AppSandbox host
Radin committed
- Author
- Radin · radin@coline.appAug 10, 2026 at 19:09
- Committer
- Radin · radin@coline.appAug 10, 2026 at 19:09
- Parents
- a04e15a16ef4
SDK v2 Phase 4 (3/4): build pipeline, sandbox shell, and the AppSandbox host
Build (plan §7.2.5):
- lib/apps/client-build.ts: developers ship source, Coline builds —
esbuild compiles the declared entry into a self-contained IIFE (React
+ @colineapp/ui + the bridge compiled in). Imports resolve to this
monorepo's node_modules only: no dependency installation, no npm
lifecycle scripts. sha256 recorded on app_versions
(client_bundle_js/client_bundle_hash, migration 0226 applied) so the
reviewed artifact is provably the served artifact.
- v2 registration accepts clientSource {entry, files}; react-tier
surfaces without client source are rejected at registration.
Sandbox shell (plan §7.2.1):
- GET .../apps/{appKey}/sandbox/shell: session-guarded HTML with the
@colineapp/ui stylesheet inlined (generated module + sync script) and
the version's client bundle. The CSP is the security posture in one
header: connect-src 'none' — guest code cannot make ANY network
request; every capability crosses the postMessage bridge where the
host holds credentials.
Host:
- AppSandbox (components/platform/apps/app-sandbox.tsx): opaque-origin
iframe (sandbox="allow-scripts"), host bridge with live theme sync
(MutationObserver on documentElement), navigation intents into the
router, sonner toasts, and a host-rendered confirm dialog (plan
§7.2.3). Capability relay: session-authed sandbox/capability route
that re-guards through the unified guard with surface-derived effect
ceilings (editor=write, preview/home=read) and executes through the
same capability-ops as every other transport.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>1 file changed+19−0