dreampiler/kandev
1
0
Fork 0
Code Issues 43 Pull Requests Actions 6 Packages Projects Releases Wiki Activity

fix: restore canvas runtime and panel toolbar behavior (#3827)

Browse Source
This commit is contained in:
Carlos Florêncio
2026-09-20 11:33:30 +01:00
committed by GitHub
parent 02ac02cd66
commit 93a7cba937
86 changed files with 6295 additions and 1640 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/public/plugins-authoring.md
+14 -8
View File
@@ -150,9 +150,13 @@ the canvas recoverable after 15 seconds. Keep the entry document and its
relative assets valid HTML, and make the app render its own loading and error
states after startup.
The frame has an opaque browser origin. Do not use `localStorage`,
`sessionStorage`, IndexedDB, or service workers. Use the state protocol for
small app-specific shared values and JavaScript memory for temporary values.
The frame is same-origin with Kandev and canvas code is trusted with the
viewing user's ordinary user-session authority. It can use `localStorage`,
`sessionStorage`, IndexedDB, same-origin cookies, and the host DOM. Keep
Kandev protocol requests relative and do not copy capability URLs or tokens.
Use the state protocol for small app-specific shared values and JavaScript
memory for temporary values. Capability URLs, release bindings, scope checks,
and declared grants still govern every Kandev protocol operation.
Network access uses exact HTTPS origins that a user approves. Wildcards,
origin paths, query strings, credentials, and remote scripts are not allowed.
@@ -275,10 +279,12 @@ curated React, UI, and app-store surface.
Host adapters consume the approval receipt/query surface; they do not derive
authority from plugin IDs, package digests, or workspace state.
An isolated web app has a separate browser boundary. Kandev loads it in a
sandboxed iframe with an opaque origin. It cannot use the host DOM, cookies,
host authentication headers, popups, top-level navigation, or a global Kandev
JavaScript API. See [Security and trust](security.md#isolated-web-applications)
An isolated web app has a separate iframe and sandbox boundary. Kandev loads it
same-origin with the host, so its trusted source can use the viewing user's
ordinary browser authority, including cookies, storage, and the host DOM. It
still cannot open popups or navigate the top-level page, and it receives no
global Kandev JavaScript API. Capability URLs and grants remain required for
Kandev protocol operations. See [Security and trust](security.md#isolated-web-applications)
for the runtime boundary.
## Storage decision table
@@ -288,7 +294,7 @@ for the runtime boundary.
| Small JSON object owned by this plugin | Host state: GetState, SetState, DeleteState, ListState | instance, workspace, task, or agent; survives restart/upgrade and is included in Kandev state backups | capabilities.state: true; values are JSON objects, not bare scalars |
| Canvas app shared state | Relative `./_kandev/v1/state` protocol | Canvas instance; survives restart while the instance remains | `state` grant, store app-specific shared values, not duplicate task data |
| Per-user browser/plugin storage | host.storage: get/set/delete/list/subscribe | instance, workspace, task, session, or repository, scoped per user | capabilities.user_state: true; set/delete accept ifUnmodifiedSince and writerId |
| Temporary canvas app value | JavaScript memory inside the iframe | Current document only | Opaque origin blocks browser storage and service workers |
| Temporary canvas app value | JavaScript memory inside the iframe | Current document only | Use browser storage for user-scoped client data; keep shared app values in canvas state |
| Operator configuration | Host.GetConfig and manifest config_schema | Plugin-owned settings; config changes restart an active subprocess | Ungated GetConfig; secret fields arrive cleartext in the subprocess |
| Plugin-owned credentials | Host.GetSecret/SetSecret/DeleteSecret, or secret: true config fields | Encrypted Kandev vault, namespaced to this plugin | capabilities.secrets: true; never log values |
| Files, caches, or plugin-managed database | KANDEV_PLUGIN_DATA_DIR | Shared across versions, removed on uninstall | Write only below the injected directory; own schema, locking, and migrations |