@flowdular/sandbox 0.2.2 → 0.2.4

package/README.md

@@ -82,7 +82,7 @@ platform database.
 
 The token is encrypted at rest with a key in `.flowdular/sandbox/secret.key` and
 is never returned to the browser. The application may run anywhere: the sandbox
-works the same against `http://127.0.0.1:4310` and a deployment.
+defaults to `http://localhost:4310`, which supports Vite's IPv4 or IPv6 loopback listener, and can also connect to a deployment. For an older application, enable `sandbox.core` with `pnpm flowdular module enable sandbox.core --apply` while the application is stopped, then restart it. If local demo setup reset the database, issue a new API token before reconnecting.
 
 Sign-in is enforced on the platform side: the token authenticates as its
 account, and `sandbox.core` must hold an active grant for it.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flowdular/sandbox",
-	"version": "0.2.2",
+	"version": "0.2.4",
 	"description": "The Flowdular sandbox: chat a change, build it behind the gates, preview it in the real application, deliver it as code.",
 	"license": "MIT",
 	"homepage": "https://github.com/flowdular/flowdular/tree/main/packages/sandbox#readme",
@@ -57,7 +57,7 @@
 		"octane": "0.1.51",
 		"segment-state": "0.2.0",
 		"vite": "8.2.2",
-		"@flowdular/sdk": "0.2.1"
+		"@flowdular/sdk": "0.2.3"
 	},
 	"imports": {
 		"#coding-agent": "./internal/coding-agent/src/index.ts"

package/src/server/config.ts

@@ -98,7 +98,7 @@ export const DEFAULT_GITHUB_CONFIGURATION: GitHubDeliveryConfiguration = {
 export const DEFAULT_CONFIGURATION: SandboxConfiguration = {
 	version: 1,
 	mode: 'loopback',
-	platformUrl: 'http://127.0.0.1:4310',
+	platformUrl: 'http://localhost:4310',
 	platformToken: null,
 	driver: 'claude-code',
 	driverModel: null,

package/vite.config.ts

@@ -1,5 +1,6 @@
 import { flowdularEnvironment } from '@flowdular/sdk/kernel/runtime-config';
 import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { octane } from '@octanejs/vite-plugin';
@@ -13,6 +14,13 @@ import type { SandboxSession } from './src/server/sessions.ts';
 Object.assign(process.env, flowdularEnvironment(process.env));
 
 const appRoot = dirname(fileURLToPath(import.meta.url));
+// npx installs UI dependencies beside the sandbox, outside the app/workspace.
+// Allow only the font asset directories, never the surrounding npm cache.
+const uiRequire = createRequire(import.meta.resolve('@flowdular/sdk/ui'));
+const fontDirectories = [
+	'@fontsource-variable/ibm-plex-sans',
+	'@fontsource/ibm-plex-mono',
+].map((name) => join(dirname(uiRequire.resolve(name)), 'files'));
 const workspace = await findFlowdularWorkspace(
 	process.env.FD_SANDBOX_WORKSPACE ?? process.cwd(),
 );
@@ -126,7 +134,7 @@ const config = {
 		   outside this app's root. The preview reloads itself instead, and a Vite
 		   overlay must never cover a module someone is reviewing. */
 		hmr: { overlay: false },
-		fs: { allow: [appRoot, workspace.root] },
+		fs: { allow: [appRoot, workspace.root, ...fontDirectories] },
 		watch: { ignored: ['**/.flowdular/data/**', '**/.coreloom/data/**'] },
 	},
 } satisfies import('vitest/config').UserWorkspaceConfig;