@replohq/sandbox-runtime 1.19.1 → 1.19.3

package/LinkInterceptor.js

@@ -1,30 +1,50 @@
 "use client";
 import { useEffect } from "react";
+import {
+  EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID,
+  EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION,
+  parentToSandboxExternalNavigationMethodConfig,
+  sandboxToParentExternalNavigationMethodConfig
+} from "./_vendor/schemas/externalNavigationIframeRpc.mjs";
+import {
+  createIframeRpcChannel,
+  createIframeRpcRemote
+} from "./_vendor/schemas/iframeRpcChannel.mjs";
 import { displayModeStore } from "./select-mode/displayModeStore";
-const EXTERNAL_NAVIGATION_HANDLER_KEY = "__reploExternalNavigationHandler";
 function blockNavigation(event) {
   event.preventDefault();
   event.stopPropagation();
   event.stopImmediatePropagation();
 }
 function isNavigationLike(value) {
-  if (typeof value !== "object" || value === null) {
-    return false;
-  }
-  return typeof Reflect.get(value, "addEventListener") === "function" && typeof Reflect.get(value, "removeEventListener") === "function";
+  return typeof value === "object" && value !== null && "addEventListener" in value && typeof value.addEventListener === "function" && "removeEventListener" in value && typeof value.removeEventListener === "function";
 }
 function getWindowNavigation() {
-  const navigation = Reflect.get(window, "navigation");
-  return isNavigationLike(navigation) ? navigation : null;
+  return "navigation" in window && isNavigationLike(window.navigation) ? window.navigation : null;
 }
-function shouldInterceptNavigationForAgentPreview() {
-  if (typeof window === "undefined") {
-    return false;
+const LIVE_SHARED_PREVIEW_STORAGE_KEY = "__reploLiveSharedPreview";
+function syncStoredLiveSharedPreview(isMarked) {
+  try {
+    if (isMarked) {
+      window.sessionStorage.setItem(LIVE_SHARED_PREVIEW_STORAGE_KEY, "1");
+      return true;
+    }
+    return window.sessionStorage.getItem(LIVE_SHARED_PREVIEW_STORAGE_KEY) === "1";
+  } catch {
+    return isMarked;
   }
-  if (window.parent === window) {
-    return false;
+}
+function getAgentPreviewMode() {
+  if (typeof window === "undefined" || window.parent === window) {
+    return null;
   }
-  return new URLSearchParams(window.location.search).get("__reploAgentPreview") === "1";
+  const marker = new URLSearchParams(window.location.search).get(
+    "__reploAgentPreview"
+  );
+  if (marker === "1") {
+    return "editor";
+  }
+  return syncStoredLiveSharedPreview(marker === "live-shared-preview") ? "live-shared-preview" : null;
 }
 function resolveUrl(rawUrl) {
   try {
@@ -40,15 +60,81 @@ function urlLeavesSandbox(rawUrl) {
   const resolved = resolveUrl(rawUrl);
   return resolved === null ? null : resolved.origin !== window.location.origin;
 }
+function isOutboundCheckout(rawUrl) {
+  const resolved = resolveUrl(rawUrl);
+  return resolved !== null && resolved.origin !== window.location.origin && (resolved.hostname === "checkout.stripe.com" || /\/cart\/(?:c\/|\d+:\d+)|\/checkouts\//u.test(resolved.pathname));
+}
+let parentRemote = null;
+function getParentRemote() {
+  parentRemote ??= createIframeRpcRemote(
+    createIframeRpcChannel({
+      subscriberWindow: window,
+      channelIdentifier: EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID,
+      version: EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION,
+      getTargetWindow: () => window.parent,
+      targetOrigin: "*",
+      isExpectedMessage: (event) => event.source === window.parent,
+      outgoingMethods: sandboxToParentExternalNavigationMethodConfig,
+      incomingMethods: parentToSandboxExternalNavigationMethodConfig,
+      handlers: {}
+    })
+  );
+  return parentRemote;
+}
+function openInParent(rawUrl) {
+  const resolved = resolveUrl(rawUrl);
+  if (resolved?.protocol !== "http:" && resolved?.protocol !== "https:") {
+    return;
+  }
+  getParentRemote().openExternal({ url: resolved.toString() });
+}
+function addSharedPreviewCheckoutListeners(navigation) {
+  const handleNavigate = (event) => {
+    const destinationUrl = event.destination?.url;
+    if (!destinationUrl || !isOutboundCheckout(destinationUrl)) {
+      return;
+    }
+    event.preventDefault?.();
+    openInParent(destinationUrl);
+  };
+  const handleClick = (event) => {
+    const link = event.target instanceof Element ? event.target.closest("a[href]") : null;
+    const href = link instanceof HTMLAnchorElement ? link.getAttribute("href") : null;
+    if (!href || !isOutboundCheckout(href)) {
+      return;
+    }
+    blockNavigation(event);
+    openInParent(href);
+  };
+  navigation?.addEventListener("navigate", handleNavigate);
+  document.addEventListener("click", handleClick, true);
+  return () => {
+    navigation?.removeEventListener("navigate", handleNavigate);
+    document.removeEventListener("click", handleClick, true);
+  };
+}
 function LinkInterceptor() {
   useEffect(() => {
-    if (!shouldInterceptNavigationForAgentPreview()) {
+    const mode = getAgentPreviewMode();
+    if (mode === null) {
       return;
     }
+    const host = window;
+    const navigation = getWindowNavigation();
+    host.__reploExternalNavigationHandler = (url) => {
+      openInParent(url);
+      return true;
+    };
+    if (mode === "live-shared-preview") {
+      const removeListeners = addSharedPreviewCheckoutListeners(navigation);
+      return () => {
+        delete host.__reploExternalNavigationHandler;
+        removeListeners();
+      };
+    }
     const originalWindowOpen = window.open;
     const originalPushState = history.pushState;
     const originalReplaceState = history.replaceState;
-    const navigation = getWindowNavigation();
     const reportNavigated = (rawUrl) => {
       window.parent.postMessage(
         {
@@ -58,23 +144,6 @@ function LinkInterceptor() {
         "*"
       );
     };
-    const openInParent = (rawUrl) => {
-      const resolved = resolveUrl(rawUrl);
-      if (!resolved) {
-        return;
-      }
-      window.parent.postMessage(
-        {
-          type: "replo:open-external",
-          url: resolved.toString()
-        },
-        "*"
-      );
-    };
-    Reflect.set(window, EXTERNAL_NAVIGATION_HANDLER_KEY, (url) => {
-      openInParent(url);
-      return true;
-    });
     window.open = function(url, target, features) {
       if (url !== void 0 && url !== "" && urlLeavesSandbox(url) === true) {
         openInParent(url);
@@ -156,7 +225,7 @@ function LinkInterceptor() {
     navigation?.addEventListener("navigate", handleNavigate);
     document.addEventListener("click", handleClick, true);
     return () => {
-      Reflect.deleteProperty(window, EXTERNAL_NAVIGATION_HANDLER_KEY);
+      delete host.__reploExternalNavigationHandler;
       window.open = originalWindowOpen;
       history.pushState = originalPushState;
       history.replaceState = originalReplaceState;

package/_vendor/replo-utils/lib/misc.mjs

@@ -1,4 +1,4 @@
 export { coerceNumberToString, deepCloneAndMergeReplacingArrays, errorMessage, exhaustiveSwitch, formatFileSize, getFromRecordOrNull, hasOwnProperty, invariant, isEmpty, isFunction_default as isFunction, isNotNullish, isNullish, isPrimitive, isString_default as isString, mergeReplacingArrays, mergeReplacingObjects, noop, preventDefault, sleep, sleepWithSignal, warning } from '../../../chunk-THOBCJJA.mjs';
-export { isNumber_default as isNumber } from '../../../chunk-SKVPFN7M.mjs';
 import '../../../chunk-4ITJNSXZ.mjs';
+export { isNumber_default as isNumber } from '../../../chunk-SKVPFN7M.mjs';
 import '../../../chunk-XYS6G2ZC.mjs';

package/_vendor/schemas/externalNavigationIframeRpc.d.ts

@@ -0,0 +1,17 @@
+import * as z from "zod";
+export declare const EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID: "replo:external-navigation-iframe-rpc";
+export declare const EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION: 1;
+export declare const sandboxToParentExternalNavigationMethodConfig: {
+    openExternal: {
+        inputSchema: z.ZodObject<{
+            url: z.ZodURL;
+        }, z.core.$strip>;
+        outputSchema: z.ZodVoid;
+    };
+};
+export declare const parentToSandboxExternalNavigationMethodConfig: {};
+/** Opens what the frame hands up in a new tab. Null `frameOrigin` accepts any origin. */
+export declare function createExternalNavigationParentChannel({ getFrameWindow, frameOrigin, }: {
+    getFrameWindow: () => Window | null;
+    frameOrigin: string | null;
+}): import("./iframeRpcChannel").IframeRpcChannel<{}>;

package/_vendor/schemas/externalNavigationIframeRpc.mjs

@@ -0,0 +1,41 @@
+import { createIframeRpcChannel } from '../../chunk-36IPO47A.mjs';
+import '../../chunk-ZTT7SNYN.mjs';
+import '../../chunk-THOBCJJA.mjs';
+import '../../chunk-4ITJNSXZ.mjs';
+import '../../chunk-SKVPFN7M.mjs';
+import '../../chunk-XYS6G2ZC.mjs';
+import * as z from 'zod';
+
+var EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID = "replo:external-navigation-iframe-rpc";
+var EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION = 1;
+var sandboxToParentExternalNavigationMethodConfig = {
+  openExternal: {
+    inputSchema: z.object({ url: z.url({ protocol: /^https?$/ }) }),
+    outputSchema: z.void()
+  }
+};
+var parentToSandboxExternalNavigationMethodConfig = {};
+function createExternalNavigationParentChannel({
+  getFrameWindow,
+  frameOrigin
+}) {
+  return createIframeRpcChannel({
+    subscriberWindow: window,
+    channelIdentifier: EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID,
+    version: EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION,
+    getTargetWindow: getFrameWindow,
+    targetOrigin: "*",
+    isExpectedMessage: (event) => {
+      return event.source === getFrameWindow() && (frameOrigin === null || event.origin === frameOrigin);
+    },
+    outgoingMethods: parentToSandboxExternalNavigationMethodConfig,
+    incomingMethods: sandboxToParentExternalNavigationMethodConfig,
+    handlers: {
+      openExternal: ({ url: url2 }) => {
+        window.open(url2, "_blank", "noopener,noreferrer");
+      }
+    }
+  });
+}
+
+export { EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID, EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION, createExternalNavigationParentChannel, parentToSandboxExternalNavigationMethodConfig, sandboxToParentExternalNavigationMethodConfig };

package/_vendor/schemas/iframeRpcChannel.mjs

@@ -1,6 +1,6 @@
 export { createIframeRpcChannel, createIframeRpcRemote, iframeRpcCallSchema } from '../../chunk-36IPO47A.mjs';
 import '../../chunk-ZTT7SNYN.mjs';
 import '../../chunk-THOBCJJA.mjs';
-import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
+import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-XYS6G2ZC.mjs';

package/_vendor/schemas/previewHealthIframeRpc.mjs

@@ -1,8 +1,8 @@
 import { createIframeRpcChannel } from '../../chunk-36IPO47A.mjs';
 import '../../chunk-ZTT7SNYN.mjs';
 import '../../chunk-THOBCJJA.mjs';
-import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
+import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-XYS6G2ZC.mjs';
 import * as z from 'zod';
 

package/_vendor/schemas/selectMode.mjs

@@ -1,5 +1,5 @@
 export { SELECT_MODE_SELECTABLE_ATTRIBUTE, SELECT_MODE_SELECTABLE_PAYLOAD_ATTRIBUTE, displayModeSchema, getIframeOffset, isSelectedSection, readSelectablePayload, selectModeBoundingRectSchema, selectModeClickPositionSchema, selectModeDefinedStyleSchema, selectModeFiberChainEntrySchema, selectModeFormatCommandSchema, selectModeHoverRectSchema, selectModeImageSchema, selectModeImageScopeSchema, selectModeImageSourceSchema, selectModeInlineTextStatusSchema, selectModeOptimisticUpdatePayloadSchema, selectModeSelectionRectSchema, selectModeSelectionSchema, selectModeSelectionTypeSchema, selectModeSourceLocationSchema, selectModeStyleAtRuleSchema, selectModeStyleVariantSchema, selectModeTextMetricsSchema, selectModeTiptapActiveMarksSchema, selectModeVideoSchema, selectableDataPayloadSchema, selectableDataSchema, selectablePlanDataSchema, selectablePlanPayloadSchema, selectedElementSchema, transformPoint, transformRect, transformSelectableData, transformSelectedElement } from '../../chunk-QTGDSYSU.mjs';
 import '../../chunk-THOBCJJA.mjs';
-import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
+import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-XYS6G2ZC.mjs';

package/_vendor/schemas/selectModeIframeRpc.mjs

@@ -1,7 +1,7 @@
 import { selectModeBoundingRectSchema, selectModeTiptapActiveMarksSchema, selectModeSelectionRectSchema, selectableDataSchema, selectModeHoverRectSchema, selectModeFormatCommandSchema, selectModeOptimisticUpdatePayloadSchema, selectModeSelectionTypeSchema, displayModeSchema, selectModeClickPositionSchema, selectedElementSchema } from '../../chunk-QTGDSYSU.mjs';
 import '../../chunk-THOBCJJA.mjs';
-import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
+import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-XYS6G2ZC.mjs';
 import * as z from 'zod';
 

package/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sandbox-runtime",
-  "version": "1.19.1",
+  "version": "1.19.3",
   "branch": "HEAD",
-  "commit": "0ccd8b79a0c0654b1b2e215b83c1efed676128fe",
-  "builtAt": "2026-10-24T00:25:38.939Z"
+  "commit": "1b05582b9331219dbbcb56ff30f0876086df7e32",
+  "builtAt": "2026-10-24T18:33:20.377Z"
 };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sandbox-runtime",
-  "version": "1.19.1",
+  "version": "1.19.3",
   "reploBuild": {
     "packageName": "@replohq/sandbox-runtime",
-    "version": "1.19.1",
+    "version": "1.19.3",
     "branch": "HEAD",
-    "commit": "0ccd8b79a0c0654b1b2e215b83c1efed676128fe",
-    "builtAt": "2026-10-24T00:25:38.939Z"
+    "commit": "1b05582b9331219dbbcb56ff30f0876086df7e32",
+    "builtAt": "2026-10-24T18:33:20.377Z"
   },
   "description": "Replo sandbox runtime — editor integration for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",

package/previewHealth.d.ts

@@ -19,6 +19,13 @@ declare global {
         __reploPreviewHealthMonitor?: PreviewHealthMonitor;
     }
 }
+/**
+ * Next's error dialog locks the body's scroll while it's open, and the
+ * stylesheet above hides that dialog, so the page would stop scrolling for no
+ * visible reason. Only a lock taken while the dialog is mounted is released;
+ * a site's own lock (a mobile menu, a modal) is left alone.
+ */
+export declare function releaseNextOverlayScrollLock(): () => void;
 /** The document's preview health actions; null outside an embedded preview. */
 export declare function getPreviewHealthActions(): PreviewHealthActions | null;
 export declare function resetPreviewHealthMonitorForTests(): void;

package/previewHealth.js

@@ -294,6 +294,7 @@ function createPreviewHealthMonitor() {
   overlayStyle.dataset.reploPreviewHealth = "";
   overlayStyle.textContent = "nextjs-portal{display:none!important}";
   document.head.append(overlayStyle);
+  const stopScrollLockRelease = releaseNextOverlayScrollLock();
   const stopBuildStatus = subscribeToBuildStatus({
     onBuildErrors: actions.buildErrorsChanged
   });
@@ -303,6 +304,7 @@ function createPreviewHealthMonitor() {
       unsubscribe();
       stopBuildStatus();
       overlayStyle.remove();
+      stopScrollLockRelease();
       cancelPendingRecovery();
       if (window.__reploNextErrorFeed?.listener === handleNextError) {
         window.__reploNextErrorFeed.listener = null;
@@ -310,6 +312,34 @@ function createPreviewHealthMonitor() {
     }
   };
 }
+function releaseNextOverlayScrollLock() {
+  const release = () => {
+    const portal = document.querySelector("nextjs-portal");
+    const isDialogOpen = Boolean(
+      portal?.shadowRoot?.querySelector("[data-nextjs-dialog-overlay]")
+    );
+    if (isDialogOpen && document.body.style.overflow === "hidden") {
+      document.body.style.overflow = "";
+    }
+  };
+  const observer = new MutationObserver(release);
+  const observe = () => {
+    observer.observe(document.body, {
+      attributes: true,
+      attributeFilter: ["style"]
+    });
+    release();
+  };
+  if (document.body) {
+    observe();
+  } else {
+    document.addEventListener("DOMContentLoaded", observe, { once: true });
+  }
+  return () => {
+    observer.disconnect();
+    document.removeEventListener("DOMContentLoaded", observe);
+  };
+}
 function openSocket(url) {
   return new Promise((resolve) => {
     const socket = new window.WebSocket(url);
@@ -427,5 +457,6 @@ if (typeof window !== "undefined" && process.env.NODE_ENV !== "production") {
 }
 export {
   getPreviewHealthActions,
+  releaseNextOverlayScrollLock,
   resetPreviewHealthMonitorForTests
 };