@lotics/cli 0.30.0 → 0.30.1

package/dist/src/dev/wrapper_page.d.ts

@@ -2,11 +2,16 @@
  * Builds the wrapper HTML for `lotics app dev`.
  *
  * The wrapper page is served at http://localhost:<port>/ and embeds the
- * project's Vite dev server in a sandboxed iframe with the same
- * sandbox="allow-scripts" attribute production uses. The iframe sends
- * postMessage RPCs to this wrapper, which forwards them to the local
- * /_rpc endpoint, which dispatches to api.lotics.ai with the CLI's API
- * key.
+ * project's Vite dev server in an iframe with the same
+ * sandbox="allow-scripts allow-same-origin" attribute production uses —
+ * safe because the Vite iframe is cross-origin to this wrapper (different
+ * port), so the app gets its own real origin (and Web Storage) without
+ * being able to reach the wrapper. The iframe sends postMessage RPCs to
+ * this wrapper, which forwards them to the local /_rpc endpoint, which
+ * dispatches to api.lotics.ai with the CLI's API key.
+ *
+ * postMessage is origin-locked both ways — the wrapper passes its origin
+ * via `?lotics_host=` and talks only to the Vite origin.
  *
  * Protocol matches `frontend/features/app_ui/app_iframe_host.tsx` exactly:
  *   iframe → wrapper: { id: number, op: string, payload: unknown }

package/dist/src/dev/wrapper_page.js

@@ -2,11 +2,16 @@
  * Builds the wrapper HTML for `lotics app dev`.
  *
  * The wrapper page is served at http://localhost:<port>/ and embeds the
- * project's Vite dev server in a sandboxed iframe with the same
- * sandbox="allow-scripts" attribute production uses. The iframe sends
- * postMessage RPCs to this wrapper, which forwards them to the local
- * /_rpc endpoint, which dispatches to api.lotics.ai with the CLI's API
- * key.
+ * project's Vite dev server in an iframe with the same
+ * sandbox="allow-scripts allow-same-origin" attribute production uses —
+ * safe because the Vite iframe is cross-origin to this wrapper (different
+ * port), so the app gets its own real origin (and Web Storage) without
+ * being able to reach the wrapper. The iframe sends postMessage RPCs to
+ * this wrapper, which forwards them to the local /_rpc endpoint, which
+ * dispatches to api.lotics.ai with the CLI's API key.
+ *
+ * postMessage is origin-locked both ways — the wrapper passes its origin
+ * via `?lotics_host=` and talks only to the Vite origin.
  *
  * Protocol matches `frontend/features/app_ui/app_iframe_host.tsx` exactly:
  *   iframe → wrapper: { id: number, op: string, payload: unknown }
@@ -53,12 +58,19 @@ export function buildWrapperPage(args) {
     <span>workspace <code>${escapeHtml(workspace_id)}</code></span>
     <span>RPC → <code>${escapeHtml(api_url)}</code></span>
   </header>
-  <iframe id="app" sandbox="allow-scripts" allow="clipboard-write" src="${escapeAttr(vite_url)}"></iframe>
+  <iframe id="app" sandbox="allow-scripts allow-same-origin" allow="clipboard-write"></iframe>
   <script>
     (function () {
       const APP_ID = ${JSON.stringify(app_id)};
+      const VITE_URL = ${JSON.stringify(vite_url)};
+      const VITE_ORIGIN = new URL(VITE_URL).origin;
       const iframe = document.getElementById("app");
 
+      // Pass the wrapper's own origin to the app via ?lotics_host= so the app
+      // SDK can origin-lock its postMessage bridge.
+      iframe.src = VITE_URL + (VITE_URL.indexOf("?") >= 0 ? "&" : "?")
+        + "lotics_host=" + encodeURIComponent(window.location.origin);
+
       async function rpc(op, payload) {
         const res = await fetch("/_rpc", {
           method: "POST",
@@ -104,7 +116,7 @@ export function buildWrapperPage(args) {
       }
 
       window.addEventListener("message", async function (event) {
-        if (event.source !== iframe.contentWindow) return;
+        if (event.source !== iframe.contentWindow || event.origin !== VITE_ORIGIN) return;
         const msg = event.data;
         if (!msg || typeof msg.id !== "number" || typeof msg.op !== "string") return;
         const startedAt = performance.now();
@@ -114,13 +126,16 @@ export function buildWrapperPage(args) {
             : await rpc(msg.op, msg.payload);
           const ms = Math.round(performance.now() - startedAt);
           console.debug("[lotics-dev] " + msg.op + " " + ms + "ms", data);
-          iframe.contentWindow.postMessage({ id: msg.id, type: "result", data: data }, "*");
+          iframe.contentWindow.postMessage(
+            { id: msg.id, type: "result", data: data },
+            VITE_ORIGIN
+          );
         } catch (err) {
           const message = err && err.message ? err.message : String(err);
           console.error("[lotics-dev] " + msg.op + " failed:", message);
           iframe.contentWindow.postMessage(
             { id: msg.id, type: "error", message: message },
-            "*"
+            VITE_ORIGIN
           );
         }
       });
@@ -136,6 +151,3 @@ function escapeHtml(s) {
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;");
 }
-function escapeAttr(s) {
-    return escapeHtml(s).replace(/"/g, "&quot;");
-}

package/dist/src/starter_template.js

@@ -50,7 +50,7 @@ export function buildStarterTemplate(args) {
                     test: "vitest run",
                 },
                 dependencies: {
-                    "@lotics/app-sdk": "^0.6.0",
+                    "@lotics/app-sdk": "^0.7.0",
                     "@lotics/ui": "^1.3.0",
                     "@react-native-picker/picker": "^2.7.0",
                     "expo-image": "~3.0.9",
@@ -155,6 +155,11 @@ export default defineConfig({
     // iframe loads modules from api.lotics.ai which already permits null
     // origin via CORS.
     cors: { origin: "*" },
+    // @lotics/ui/fonts.css references the API's /iframe/fonts/*.woff2 files
+    // by root-relative URL. A deployed app is served from the API origin so
+    // they resolve directly; under \`lotics app dev\` the app runs on
+    // localhost, so proxy /iframe to the API to load the real fonts.
+    proxy: { "/iframe": { target: "https://api.lotics.ai", changeOrigin: true } },
   },
   test: {
     environment: "jsdom",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {