@replohq/sandbox-runtime 1.24.3 → 1.24.5

package/PagePreviewHeightResponder.js

@@ -21,6 +21,20 @@ function startResponder() {
     if (!parentOrigin) {
       return;
     }
+    awaitingMeasurement = false;
+    if (!reportedHeight) {
+      const pendingImages = Array.from(document.images).filter(
+        (image) => !image.complete
+      );
+      for (const image of pendingImages) {
+        if (image.loading === "lazy") {
+          image.loading = "eager";
+        }
+      }
+      if (pendingImages.length) {
+        return;
+      }
+    }
     const body = document.body;
     pinPreviewViewportUnits({
       width: window.innerWidth,
@@ -37,7 +51,6 @@ function startResponder() {
       )
     );
     baselineRootHeight = getComputedStyle(document.documentElement).height;
-    awaitingMeasurement = false;
     if (height > 0) {
       reportedHeight = height;
       window.parent.postMessage(
@@ -91,6 +104,10 @@ function startResponder() {
     if (!parentOrigin || awaitingMeasurement) {
       return;
     }
+    if (!reportedHeight) {
+      schedule();
+      return;
+    }
     cancelAnimationFrame(scheduledFrame);
     scheduledFrame = requestAnimationFrame(() => {
       scheduledFrame = 0;
@@ -135,6 +152,7 @@ function startResponder() {
     document.addEventListener(event, measureInteraction, true);
   }
   document.addEventListener("load", schedule, true);
+  document.addEventListener("error", schedule, true);
   document.addEventListener("toggle", schedule, true);
   return () => {
     cancelAnimationFrame(scheduledFrame);
@@ -145,6 +163,7 @@ function startResponder() {
     mutations.disconnect();
     window.removeEventListener("message", receive);
     document.removeEventListener("load", schedule, true);
+    document.removeEventListener("error", schedule, true);
     document.removeEventListener("toggle", schedule, true);
     for (const event of events) {
       document.removeEventListener(event, measureInteraction, true);

package/_vendor/replo-utils/lib/crypto.d.ts

@@ -22,4 +22,9 @@ export declare function getHmacSha256Hex({ rawBody, signingKey, }: {
     rawBody: string;
     signingKey: string;
 }): Promise<string>;
+export declare function isValidHmacSha256Hex({ rawBody, signingKey, signature, }: {
+    rawBody: string;
+    signingKey: string;
+    signature: string;
+}): Promise<boolean>;
 export declare function deterministicUUID(value: string): string;

package/_vendor/replo-utils/lib/crypto.mjs

@@ -1 +1 @@
-export { base64UrlToBytes, bytesToBase64Url, constantTimeEqual, deterministicUUID, getHmacSha256Hex, randomBase64Url, randomUUID, sha256Hex } from '../../../chunk-ZTT7SNYN.mjs';
+export { base64UrlToBytes, bytesToBase64Url, constantTimeEqual, deterministicUUID, getHmacSha256Hex, isValidHmacSha256Hex, randomBase64Url, randomUUID, sha256Hex } from '../../../chunk-WMAKU6GT.mjs';

package/_vendor/replo-utils/lib/json.d.ts

@@ -1,6 +1,2 @@
 export declare function parseJsonOrNull(json: string): unknown | null;
-export declare function omitJsonObjectFieldsOrNull({ json, fields, }: {
-    json: string;
-    fields: string[];
-}): string | null;
 export declare function jsonStringifyOrNull(value: unknown): string | null;

package/_vendor/replo-utils/lib/math.mjs

@@ -1,4 +1,4 @@
-import { randomUUID } from '../../../chunk-ZTT7SNYN.mjs';
+import { randomUUID } from '../../../chunk-WMAKU6GT.mjs';
 import { isNumber_default } from '../../../chunk-SKVPFN7M.mjs';
 import '../../../chunk-XYS6G2ZC.mjs';
 

package/_vendor/replo-utils/lib/misc.mjs

@@ -1,4 +1,4 @@
-export { coerceNumberToString, deepCloneAndMergeReplacingArrays, errorMessage, exhaustiveSwitch, formatFileSize, getFromRecordOrNull, hasOwnProperty, invariant, isEmpty, isFunction_default as isFunction, isNotNullish, isNullish, isPrimitive, isString_default as isString, mergeReplacingArrays, mergeReplacingObjects, noop, preventDefault, sleep, sleepWithSignal, warning } from '../../../chunk-THOBCJJA.mjs';
+export { coerceNumberToString, deepCloneAndMergeReplacingArrays, errorMessage, exhaustiveSwitch, formatFileSize, getFromRecordOrNull, hasOwnProperty, invariant, isEmpty, isFunction_default as isFunction, isNotNullish, isNullish, isPrimitive, isString_default as isString, mergeReplacingArrays, mergeReplacingObjects, noop, preventDefault, sleep, sleepWithSignal, warning } from '../../../chunk-HB4GV2QH.mjs';
 export { isNumber_default as isNumber } from '../../../chunk-SKVPFN7M.mjs';
 import '../../../chunk-4ITJNSXZ.mjs';
 import '../../../chunk-XYS6G2ZC.mjs';

package/_vendor/replo-utils/lib/pageCapture.mjs

@@ -1,4 +1,4 @@
-import { randomUUID } from '../../../chunk-ZTT7SNYN.mjs';
+import { randomUUID } from '../../../chunk-WMAKU6GT.mjs';
 
 var PAGE_CAPTURE_REQUEST = "replo:page-capture:request";
 var PAGE_CAPTURE_RESPONSE = "replo:page-capture:response";

package/_vendor/schemas/commentsOverlayRpc.d.ts

@@ -168,6 +168,10 @@ export declare const hostToCommentsOverlayMethodConfig: {
         }, z.core.$strict>;
         outputSchema: z.ZodVoid;
     };
+    clearThreadFocus: {
+        inputSchema: z.ZodUndefined;
+        outputSchema: z.ZodVoid;
+    };
     clearDraft: {
         inputSchema: z.ZodUndefined;
         outputSchema: z.ZodVoid;

package/_vendor/schemas/commentsOverlayRpc.mjs

@@ -1,5 +1,5 @@
-import { commentAnchorSchema, displayModeSchema, commentAnchorElementSchema } from '../../chunk-CGRTGQO5.mjs';
-import '../../chunk-THOBCJJA.mjs';
+import { commentAnchorSchema, displayModeSchema, commentAnchorElementSchema } from '../../chunk-YNBU56LF.mjs';
+import '../../chunk-HB4GV2QH.mjs';
 import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
 import '../../chunk-XYS6G2ZC.mjs';
@@ -40,6 +40,10 @@ var hostToCommentsOverlayMethodConfig = {
     inputSchema: z.strictObject({ threadId: z.string() }),
     outputSchema: z.void()
   },
+  clearThreadFocus: {
+    inputSchema: z.undefined(),
+    outputSchema: z.void()
+  },
   clearDraft: {
     inputSchema: z.undefined(),
     outputSchema: z.void()

package/_vendor/schemas/externalNavigationIframeRpc.mjs

@@ -1,6 +1,6 @@
-import { createIframeRpcChannel } from '../../chunk-6WREP7C2.mjs';
-import '../../chunk-ZTT7SNYN.mjs';
-import '../../chunk-THOBCJJA.mjs';
+import { createIframeRpcChannel } from '../../chunk-WLPBO36O.mjs';
+import '../../chunk-WMAKU6GT.mjs';
+import '../../chunk-HB4GV2QH.mjs';
 import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
 import '../../chunk-XYS6G2ZC.mjs';

package/_vendor/schemas/iframeRpcChannel.mjs

@@ -1,6 +1,6 @@
-export { createIframeRpcChannel, createIframeRpcRemote, iframeRpcCallSchema } from '../../chunk-6WREP7C2.mjs';
-import '../../chunk-ZTT7SNYN.mjs';
-import '../../chunk-THOBCJJA.mjs';
+export { createIframeRpcChannel, createIframeRpcRemote, iframeRpcCallSchema } from '../../chunk-WLPBO36O.mjs';
+import '../../chunk-WMAKU6GT.mjs';
+import '../../chunk-HB4GV2QH.mjs';
 import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
 import '../../chunk-XYS6G2ZC.mjs';

package/_vendor/schemas/previewHealthIframeRpc.mjs

@@ -1,6 +1,6 @@
-import { createIframeRpcChannel } from '../../chunk-6WREP7C2.mjs';
-import '../../chunk-ZTT7SNYN.mjs';
-import '../../chunk-THOBCJJA.mjs';
+import { createIframeRpcChannel } from '../../chunk-WLPBO36O.mjs';
+import '../../chunk-WMAKU6GT.mjs';
+import '../../chunk-HB4GV2QH.mjs';
 import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
 import '../../chunk-XYS6G2ZC.mjs';

package/_vendor/schemas/selectMode.mjs

@@ -1,5 +1,5 @@
-export { SELECT_MODE_SELECTABLE_ATTRIBUTE, SELECT_MODE_SELECTABLE_PAYLOAD_ATTRIBUTE, displayModeSchema, getIframeOffset, isSelectedSection, readSelectablePayload, selectModeBoundingRectSchema, selectModeClickPositionSchema, selectModeDefinedStyleSchema, selectModeFiberChainEntrySchema, selectModeFormatCommandSchema, selectModeHoverRectSchema, selectModeImageSchema, selectModeImageScopeSchema, selectModeImageSourceSchema, selectModeInlineTextStatusSchema, selectModeOptimisticUpdatePayloadSchema, selectModeSelectionRectSchema, selectModeSelectionSchema, selectModeSelectionTypeSchema, selectModeSourceLocationSchema, selectModeStyleAtRuleSchema, selectModeStyleVariantSchema, selectModeTextMetricsSchema, selectModeTiptapActiveMarksSchema, selectModeVideoSchema, selectableDataPayloadSchema, selectableDataSchema, selectablePlanDataSchema, selectablePlanPayloadSchema, selectedElementSchema, transformPoint, transformRect, transformSelectableData, transformSelectedElement } from '../../chunk-CGRTGQO5.mjs';
-import '../../chunk-THOBCJJA.mjs';
+export { SELECT_MODE_SELECTABLE_ATTRIBUTE, SELECT_MODE_SELECTABLE_PAYLOAD_ATTRIBUTE, displayModeSchema, getIframeOffset, isSelectedSection, readSelectablePayload, selectModeBoundingRectSchema, selectModeClickPositionSchema, selectModeDefinedStyleSchema, selectModeFiberChainEntrySchema, selectModeFormatCommandSchema, selectModeHoverRectSchema, selectModeImageSchema, selectModeImageScopeSchema, selectModeImageSourceSchema, selectModeInlineTextStatusSchema, selectModeOptimisticUpdatePayloadSchema, selectModeSelectionRectSchema, selectModeSelectionSchema, selectModeSelectionTypeSchema, selectModeSourceLocationSchema, selectModeStyleAtRuleSchema, selectModeStyleVariantSchema, selectModeTextMetricsSchema, selectModeTiptapActiveMarksSchema, selectModeVideoSchema, selectableDataPayloadSchema, selectableDataSchema, selectablePlanDataSchema, selectablePlanPayloadSchema, selectedElementSchema, transformPoint, transformRect, transformSelectableData, transformSelectedElement } from '../../chunk-YNBU56LF.mjs';
+import '../../chunk-HB4GV2QH.mjs';
 import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
 import '../../chunk-XYS6G2ZC.mjs';

package/_vendor/schemas/selectModeIframeRpc.mjs

@@ -1,5 +1,5 @@
-import { selectModeBoundingRectSchema, selectModeTiptapActiveMarksSchema, selectModeSelectionRectSchema, selectableDataSchema, selectModeHoverRectSchema, selectModeFormatCommandSchema, selectModeOptimisticUpdatePayloadSchema, selectModeSelectionTypeSchema, displayModeSchema, selectModeClickPositionSchema, selectedElementSchema } from '../../chunk-CGRTGQO5.mjs';
-import '../../chunk-THOBCJJA.mjs';
+import { selectModeBoundingRectSchema, selectModeTiptapActiveMarksSchema, selectModeSelectionRectSchema, selectableDataSchema, selectModeHoverRectSchema, selectModeFormatCommandSchema, selectModeOptimisticUpdatePayloadSchema, selectModeSelectionTypeSchema, displayModeSchema, selectModeClickPositionSchema, selectedElementSchema } from '../../chunk-YNBU56LF.mjs';
+import '../../chunk-HB4GV2QH.mjs';
 import '../../chunk-SKVPFN7M.mjs';
 import '../../chunk-4ITJNSXZ.mjs';
 import '../../chunk-XYS6G2ZC.mjs';

package/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sandbox-runtime",
-  "version": "1.24.3",
+  "version": "1.24.5",
   "branch": "HEAD",
-  "commit": "e1eeef82df82036e9d623fccf943736d34fb994d",
-  "builtAt": "2026-11-04T19:25:11.953Z"
+  "commit": "547c2f890567e78210f5359114f849b43d7611da",
+  "builtAt": "2026-11-07T18:09:33.143Z"
 };

package/{chunk-6WREP7C2.mjs → chunk-WLPBO36O.mjs}

@@ -1,5 +1,5 @@
-import { randomUUID } from './chunk-ZTT7SNYN.mjs';
-import { isNullish } from './chunk-THOBCJJA.mjs';
+import { randomUUID } from './chunk-WMAKU6GT.mjs';
+import { isNullish } from './chunk-HB4GV2QH.mjs';
 import * as z from 'zod';
 
 var defaultLogger = {

package/{chunk-ZTT7SNYN.mjs → chunk-WMAKU6GT.mjs}

@@ -63,8 +63,19 @@ async function getHmacSha256Hex({
   );
   return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
+async function isValidHmacSha256Hex({
+  rawBody,
+  signingKey,
+  signature
+}) {
+  const encoder = new TextEncoder();
+  return constantTimeEqual({
+    left: encoder.encode(await getHmacSha256Hex({ rawBody, signingKey })),
+    right: encoder.encode(signature)
+  });
+}
 function deterministicUUID(value) {
   return v5(value, v5.URL);
 }
 
-export { base64UrlToBytes, bytesToBase64Url, constantTimeEqual, deterministicUUID, getHmacSha256Hex, randomBase64Url, randomUUID, sha256Hex };
+export { base64UrlToBytes, bytesToBase64Url, constantTimeEqual, deterministicUUID, getHmacSha256Hex, isValidHmacSha256Hex, randomBase64Url, randomUUID, sha256Hex };

package/{chunk-CGRTGQO5.mjs → chunk-YNBU56LF.mjs}

@@ -1,4 +1,4 @@
-import { exhaustiveSwitch } from './chunk-THOBCJJA.mjs';
+import { exhaustiveSwitch } from './chunk-HB4GV2QH.mjs';
 import * as z from 'zod';
 
 function parseJsonOrNull(json) {

package/comments-overlay/bridge.js

@@ -64,6 +64,9 @@ function startCommentsOverlay({
       focusThread: ({ threadId }) => {
         getOverlay().focusThread(threadId);
       },
+      clearThreadFocus: () => {
+        overlay?.clearThreadFocus();
+      },
       clearDraft: () => {
         overlay?.clearDraft();
       },

package/comments-overlay/capture.d.ts

@@ -32,7 +32,10 @@ export declare function getElementSource(element: Element): ElementSource | null
  * none. Inside a shadow root it includes nested shadow roots' text.
  */
 export declare function getTextPreview(element: Element): string;
-/** The element an anchor for this click target or selection describes. */
+/**
+ * The element an anchor for this click target or selection describes; null
+ * when a click lands in layout spacing or a selection isn't in an element.
+ */
 export declare function getAnchorElement(target: Element | Range): Element | null;
 /**
  * Builds an element anchor (D-13) for a clicked element or a text selection.

package/comments-overlay/capture.js

@@ -168,8 +168,14 @@ function createRootAnchorSelectors(element) {
     selector: ownSemanticSelector ?? findUniqueSelector(element) ?? createNthChildSelector(element)
   };
 }
+const LAYOUT_SELECTOR = "[data-comment-layout]";
 function getAnchorElement(target) {
-  const picked = isElement(target) ? target : rangeContainer(target);
+  if (isElement(target)) {
+    const element = snapToAnchorElement(target);
+    const isLayout = element.matches(LAYOUT_SELECTOR) || element.querySelector(LAYOUT_SELECTOR) !== null;
+    return isLayout ? null : element;
+  }
+  const picked = rangeContainer(target);
   return picked ? snapToAnchorElement(picked) : null;
 }
 function captureAnchor(target, point) {

package/comments-overlay/overlay.d.ts

@@ -37,6 +37,7 @@ export type CommentsOverlay = {
     setMode: (mode: DisplayMode) => void;
     setPins: (pins: CommentOverlayPin[]) => void;
     focusThread: (threadId: string) => void;
+    clearThreadFocus: () => void;
     clearDraft: () => void;
     setDraftAnchor: (anchor: CommentAnchor | null) => void;
     /** Re-resolves every anchor now, e.g. after symbolication results arrive. */

package/comments-overlay/overlay.js

@@ -12,6 +12,7 @@ const COMPACT_GUTTER_MAX_WIDTH_PX = 600;
 const RERESOLVE_DEBOUNCE_MS = 250;
 const SELECTION_PROMPT_DEBOUNCE_MS = 150;
 const TEXT_PICK_CLICK_SUPPRESS_MS = 750;
+const PENDING_SCROLL_MS = 1e4;
 const HOVER_OUTLINE_STYLE = `position:absolute;pointer-events:none;box-sizing:border-box;border:${HIGHLIGHT_OUTLINE};background:transparent;border-radius:4px`;
 const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
 const EDITABLE_SELECTOR = "input, textarea, select, [contenteditable]:not([contenteditable='false'])";
@@ -34,6 +35,7 @@ function createCommentsOverlay(options) {
   const boundElements = /* @__PURE__ */ new Map();
   let selection = null;
   let hoveredBadgeThreadId = null;
+  let pendingScroll = null;
   let statusesKey = "";
   let hoveredElement = null;
   let hoverOutline = null;
@@ -105,6 +107,19 @@ function createCommentsOverlay(options) {
       return pin.anchor.type === "element" ? [{ pin, anchor: pin.anchor }] : [];
     });
   };
+  const scrollToThread = (threadId) => {
+    const resolution = resolutions.get(threadId);
+    if (!resolution || !isResolutionVisible(resolution)) {
+      return false;
+    }
+    const target = resolution.range?.startContainer.parentElement ?? resolution.element;
+    const reduceMotion = window.matchMedia?.("(prefers-reduced-motion: reduce)")?.matches ?? false;
+    target?.scrollIntoView?.({
+      block: "center",
+      behavior: reduceMotion ? "auto" : "smooth"
+    });
+    return true;
+  };
   const resolveAll = () => {
     resolveTimer = null;
     observeShadowRoots(document);
@@ -130,6 +145,12 @@ function createCommentsOverlay(options) {
       }
     }
     resolutions = next;
+    if (pendingScroll) {
+      const isStale = selection?.kind !== "thread" || selection.threadId !== pendingScroll.threadId || Date.now() > pendingScroll.until;
+      if (isStale || scrollToThread(pendingScroll.threadId)) {
+        pendingScroll = null;
+      }
+    }
     if (selection?.kind === "draft") {
       selection.resolution = resolveAnchor(selection.anchor, document, {
         previous: selection.resolution?.element ?? null,
@@ -589,7 +610,7 @@ function createCommentsOverlay(options) {
     if (window.getSelection()?.toString().trim()) {
       return;
     }
-    if (!isPageElement(target)) {
+    if (!isPageElement(target) || !getAnchorElement(target)) {
       dismissSelection();
       return;
     }
@@ -741,17 +762,15 @@ function createCommentsOverlay(options) {
     },
     focusThread: (threadId) => {
       selection = { kind: "thread", threadId };
-      const resolution = resolutions.get(threadId);
-      const target = resolution?.range?.startContainer.parentElement ?? resolution?.element ?? null;
-      if (resolution && isResolutionVisible(resolution)) {
-        const reduceMotion = window.matchMedia?.("(prefers-reduced-motion: reduce)")?.matches ?? false;
-        target?.scrollIntoView?.({
-          block: "center",
-          behavior: reduceMotion ? "auto" : "smooth"
-        });
-      }
+      pendingScroll = scrollToThread(threadId) ? null : { threadId, until: Date.now() + PENDING_SCROLL_MS };
       schedulePaint();
     },
+    clearThreadFocus: () => {
+      if (selection?.kind === "thread") {
+        selection = null;
+        schedulePaint();
+      }
+    },
     clearDraft: () => {
       clearDraft();
       schedulePaint();

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sandbox-runtime",
-  "version": "1.24.3",
+  "version": "1.24.5",
   "reploBuild": {
     "packageName": "@replohq/sandbox-runtime",
-    "version": "1.24.3",
+    "version": "1.24.5",
     "branch": "HEAD",
-    "commit": "e1eeef82df82036e9d623fccf943736d34fb994d",
-    "builtAt": "2026-11-04T19:25:11.953Z"
+    "commit": "547c2f890567e78210f5359114f849b43d7611da",
+    "builtAt": "2026-11-07T18:09:33.143Z"
   },
   "description": "Replo sandbox runtime — editor integration for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",

package/_vendor/replo-utils/lib/object.d.ts

@@ -1,46 +0,0 @@
-import { dequal as dequalLite } from "dequal/lite";
-interface ForEachPrimitiveValueArgs {
-    target: Record<string, any> | unknown[] | null;
-    fn: (value: unknown, key: string, newTarget: Record<string, any>) => void;
-    valueConversionFunction?: (transformValue: Record<string, any> | unknown[]) => Record<string, any> | unknown[];
-}
-/** There's probably a bug somewhere here since it assumes target is initially an object */
-export declare function forEachPrimitiveValue({ target, fn, valueConversionFunction, }: ForEachPrimitiveValueArgs): void;
-export declare function shallowEqual(objA: unknown, objB: unknown): boolean;
-/**
- * Internally we use `dequal` for deep equality checks. It benchmarks faster
- * than lodash and most other libraries.
- *
- * This function is an alias for `dequal`'s "lite" module. It does not check
- * equality for `Map` or `Set` values. If you need to compare those, use
- * `deepEqualHeavy`.
- *
- * @see https://github.com/lukeed/dequal#modes
- */
-export declare const deepEqual: typeof dequalLite;
-/**
- * Creates a new object with specified keys omitted.
- *
- * @param obj - The source object
- * @param keysToOmit - Array of keys to omit from the result
- * @returns A new object without the specified keys
- */
-export declare function omit<ObjectType extends Record<string, any>, KeyType extends keyof ObjectType>(obj: ObjectType, keysToOmit: KeyType[]): Omit<ObjectType, KeyType>;
-/**
- * `ObjectType` with every key that can hold `undefined` made optional and
- * `undefined` removed from its value type. Keys that can't be `undefined`
- * stay required.
- */
-export type WithoutUndefined<ObjectType> = {
-    [Key in keyof ObjectType as undefined extends ObjectType[Key] ? never : Key]: ObjectType[Key];
-} & {
-    [Key in keyof ObjectType as undefined extends ObjectType[Key] ? Key : never]?: Exclude<ObjectType[Key], undefined>;
-};
-/**
- * Copies `data` without its `undefined`-valued own keys. A plain loop rather
- * than lodash `pickBy`: this ships in the published SDK, and `pickBy` drags in
- * lodash's iteratee-shorthand machinery (~6 KB gzipped) for a one-line check.
- */
-export declare function filterUndefined<ObjectType extends Record<string, unknown>>(data: ObjectType): WithoutUndefined<ObjectType>;
-export declare function toNullableIfDefined<ValueType>(value: ValueType | undefined): ValueType | null | undefined;
-export {};