@replohq/sandbox-runtime 1.19.2 → 1.19.4

package/LinkInterceptor.js

@@ -1,30 +1,50 @@
 "use client";
 import { useEffect } from "react";
+import {
+  EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID,
+  EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION,
+  parentToSandboxExternalNavigationMethodConfig,
+  sandboxToParentExternalNavigationMethodConfig
+} from "./_vendor/schemas/externalNavigationIframeRpc.mjs";
+import {
+  createIframeRpcChannel,
+  createIframeRpcRemote
+} from "./_vendor/schemas/iframeRpcChannel.mjs";
 import { displayModeStore } from "./select-mode/displayModeStore";
-const EXTERNAL_NAVIGATION_HANDLER_KEY = "__reploExternalNavigationHandler";
 function blockNavigation(event) {
   event.preventDefault();
   event.stopPropagation();
   event.stopImmediatePropagation();
 }
 function isNavigationLike(value) {
-  if (typeof value !== "object" || value === null) {
-    return false;
-  }
-  return typeof Reflect.get(value, "addEventListener") === "function" && typeof Reflect.get(value, "removeEventListener") === "function";
+  return typeof value === "object" && value !== null && "addEventListener" in value && typeof value.addEventListener === "function" && "removeEventListener" in value && typeof value.removeEventListener === "function";
 }
 function getWindowNavigation() {
-  const navigation = Reflect.get(window, "navigation");
-  return isNavigationLike(navigation) ? navigation : null;
+  return "navigation" in window && isNavigationLike(window.navigation) ? window.navigation : null;
 }
-function shouldInterceptNavigationForAgentPreview() {
-  if (typeof window === "undefined") {
-    return false;
+const LIVE_SHARED_PREVIEW_STORAGE_KEY = "__reploLiveSharedPreview";
+function syncStoredLiveSharedPreview(isMarked) {
+  try {
+    if (isMarked) {
+      window.sessionStorage.setItem(LIVE_SHARED_PREVIEW_STORAGE_KEY, "1");
+      return true;
+    }
+    return window.sessionStorage.getItem(LIVE_SHARED_PREVIEW_STORAGE_KEY) === "1";
+  } catch {
+    return isMarked;
   }
-  if (window.parent === window) {
-    return false;
+}
+function getAgentPreviewMode() {
+  if (typeof window === "undefined" || window.parent === window) {
+    return null;
   }
-  return new URLSearchParams(window.location.search).get("__reploAgentPreview") === "1";
+  const marker = new URLSearchParams(window.location.search).get(
+    "__reploAgentPreview"
+  );
+  if (marker === "1") {
+    return "editor";
+  }
+  return syncStoredLiveSharedPreview(marker === "live-shared-preview") ? "live-shared-preview" : null;
 }
 function resolveUrl(rawUrl) {
   try {
@@ -40,15 +60,81 @@ function urlLeavesSandbox(rawUrl) {
   const resolved = resolveUrl(rawUrl);
   return resolved === null ? null : resolved.origin !== window.location.origin;
 }
+function isOutboundCheckout(rawUrl) {
+  const resolved = resolveUrl(rawUrl);
+  return resolved !== null && resolved.origin !== window.location.origin && (resolved.hostname === "checkout.stripe.com" || /\/cart\/(?:c\/|\d+:\d+)|\/checkouts\//u.test(resolved.pathname));
+}
+let parentRemote = null;
+function getParentRemote() {
+  parentRemote ??= createIframeRpcRemote(
+    createIframeRpcChannel({
+      subscriberWindow: window,
+      channelIdentifier: EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID,
+      version: EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION,
+      getTargetWindow: () => window.parent,
+      targetOrigin: "*",
+      isExpectedMessage: (event) => event.source === window.parent,
+      outgoingMethods: sandboxToParentExternalNavigationMethodConfig,
+      incomingMethods: parentToSandboxExternalNavigationMethodConfig,
+      handlers: {}
+    })
+  );
+  return parentRemote;
+}
+function openInParent(rawUrl) {
+  const resolved = resolveUrl(rawUrl);
+  if (resolved?.protocol !== "http:" && resolved?.protocol !== "https:") {
+    return;
+  }
+  getParentRemote().openExternal({ url: resolved.toString() });
+}
+function addSharedPreviewCheckoutListeners(navigation) {
+  const handleNavigate = (event) => {
+    const destinationUrl = event.destination?.url;
+    if (!destinationUrl || !isOutboundCheckout(destinationUrl)) {
+      return;
+    }
+    event.preventDefault?.();
+    openInParent(destinationUrl);
+  };
+  const handleClick = (event) => {
+    const link = event.target instanceof Element ? event.target.closest("a[href]") : null;
+    const href = link instanceof HTMLAnchorElement ? link.getAttribute("href") : null;
+    if (!href || !isOutboundCheckout(href)) {
+      return;
+    }
+    blockNavigation(event);
+    openInParent(href);
+  };
+  navigation?.addEventListener("navigate", handleNavigate);
+  document.addEventListener("click", handleClick, true);
+  return () => {
+    navigation?.removeEventListener("navigate", handleNavigate);
+    document.removeEventListener("click", handleClick, true);
+  };
+}
 function LinkInterceptor() {
   useEffect(() => {
-    if (!shouldInterceptNavigationForAgentPreview()) {
+    const mode = getAgentPreviewMode();
+    if (mode === null) {
       return;
     }
+    const host = window;
+    const navigation = getWindowNavigation();
+    host.__reploExternalNavigationHandler = (url) => {
+      openInParent(url);
+      return true;
+    };
+    if (mode === "live-shared-preview") {
+      const removeListeners = addSharedPreviewCheckoutListeners(navigation);
+      return () => {
+        delete host.__reploExternalNavigationHandler;
+        removeListeners();
+      };
+    }
     const originalWindowOpen = window.open;
     const originalPushState = history.pushState;
     const originalReplaceState = history.replaceState;
-    const navigation = getWindowNavigation();
     const reportNavigated = (rawUrl) => {
       window.parent.postMessage(
         {
@@ -58,23 +144,6 @@ function LinkInterceptor() {
         "*"
       );
     };
-    const openInParent = (rawUrl) => {
-      const resolved = resolveUrl(rawUrl);
-      if (!resolved) {
-        return;
-      }
-      window.parent.postMessage(
-        {
-          type: "replo:open-external",
-          url: resolved.toString()
-        },
-        "*"
-      );
-    };
-    Reflect.set(window, EXTERNAL_NAVIGATION_HANDLER_KEY, (url) => {
-      openInParent(url);
-      return true;
-    });
     window.open = function(url, target, features) {
       if (url !== void 0 && url !== "" && urlLeavesSandbox(url) === true) {
         openInParent(url);
@@ -156,7 +225,7 @@ function LinkInterceptor() {
     navigation?.addEventListener("navigate", handleNavigate);
     document.addEventListener("click", handleClick, true);
     return () => {
-      Reflect.deleteProperty(window, EXTERNAL_NAVIGATION_HANDLER_KEY);
+      delete host.__reploExternalNavigationHandler;
       window.open = originalWindowOpen;
       history.pushState = originalPushState;
       history.replaceState = originalReplaceState;

package/_vendor/replo-utils/lib/misc.mjs

@@ -1,4 +1,4 @@
 export { coerceNumberToString, deepCloneAndMergeReplacingArrays, errorMessage, exhaustiveSwitch, formatFileSize, getFromRecordOrNull, hasOwnProperty, invariant, isEmpty, isFunction_default as isFunction, isNotNullish, isNullish, isPrimitive, isString_default as isString, mergeReplacingArrays, mergeReplacingObjects, noop, preventDefault, sleep, sleepWithSignal, warning } from '../../../chunk-THOBCJJA.mjs';
-export { isNumber_default as isNumber } from '../../../chunk-SKVPFN7M.mjs';
 import '../../../chunk-4ITJNSXZ.mjs';
+export { isNumber_default as isNumber } from '../../../chunk-SKVPFN7M.mjs';
 import '../../../chunk-XYS6G2ZC.mjs';

package/_vendor/schemas/externalNavigationIframeRpc.d.ts

@@ -0,0 +1,17 @@
+import * as z from "zod";
+export declare const EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID: "replo:external-navigation-iframe-rpc";
+export declare const EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION: 1;
+export declare const sandboxToParentExternalNavigationMethodConfig: {
+    openExternal: {
+        inputSchema: z.ZodObject<{
+            url: z.ZodURL;
+        }, z.core.$strip>;
+        outputSchema: z.ZodVoid;
+    };
+};
+export declare const parentToSandboxExternalNavigationMethodConfig: {};
+/** Opens what the frame hands up in a new tab. Null `frameOrigin` accepts any origin. */
+export declare function createExternalNavigationParentChannel({ getFrameWindow, frameOrigin, }: {
+    getFrameWindow: () => Window | null;
+    frameOrigin: string | null;
+}): import("./iframeRpcChannel").IframeRpcChannel<{}>;

package/_vendor/schemas/externalNavigationIframeRpc.mjs

@@ -0,0 +1,41 @@
+import { createIframeRpcChannel } from '../../chunk-36IPO47A.mjs';
+import '../../chunk-ZTT7SNYN.mjs';
+import '../../chunk-THOBCJJA.mjs';
+import '../../chunk-4ITJNSXZ.mjs';
+import '../../chunk-SKVPFN7M.mjs';
+import '../../chunk-XYS6G2ZC.mjs';
+import * as z from 'zod';
+
+var EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID = "replo:external-navigation-iframe-rpc";
+var EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION = 1;
+var sandboxToParentExternalNavigationMethodConfig = {
+  openExternal: {
+    inputSchema: z.object({ url: z.url({ protocol: /^https?$/ }) }),
+    outputSchema: z.void()
+  }
+};
+var parentToSandboxExternalNavigationMethodConfig = {};
+function createExternalNavigationParentChannel({
+  getFrameWindow,
+  frameOrigin
+}) {
+  return createIframeRpcChannel({
+    subscriberWindow: window,
+    channelIdentifier: EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID,
+    version: EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION,
+    getTargetWindow: getFrameWindow,
+    targetOrigin: "*",
+    isExpectedMessage: (event) => {
+      return event.source === getFrameWindow() && (frameOrigin === null || event.origin === frameOrigin);
+    },
+    outgoingMethods: parentToSandboxExternalNavigationMethodConfig,
+    incomingMethods: sandboxToParentExternalNavigationMethodConfig,
+    handlers: {
+      openExternal: ({ url: url2 }) => {
+        window.open(url2, "_blank", "noopener,noreferrer");
+      }
+    }
+  });
+}
+
+export { EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_ID, EXTERNAL_NAVIGATION_IFRAME_RPC_CHANNEL_VERSION, createExternalNavigationParentChannel, parentToSandboxExternalNavigationMethodConfig, sandboxToParentExternalNavigationMethodConfig };

package/_vendor/schemas/iframeRpcChannel.mjs

@@ -1,6 +1,6 @@
 export { createIframeRpcChannel, createIframeRpcRemote, iframeRpcCallSchema } from '../../chunk-36IPO47A.mjs';
 import '../../chunk-ZTT7SNYN.mjs';
 import '../../chunk-THOBCJJA.mjs';
-import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
+import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-XYS6G2ZC.mjs';

package/_vendor/schemas/previewHealthIframeRpc.mjs

@@ -1,8 +1,8 @@
 import { createIframeRpcChannel } from '../../chunk-36IPO47A.mjs';
 import '../../chunk-ZTT7SNYN.mjs';
 import '../../chunk-THOBCJJA.mjs';
-import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
+import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-XYS6G2ZC.mjs';
 import * as z from 'zod';
 

package/_vendor/schemas/selectMode.mjs

@@ -1,5 +1,5 @@
 export { SELECT_MODE_SELECTABLE_ATTRIBUTE, SELECT_MODE_SELECTABLE_PAYLOAD_ATTRIBUTE, displayModeSchema, getIframeOffset, isSelectedSection, readSelectablePayload, selectModeBoundingRectSchema, selectModeClickPositionSchema, selectModeDefinedStyleSchema, selectModeFiberChainEntrySchema, selectModeFormatCommandSchema, selectModeHoverRectSchema, selectModeImageSchema, selectModeImageScopeSchema, selectModeImageSourceSchema, selectModeInlineTextStatusSchema, selectModeOptimisticUpdatePayloadSchema, selectModeSelectionRectSchema, selectModeSelectionSchema, selectModeSelectionTypeSchema, selectModeSourceLocationSchema, selectModeStyleAtRuleSchema, selectModeStyleVariantSchema, selectModeTextMetricsSchema, selectModeTiptapActiveMarksSchema, selectModeVideoSchema, selectableDataPayloadSchema, selectableDataSchema, selectablePlanDataSchema, selectablePlanPayloadSchema, selectedElementSchema, transformPoint, transformRect, transformSelectableData, transformSelectedElement } from '../../chunk-QTGDSYSU.mjs';
 import '../../chunk-THOBCJJA.mjs';
-import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
+import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-XYS6G2ZC.mjs';

package/_vendor/schemas/selectModeIframeRpc.mjs

@@ -1,7 +1,7 @@
 import { selectModeBoundingRectSchema, selectModeTiptapActiveMarksSchema, selectModeSelectionRectSchema, selectableDataSchema, selectModeHoverRectSchema, selectModeFormatCommandSchema, selectModeOptimisticUpdatePayloadSchema, selectModeSelectionTypeSchema, displayModeSchema, selectModeClickPositionSchema, selectedElementSchema } from '../../chunk-QTGDSYSU.mjs';
 import '../../chunk-THOBCJJA.mjs';
-import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
+import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-XYS6G2ZC.mjs';
 import * as z from 'zod';
 

package/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sandbox-runtime",
-  "version": "1.19.2",
+  "version": "1.19.4",
   "branch": "HEAD",
-  "commit": "cdc23a21d2f115a5a458a13a97942dac138e692d",
-  "builtAt": "2026-10-24T17:26:05.661Z"
+  "commit": "3a362d942a24f8c7b0af6d26e3ccad003254d6c5",
+  "builtAt": "2026-10-25T05:11:58.524Z"
 };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sandbox-runtime",
-  "version": "1.19.2",
+  "version": "1.19.4",
   "reploBuild": {
     "packageName": "@replohq/sandbox-runtime",
-    "version": "1.19.2",
+    "version": "1.19.4",
     "branch": "HEAD",
-    "commit": "cdc23a21d2f115a5a458a13a97942dac138e692d",
-    "builtAt": "2026-10-24T17:26:05.661Z"
+    "commit": "3a362d942a24f8c7b0af6d26e3ccad003254d6c5",
+    "builtAt": "2026-10-25T05:11:58.524Z"
   },
   "description": "Replo sandbox runtime — editor integration for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",

package/select-mode/descriptor/elementDescriptor.js

@@ -116,6 +116,13 @@ function identifyElement({
     }
     return "image";
   }
+  if (element instanceof HTMLIFrameElement) {
+    if (element.hasAttribute("srcdoc")) {
+      return "iframe: inline HTML (srcdoc)";
+    }
+    const src = element.getAttribute("src");
+    return src ? `iframe: [${src.slice(0, 60)}]` : "iframe";
+  }
   if (/^h[1-6]$/.test(tagName)) {
     return trimmedText ? `heading(${tagName}): "${trimmedText.slice(0, 60)}"` : tagName;
   }

package/select-mode/interactions/embeddedFrames.d.ts

@@ -4,11 +4,7 @@ export declare const FRAME_SHIELD_CSS = "iframe { pointer-events: none !importan
  * Select mode shields iframes from the pointer so presses over an embed reach
  * this document instead of the embed's own (often cross-origin) one. The hit
  * element is then whatever sits behind the frame, so lift the shield for one
- * native hit test to find the frame the user actually pointed at. A frame
- * injected as raw HTML has no React source, so prefer its nearest
- * React-rendered ancestor, which the agent can edit. React 19 renders <body>
- * too, so stop below it: a widget script appends its frame straight to the
- * body, and selecting the frame beats selecting the whole page.
+ * native hit test to find the frame the user actually pointed at.
  */
 export declare function getSelectionTargetForEmbeddedFrameHit({ hitElement, clientX, clientY, }: {
     hitElement: Element;

package/select-mode/interactions/embeddedFrames.js

@@ -1,4 +1,3 @@
-import { getFiberFromElement } from "../fiber";
 const FRAME_SHIELD_ATTRIBUTE = "data-select-mode-frame-shield";
 const FRAME_SHIELD_CSS = "iframe { pointer-events: none !important; }";
 function getSelectionTargetForEmbeddedFrameHit({
@@ -15,15 +14,7 @@ function getSelectionTargetForEmbeddedFrameHit({
   shield.disabled = true;
   const frame = document.elementFromPoint(clientX, clientY);
   shield.disabled = false;
-  if (!(frame instanceof HTMLIFrameElement)) {
-    return hitElement;
-  }
-  for (let candidate = frame; candidate && candidate !== document.body; candidate = candidate.parentElement) {
-    if (getFiberFromElement(candidate)) {
-      return candidate;
-    }
-  }
-  return frame;
+  return frame instanceof HTMLIFrameElement ? frame : hitElement;
 }
 export {
   FRAME_SHIELD_ATTRIBUTE,