ZiyaZhang
59bfe77fb8
A sandbox header bought isolation by taking the document's origin away, and measuring that cost decided against it: the reported artifact throws SecurityError on load, and because an uncaught exception aborts the rest of its <script>, every listener declared after that line — theme toggle, mobile menu, model tabs — never binds. Two of the four artifacts in the reporting user's workspace were dead pages under it, and they still looked right. A second listener on the API's host, answering /f and nothing else, is the same boundary without the amputation: cross-origin to /api (refused by the Origin fence and by CORS), same-origin with itself (localStorage, cookies and fetch all work). Its port is published into the index page; the browser half reads it to address previews, and its absence — the keyless fixture lane — is what makes a file row fall back to the Host opener instead of a dead tab. fileUrl moves from IWorkspaces to ConnectionHandle: the transport owns both the listener that serves the bytes and the port that addresses it.
34 lines
503 B
JSON
34 lines
503 B
JSON
{
|
|
"extends": "../../../tsconfig.base.client.json",
|
|
"compilerOptions": {
|
|
"rootDir": "src",
|
|
"outDir": "lib/types"
|
|
},
|
|
"include": [
|
|
"src"
|
|
],
|
|
"references": [
|
|
{
|
|
"path": "../../../vendor/cordis"
|
|
},
|
|
{
|
|
"path": "../ui-slots"
|
|
},
|
|
{
|
|
"path": "../web-react"
|
|
},
|
|
{
|
|
"path": "../connection"
|
|
},
|
|
{
|
|
"path": "../runtime"
|
|
},
|
|
{
|
|
"path": "../../support/invariants"
|
|
},
|
|
{
|
|
"path": "../../host/apiproxy"
|
|
}
|
|
]
|
|
}
|