@replohq/sandbox-runtime 1.6.5 → 1.6.7

package/_vendor/schemas/errors.d.ts

@@ -261,6 +261,7 @@ export declare const errorUserFacingDetailsMessageSchema: z.ZodObject<{
     isRecoverable: z.ZodOptional<z.ZodBoolean>;
     detail: z.ZodOptional<z.ZodUnion<[z.ZodArray<z.ZodString>, z.ZodString]>>;
     key: z.ZodString;
+    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     usage: z.ZodOptional<z.ZodObject<{
         current: z.ZodNumber;
         maximum: z.ZodNumber;
@@ -327,6 +328,7 @@ export declare const errorUserFacingDetailsSchema: z.ZodDiscriminatedUnion<[z.Zo
     isRecoverable: z.ZodOptional<z.ZodBoolean>;
     detail: z.ZodOptional<z.ZodUnion<[z.ZodArray<z.ZodString>, z.ZodString]>>;
     key: z.ZodString;
+    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     usage: z.ZodOptional<z.ZodObject<{
         current: z.ZodNumber;
         maximum: z.ZodNumber;

package/_vendor/schemas/generated/errors.d.ts

@@ -4,6 +4,9 @@ export type ErrorUserFacingDetailsWithMessage = {
     isRecoverable?: boolean;
     detail?: string[] | string;
     key: string;
+    details?: {
+        [x: string]: unknown;
+    };
     usage?: {
         current: number;
         maximum: number;

package/_vendor/schemas/iframeRpcChannel.mjs

@@ -52,6 +52,11 @@ var errorUserFacingDetailsMessageSchema = z.object({
   // in FullPageModal only.
   detail: z.array(z.string()).or(z.string()).optional(),
   key: z.string(),
+  // Structured data for API callers next to the human message, e.g. the
+  // current draft version on a project-context 409 or the offending paths on
+  // a 422. The worker error handler serializes userFacingDetails as-is, so
+  // this is the one place such data can travel without a second envelope.
+  details: z.record(z.string(), z.unknown()).optional(),
   usage: z.object({
     current: z.number(),
     maximum: z.number()

package/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sandbox-runtime",
-  "version": "1.6.5",
+  "version": "1.6.7",
   "branch": "HEAD",
-  "commit": "5d112aef8f978ceb8157400597f494b241e6ac1c",
-  "builtAt": "2026-09-12T01:09:48.099Z"
+  "commit": "6f35acf4a9b5e632c79b8914aa2b66350bc80485",
+  "builtAt": "2026-09-14T19:23:28.579Z"
 };

package/chunk-RXYLMSNM.mjs

@@ -0,0 +1,134 @@
+// ../replo-utils/lib/viewportSnapshot.ts
+var VIEWPORT_SNAPSHOT_REQUEST = "replo:viewport-snapshot:request";
+var VIEWPORT_SNAPSHOT_RESPONSE = "replo:viewport-snapshot:response";
+var VIEWPORT_SNAPSHOT_MAX_DEPTH = 2;
+function isTrustedViewportSnapshotRequester(origin) {
+  let hostname;
+  try {
+    hostname = new URL(origin).hostname;
+  } catch {
+    return false;
+  }
+  if (hostname === "replo.app" || hostname.endsWith(".replo.app")) {
+    return true;
+  }
+  if (process.env.NODE_ENV === "production") {
+    return false;
+  }
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname.endsWith(".ngrok.app");
+}
+function canReceiveMessages(value) {
+  return typeof value === "object" && value !== null && "postMessage" in value && typeof value.postMessage === "function";
+}
+function isResponseMessage(data) {
+  return typeof data === "object" && data !== null && "type" in data && data.type === VIEWPORT_SNAPSHOT_RESPONSE && "requestId" in data && typeof data.requestId === "string" && "frameIndex" in data && typeof data.frameIndex === "number";
+}
+function isRequestMessage(data) {
+  return typeof data === "object" && data !== null && "type" in data && data.type === VIEWPORT_SNAPSHOT_REQUEST && "requestId" in data && typeof data.requestId === "string" && "frameIndex" in data && typeof data.frameIndex === "number" && "remainingDepth" in data && typeof data.remainingDepth === "number";
+}
+function requestChildViewportSnapshots({
+  targetWindow,
+  requestId,
+  timeoutMs,
+  remainingDepth = VIEWPORT_SNAPSHOT_MAX_DEPTH
+}) {
+  const frameCount = targetWindow.frames.length;
+  if (frameCount === 0 || remainingDepth <= 0) {
+    return Promise.resolve([]);
+  }
+  return new Promise((resolve) => {
+    const collected = /* @__PURE__ */ new Map();
+    const settle = () => {
+      targetWindow.removeEventListener("message", onMessage);
+      targetWindow.clearTimeout(timeoutId);
+      resolve(
+        [...collected.entries()].map(([frameIndex, capture]) => ({ frameIndex, capture })).sort((first, second) => {
+          return first.frameIndex - second.frameIndex;
+        })
+      );
+    };
+    const onMessage = (event) => {
+      if (!isResponseMessage(event.data) || event.data.requestId !== requestId || // A frame may only answer for its own slot — anything else could
+      // overwrite a sibling's capture or force an early settle.
+      event.source !== targetWindow.frames[event.data.frameIndex]) {
+        return;
+      }
+      if (event.data.capture !== null) {
+        collected.set(event.data.frameIndex, event.data.capture);
+      }
+      if (collected.size === frameCount) {
+        settle();
+      }
+    };
+    targetWindow.addEventListener("message", onMessage);
+    const timeoutId = targetWindow.setTimeout(settle, timeoutMs);
+    for (let frameIndex = 0; frameIndex < frameCount; frameIndex++) {
+      const message = {
+        type: VIEWPORT_SNAPSHOT_REQUEST,
+        requestId,
+        frameIndex,
+        remainingDepth
+      };
+      targetWindow.frames[frameIndex]?.postMessage(message, "*");
+    }
+  });
+}
+function startViewportSnapshotResponder({
+  targetWindow,
+  takeSnapshot,
+  measureFrameRect,
+  isTrustedRequester = isTrustedViewportSnapshotRequester,
+  cascadeTimeoutMs = 1500
+}) {
+  if (targetWindow.parent === targetWindow) {
+    return () => {
+    };
+  }
+  const onMessage = (event) => {
+    if (!isRequestMessage(event.data) || event.source !== targetWindow.parent || !canReceiveMessages(event.source) || !isTrustedRequester(event.origin ?? "")) {
+      return;
+    }
+    const { requestId, frameIndex, remainingDepth } = event.data;
+    const requester = event.source;
+    const requesterOrigin = event.origin ?? "*";
+    const respond = (capture) => {
+      const response = {
+        type: VIEWPORT_SNAPSHOT_RESPONSE,
+        requestId,
+        frameIndex,
+        capture
+      };
+      requester.postMessage(response, requesterOrigin);
+    };
+    let snapshot = null;
+    try {
+      snapshot = takeSnapshot();
+    } catch {
+    }
+    if (snapshot === null) {
+      respond(null);
+      return;
+    }
+    void requestChildViewportSnapshots({
+      targetWindow,
+      // Derived per level so a child's own fan-out can't collide with ours.
+      requestId: `${requestId}:${frameIndex}`,
+      timeoutMs: cascadeTimeoutMs,
+      remainingDepth: remainingDepth - 1
+    }).then((childCaptures) => {
+      respond({
+        snapshot,
+        childFrames: childCaptures.flatMap((child) => {
+          const rect = measureFrameRect(child.frameIndex);
+          return rect ? [{ frameIndex: child.frameIndex, rect, capture: child.capture }] : [];
+        })
+      });
+    });
+  };
+  targetWindow.addEventListener("message", onMessage);
+  return () => {
+    return targetWindow.removeEventListener("message", onMessage);
+  };
+}
+
+export { VIEWPORT_SNAPSHOT_MAX_DEPTH, VIEWPORT_SNAPSHOT_REQUEST, VIEWPORT_SNAPSHOT_RESPONSE, isTrustedViewportSnapshotRequester, requestChildViewportSnapshots, startViewportSnapshotResponder };

package/design-library-preview/DesignLibraryPreview.js

@@ -2,6 +2,7 @@
 import { useEffect, useRef } from "react";
 import { buildGoogleFontsCssUrl } from "../_vendor/replo-utils/lib/fonts.mjs";
 import { designLibraryPreviewMessageSchema } from "../_vendor/schemas/designLibrary.mjs";
+import { isAllowedEditorMessage } from "../annotations/bridgeGate";
 const FONT_LINK_DATA_KEY = "reploDesignLibraryFont";
 function escapeCssString(value) {
   return value.replace(/\\/gu, "\\\\").replace(/'/gu, "\\'");
@@ -13,6 +14,7 @@ function DesignLibraryPreview() {
   const ownsDefaultFont = useRef(false);
   useEffect(() => {
     const handleMessage = (event) => {
+      if (!isAllowedEditorMessage(event)) return;
       const parsed = designLibraryPreviewMessageSchema.safeParse(event.data);
       if (!parsed.success) return;
       const { cssVars, fonts, defaultFontCssVar } = parsed.data;

package/design-library-preview/DesignLibraryPreview.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../design-library-preview/DesignLibraryPreview.tsx"],
-  "sourcesContent": ["\"use client\";\n\nimport { useEffect, useRef } from \"react\";\n\nimport { buildGoogleFontsCssUrl } from \"replo-utils/lib/fonts\";\nimport { designLibraryPreviewMessageSchema } from \"schemas/designLibrary\";\n\nconst FONT_LINK_DATA_KEY = \"reploDesignLibraryFont\";\n\nfunction escapeCssString(value: string): string {\n  return value.replace(/\\\\/gu, \"\\\\\\\\\").replace(/'/gu, \"\\\\'\");\n}\n\nexport function DesignLibraryPreview() {\n  // NOTE (Ben, 2026-06-03): The custom-property keys we set last time, so on the\n  // next message we remove only the ones we own that the new override set drops.\n  const ownedKeys = useRef<Set<string> | null>(null);\n  // NOTE (Ben, 2026-06-05): The Google Font <link> hrefs we injected, keyed by\n  // href so we de-dupe and remove only our own when the override set changes.\n  const ownedFontLinks = useRef<Map<string, HTMLLinkElement> | null>(null);\n  // NOTE (Ben, 2026-06-05): The @font-face <style> nodes for uploaded custom\n  // fonts, keyed by family with the URL we injected, so we de-dupe, re-inject\n  // when a family's asset URL changes (re-upload), and remove only our own when\n  // the override set changes.\n  const ownedFontFaces = useRef<Map<\n    string,\n    { url: string; style: HTMLStyleElement }\n  > | null>(null);\n  // NOTE (Ben, 2026-06-05): Whether we set the document default font-family, so\n  // we can clear just that.\n  const ownsDefaultFont = useRef(false);\n\n  // eslint-disable-next-line replo/no-use-effect -- Subscribes to window message events from the parent editor.\n  useEffect(() => {\n    const handleMessage = (event: MessageEvent) => {\n      const parsed = designLibraryPreviewMessageSchema.safeParse(event.data);\n      if (!parsed.success) return;\n      const { cssVars, fonts, defaultFontCssVar } = parsed.data;\n      const root = document.documentElement;\n\n      // --- CSS variable overrides (colors + font role vars) ---\n      const nextVars: Record<string, string> = { ...cssVars };\n      for (const font of fonts) {\n        nextVars[font.cssVar] = `'${escapeCssString(font.family)}'`;\n      }\n      const owned = ownedKeys.current ?? new Set();\n      for (const key of owned) {\n        if (!(key in nextVars)) root.style.removeProperty(key);\n      }\n      ownedKeys.current = new Set(Object.keys(nextVars));\n      for (const [key, value] of Object.entries(nextVars)) {\n        root.style.setProperty(key, value);\n      }\n\n      // Custom uploaded fonts carry a faceUrl; Google fonts don't.\n      const customFonts = fonts.filter((font) => Boolean(font.faceUrl));\n      const googleFonts = fonts.filter((font) => !font.faceUrl);\n\n      // --- Google Font stylesheets (<link> to the CDN) ---\n      const links = ownedFontLinks.current ?? new Map();\n      const nextHrefs = new Set(\n        googleFonts.map((font) => buildGoogleFontsCssUrl(font.family)),\n      );\n      for (const [href, link] of links) {\n        if (!nextHrefs.has(href)) {\n          link.remove();\n          links.delete(href);\n        }\n      }\n      for (const href of nextHrefs) {\n        if (links.has(href)) continue;\n        const link = document.createElement(\"link\");\n        link.rel = \"stylesheet\";\n        link.href = href;\n        link.dataset[FONT_LINK_DATA_KEY] = \"\";\n        document.head.append(link);\n        links.set(href, link);\n      }\n      ownedFontLinks.current = links;\n\n      // --- Custom uploaded fonts (@font-face from the asset URL) ---\n      const faces = ownedFontFaces.current ?? new Map();\n      const nextFamilies = new Set(customFonts.map((font) => font.family));\n      for (const [family, entry] of faces) {\n        if (!nextFamilies.has(family)) {\n          entry.style.remove();\n          faces.delete(family);\n        }\n      }\n      for (const font of customFonts) {\n        if (!font.faceUrl) continue;\n        const existing = faces.get(font.family);\n        // Re-upload reuses the family but changes the asset URL; replace the\n        // stale node rather than skipping it.\n        if (existing?.url === font.faceUrl) continue;\n        existing?.style.remove();\n        const style = document.createElement(\"style\");\n        style.dataset[FONT_LINK_DATA_KEY] = \"\";\n        const format = font.format\n          ? ` format('${escapeCssString(font.format)}')`\n          : \"\";\n        style.textContent = `@font-face{font-family:'${escapeCssString(font.family)}';font-weight:400;font-style:normal;src:url('${escapeCssString(font.faceUrl)}')${format};font-display:swap;}`;\n        document.head.append(style);\n        faces.set(font.family, { url: font.faceUrl, style });\n      }\n      ownedFontFaces.current = faces;\n\n      // --- Document default font ---\n      if (defaultFontCssVar) {\n        root.style.setProperty(\"font-family\", `var(${defaultFontCssVar})`);\n        ownsDefaultFont.current = true;\n      } else if (ownsDefaultFont.current) {\n        root.style.removeProperty(\"font-family\");\n        ownsDefaultFont.current = false;\n      }\n    };\n    window.addEventListener(\"message\", handleMessage);\n    return () => {\n      window.removeEventListener(\"message\", handleMessage);\n    };\n  }, []);\n\n  return null;\n}\n"],
-  "mappings": ";AAEA,SAAS,WAAW,cAAc;AAElC,SAAS,8BAA8B;AACvC,SAAS,yCAAyC;AAElD,MAAM,qBAAqB;AAE3B,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,KAAK;AAC3D;AAEO,SAAS,uBAAuB;AAGrC,QAAM,YAAY,OAA2B,IAAI;AAGjD,QAAM,iBAAiB,OAA4C,IAAI;AAKvE,QAAM,iBAAiB,OAGb,IAAI;AAGd,QAAM,kBAAkB,OAAO,KAAK;AAGpC,YAAU,MAAM;AACd,UAAM,gBAAgB,CAAC,UAAwB;AAC7C,YAAM,SAAS,kCAAkC,UAAU,MAAM,IAAI;AACrE,UAAI,CAAC,OAAO,QAAS;AACrB,YAAM,EAAE,SAAS,OAAO,kBAAkB,IAAI,OAAO;AACrD,YAAM,OAAO,SAAS;AAGtB,YAAM,WAAmC,EAAE,GAAG,QAAQ;AACtD,iBAAW,QAAQ,OAAO;AACxB,iBAAS,KAAK,MAAM,IAAI,IAAI,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC1D;AACA,YAAM,QAAQ,UAAU,WAAW,oBAAI,IAAI;AAC3C,iBAAW,OAAO,OAAO;AACvB,YAAI,EAAE,OAAO,UAAW,MAAK,MAAM,eAAe,GAAG;AAAA,MACvD;AACA,gBAAU,UAAU,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC;AACjD,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,aAAK,MAAM,YAAY,KAAK,KAAK;AAAA,MACnC;AAGA,YAAM,cAAc,MAAM,OAAO,CAAC,SAAS,QAAQ,KAAK,OAAO,CAAC;AAChE,YAAM,cAAc,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO;AAGxD,YAAM,QAAQ,eAAe,WAAW,oBAAI,IAAI;AAChD,YAAM,YAAY,IAAI;AAAA,QACpB,YAAY,IAAI,CAAC,SAAS,uBAAuB,KAAK,MAAM,CAAC;AAAA,MAC/D;AACA,iBAAW,CAAC,MAAM,IAAI,KAAK,OAAO;AAChC,YAAI,CAAC,UAAU,IAAI,IAAI,GAAG;AACxB,eAAK,OAAO;AACZ,gBAAM,OAAO,IAAI;AAAA,QACnB;AAAA,MACF;AACA,iBAAW,QAAQ,WAAW;AAC5B,YAAI,MAAM,IAAI,IAAI,EAAG;AACrB,cAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,aAAK,MAAM;AACX,aAAK,OAAO;AACZ,aAAK,QAAQ,kBAAkB,IAAI;AACnC,iBAAS,KAAK,OAAO,IAAI;AACzB,cAAM,IAAI,MAAM,IAAI;AAAA,MACtB;AACA,qBAAe,UAAU;AAGzB,YAAM,QAAQ,eAAe,WAAW,oBAAI,IAAI;AAChD,YAAM,eAAe,IAAI,IAAI,YAAY,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC;AACnE,iBAAW,CAAC,QAAQ,KAAK,KAAK,OAAO;AACnC,YAAI,CAAC,aAAa,IAAI,MAAM,GAAG;AAC7B,gBAAM,MAAM,OAAO;AACnB,gBAAM,OAAO,MAAM;AAAA,QACrB;AAAA,MACF;AACA,iBAAW,QAAQ,aAAa;AAC9B,YAAI,CAAC,KAAK,QAAS;AACnB,cAAM,WAAW,MAAM,IAAI,KAAK,MAAM;AAGtC,YAAI,UAAU,QAAQ,KAAK,QAAS;AACpC,kBAAU,MAAM,OAAO;AACvB,cAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,cAAM,QAAQ,kBAAkB,IAAI;AACpC,cAAM,SAAS,KAAK,SAChB,YAAY,gBAAgB,KAAK,MAAM,CAAC,OACxC;AACJ,cAAM,cAAc,2BAA2B,gBAAgB,KAAK,MAAM,CAAC,gDAAgD,gBAAgB,KAAK,OAAO,CAAC,KAAK,MAAM;AACnK,iBAAS,KAAK,OAAO,KAAK;AAC1B,cAAM,IAAI,KAAK,QAAQ,EAAE,KAAK,KAAK,SAAS,MAAM,CAAC;AAAA,MACrD;AACA,qBAAe,UAAU;AAGzB,UAAI,mBAAmB;AACrB,aAAK,MAAM,YAAY,eAAe,OAAO,iBAAiB,GAAG;AACjE,wBAAgB,UAAU;AAAA,MAC5B,WAAW,gBAAgB,SAAS;AAClC,aAAK,MAAM,eAAe,aAAa;AACvC,wBAAgB,UAAU;AAAA,MAC5B;AAAA,IACF;AACA,WAAO,iBAAiB,WAAW,aAAa;AAChD,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,aAAa;AAAA,IACrD;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AACT;",
+  "sourcesContent": ["\"use client\";\n\nimport { useEffect, useRef } from \"react\";\n\nimport { buildGoogleFontsCssUrl } from \"replo-utils/lib/fonts\";\nimport { designLibraryPreviewMessageSchema } from \"schemas/designLibrary\";\n\nimport { isAllowedEditorMessage } from \"../annotations/bridgeGate\";\n\nconst FONT_LINK_DATA_KEY = \"reploDesignLibraryFont\";\n\nfunction escapeCssString(value: string): string {\n  return value.replace(/\\\\/gu, \"\\\\\\\\\").replace(/'/gu, \"\\\\'\");\n}\n\nexport function DesignLibraryPreview() {\n  // NOTE (Ben, 2026-06-03): The custom-property keys we set last time, so on the\n  // next message we remove only the ones we own that the new override set drops.\n  const ownedKeys = useRef<Set<string> | null>(null);\n  // NOTE (Ben, 2026-06-05): The Google Font <link> hrefs we injected, keyed by\n  // href so we de-dupe and remove only our own when the override set changes.\n  const ownedFontLinks = useRef<Map<string, HTMLLinkElement> | null>(null);\n  // NOTE (Ben, 2026-06-05): The @font-face <style> nodes for uploaded custom\n  // fonts, keyed by family with the URL we injected, so we de-dupe, re-inject\n  // when a family's asset URL changes (re-upload), and remove only our own when\n  // the override set changes.\n  const ownedFontFaces = useRef<Map<\n    string,\n    { url: string; style: HTMLStyleElement }\n  > | null>(null);\n  // NOTE (Ben, 2026-06-05): Whether we set the document default font-family, so\n  // we can clear just that.\n  const ownsDefaultFont = useRef(false);\n\n  // eslint-disable-next-line replo/no-use-effect -- Subscribes to window message events from the parent editor.\n  useEffect(() => {\n    const handleMessage = (event: MessageEvent) => {\n      if (!isAllowedEditorMessage(event)) return;\n      const parsed = designLibraryPreviewMessageSchema.safeParse(event.data);\n      if (!parsed.success) return;\n      const { cssVars, fonts, defaultFontCssVar } = parsed.data;\n      const root = document.documentElement;\n\n      // --- CSS variable overrides (colors + font role vars) ---\n      const nextVars: Record<string, string> = { ...cssVars };\n      for (const font of fonts) {\n        nextVars[font.cssVar] = `'${escapeCssString(font.family)}'`;\n      }\n      const owned = ownedKeys.current ?? new Set();\n      for (const key of owned) {\n        if (!(key in nextVars)) root.style.removeProperty(key);\n      }\n      ownedKeys.current = new Set(Object.keys(nextVars));\n      for (const [key, value] of Object.entries(nextVars)) {\n        root.style.setProperty(key, value);\n      }\n\n      // Custom uploaded fonts carry a faceUrl; Google fonts don't.\n      const customFonts = fonts.filter((font) => Boolean(font.faceUrl));\n      const googleFonts = fonts.filter((font) => !font.faceUrl);\n\n      // --- Google Font stylesheets (<link> to the CDN) ---\n      const links = ownedFontLinks.current ?? new Map();\n      const nextHrefs = new Set(\n        googleFonts.map((font) => buildGoogleFontsCssUrl(font.family)),\n      );\n      for (const [href, link] of links) {\n        if (!nextHrefs.has(href)) {\n          link.remove();\n          links.delete(href);\n        }\n      }\n      for (const href of nextHrefs) {\n        if (links.has(href)) continue;\n        const link = document.createElement(\"link\");\n        link.rel = \"stylesheet\";\n        link.href = href;\n        link.dataset[FONT_LINK_DATA_KEY] = \"\";\n        document.head.append(link);\n        links.set(href, link);\n      }\n      ownedFontLinks.current = links;\n\n      // --- Custom uploaded fonts (@font-face from the asset URL) ---\n      const faces = ownedFontFaces.current ?? new Map();\n      const nextFamilies = new Set(customFonts.map((font) => font.family));\n      for (const [family, entry] of faces) {\n        if (!nextFamilies.has(family)) {\n          entry.style.remove();\n          faces.delete(family);\n        }\n      }\n      for (const font of customFonts) {\n        if (!font.faceUrl) continue;\n        const existing = faces.get(font.family);\n        // Re-upload reuses the family but changes the asset URL; replace the\n        // stale node rather than skipping it.\n        if (existing?.url === font.faceUrl) continue;\n        existing?.style.remove();\n        const style = document.createElement(\"style\");\n        style.dataset[FONT_LINK_DATA_KEY] = \"\";\n        const format = font.format\n          ? ` format('${escapeCssString(font.format)}')`\n          : \"\";\n        style.textContent = `@font-face{font-family:'${escapeCssString(font.family)}';font-weight:400;font-style:normal;src:url('${escapeCssString(font.faceUrl)}')${format};font-display:swap;}`;\n        document.head.append(style);\n        faces.set(font.family, { url: font.faceUrl, style });\n      }\n      ownedFontFaces.current = faces;\n\n      // --- Document default font ---\n      if (defaultFontCssVar) {\n        root.style.setProperty(\"font-family\", `var(${defaultFontCssVar})`);\n        ownsDefaultFont.current = true;\n      } else if (ownsDefaultFont.current) {\n        root.style.removeProperty(\"font-family\");\n        ownsDefaultFont.current = false;\n      }\n    };\n    window.addEventListener(\"message\", handleMessage);\n    return () => {\n      window.removeEventListener(\"message\", handleMessage);\n    };\n  }, []);\n\n  return null;\n}\n"],
+  "mappings": ";AAEA,SAAS,WAAW,cAAc;AAElC,SAAS,8BAA8B;AACvC,SAAS,yCAAyC;AAElD,SAAS,8BAA8B;AAEvC,MAAM,qBAAqB;AAE3B,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,MAAM,QAAQ,QAAQ,MAAM,EAAE,QAAQ,OAAO,KAAK;AAC3D;AAEO,SAAS,uBAAuB;AAGrC,QAAM,YAAY,OAA2B,IAAI;AAGjD,QAAM,iBAAiB,OAA4C,IAAI;AAKvE,QAAM,iBAAiB,OAGb,IAAI;AAGd,QAAM,kBAAkB,OAAO,KAAK;AAGpC,YAAU,MAAM;AACd,UAAM,gBAAgB,CAAC,UAAwB;AAC7C,UAAI,CAAC,uBAAuB,KAAK,EAAG;AACpC,YAAM,SAAS,kCAAkC,UAAU,MAAM,IAAI;AACrE,UAAI,CAAC,OAAO,QAAS;AACrB,YAAM,EAAE,SAAS,OAAO,kBAAkB,IAAI,OAAO;AACrD,YAAM,OAAO,SAAS;AAGtB,YAAM,WAAmC,EAAE,GAAG,QAAQ;AACtD,iBAAW,QAAQ,OAAO;AACxB,iBAAS,KAAK,MAAM,IAAI,IAAI,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC1D;AACA,YAAM,QAAQ,UAAU,WAAW,oBAAI,IAAI;AAC3C,iBAAW,OAAO,OAAO;AACvB,YAAI,EAAE,OAAO,UAAW,MAAK,MAAM,eAAe,GAAG;AAAA,MACvD;AACA,gBAAU,UAAU,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC;AACjD,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,aAAK,MAAM,YAAY,KAAK,KAAK;AAAA,MACnC;AAGA,YAAM,cAAc,MAAM,OAAO,CAAC,SAAS,QAAQ,KAAK,OAAO,CAAC;AAChE,YAAM,cAAc,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO;AAGxD,YAAM,QAAQ,eAAe,WAAW,oBAAI,IAAI;AAChD,YAAM,YAAY,IAAI;AAAA,QACpB,YAAY,IAAI,CAAC,SAAS,uBAAuB,KAAK,MAAM,CAAC;AAAA,MAC/D;AACA,iBAAW,CAAC,MAAM,IAAI,KAAK,OAAO;AAChC,YAAI,CAAC,UAAU,IAAI,IAAI,GAAG;AACxB,eAAK,OAAO;AACZ,gBAAM,OAAO,IAAI;AAAA,QACnB;AAAA,MACF;AACA,iBAAW,QAAQ,WAAW;AAC5B,YAAI,MAAM,IAAI,IAAI,EAAG;AACrB,cAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,aAAK,MAAM;AACX,aAAK,OAAO;AACZ,aAAK,QAAQ,kBAAkB,IAAI;AACnC,iBAAS,KAAK,OAAO,IAAI;AACzB,cAAM,IAAI,MAAM,IAAI;AAAA,MACtB;AACA,qBAAe,UAAU;AAGzB,YAAM,QAAQ,eAAe,WAAW,oBAAI,IAAI;AAChD,YAAM,eAAe,IAAI,IAAI,YAAY,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC;AACnE,iBAAW,CAAC,QAAQ,KAAK,KAAK,OAAO;AACnC,YAAI,CAAC,aAAa,IAAI,MAAM,GAAG;AAC7B,gBAAM,MAAM,OAAO;AACnB,gBAAM,OAAO,MAAM;AAAA,QACrB;AAAA,MACF;AACA,iBAAW,QAAQ,aAAa;AAC9B,YAAI,CAAC,KAAK,QAAS;AACnB,cAAM,WAAW,MAAM,IAAI,KAAK,MAAM;AAGtC,YAAI,UAAU,QAAQ,KAAK,QAAS;AACpC,kBAAU,MAAM,OAAO;AACvB,cAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,cAAM,QAAQ,kBAAkB,IAAI;AACpC,cAAM,SAAS,KAAK,SAChB,YAAY,gBAAgB,KAAK,MAAM,CAAC,OACxC;AACJ,cAAM,cAAc,2BAA2B,gBAAgB,KAAK,MAAM,CAAC,gDAAgD,gBAAgB,KAAK,OAAO,CAAC,KAAK,MAAM;AACnK,iBAAS,KAAK,OAAO,KAAK;AAC1B,cAAM,IAAI,KAAK,QAAQ,EAAE,KAAK,KAAK,SAAS,MAAM,CAAC;AAAA,MACrD;AACA,qBAAe,UAAU;AAGzB,UAAI,mBAAmB;AACrB,aAAK,MAAM,YAAY,eAAe,OAAO,iBAAiB,GAAG;AACjE,wBAAgB,UAAU;AAAA,MAC5B,WAAW,gBAAgB,SAAS;AAClC,aAAK,MAAM,eAAe,aAAa;AACvC,wBAAgB,UAAU;AAAA,MAC5B;AAAA,IACF;AACA,WAAO,iBAAiB,WAAW,aAAa;AAChD,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,aAAa;AAAA,IACrD;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AACT;",
   "names": []
 }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sandbox-runtime",
-  "version": "1.6.5",
+  "version": "1.6.7",
   "reploBuild": {
     "packageName": "@replohq/sandbox-runtime",
-    "version": "1.6.5",
+    "version": "1.6.7",
     "branch": "HEAD",
-    "commit": "5d112aef8f978ceb8157400597f494b241e6ac1c",
-    "builtAt": "2026-09-12T01:09:48.099Z"
+    "commit": "6f35acf4a9b5e632c79b8914aa2b66350bc80485",
+    "builtAt": "2026-09-14T19:23:28.579Z"
   },
   "description": "Replo sandbox runtime — editor integration for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",

package/sandbox-runtime.js

@@ -1,5 +1,6 @@
 "use client";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import { useViewportSnapshotResponder } from "./_vendor/replo-utils/react/use-viewport-snapshot-responder.mjs";
 import { AnnotationLayerMount } from "./annotations/AnnotationLayerMount";
 import { ClientErrorBoundary } from "./ClientErrorBoundary";
 import { DesignLibraryPreview } from "./design-library-preview/DesignLibraryPreview";
@@ -9,6 +10,10 @@ import { NavigationReceiver } from "./NavigationReceiver";
 import { NextErrorReporter } from "./NextErrorReporter";
 import PostHogRelay from "./posthog-relay";
 import { EditorSelection } from "./select-mode/EditorSelection";
+function ViewportSnapshotResponder() {
+  useViewportSnapshotResponder();
+  return null;
+}
 function SandboxRuntime({ children }) {
   const isDevServer = process.env.NODE_ENV === "development";
   return isDevServer ? /* @__PURE__ */ jsxs(Fragment, { children: [
@@ -18,6 +23,7 @@ function SandboxRuntime({ children }) {
       /* @__PURE__ */ jsx(LinkInterceptor, {}),
       /* @__PURE__ */ jsx(NavigationReceiver, {}),
       /* @__PURE__ */ jsx(PostHogRelay, {}),
+      /* @__PURE__ */ jsx(ViewportSnapshotResponder, {}),
       /* @__PURE__ */ jsx(EditorSelection, {}),
       /* @__PURE__ */ jsx(AnnotationLayerMount, {}),
       /* @__PURE__ */ jsx(DesignLibraryPreview, {}),

package/sandbox-runtime.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../sandbox-runtime.tsx"],
-  "sourcesContent": ["\"use client\";\n\nimport { AnnotationLayerMount } from \"./annotations/AnnotationLayerMount\";\nimport { ClientErrorBoundary } from \"./ClientErrorBoundary\";\nimport { DesignLibraryPreview } from \"./design-library-preview/DesignLibraryPreview\";\nimport { DocumentReadyBeacon } from \"./DocumentReadyBeacon\";\nimport LinkInterceptor from \"./LinkInterceptor\";\nimport { NavigationReceiver } from \"./NavigationReceiver\";\nimport { NextErrorReporter } from \"./NextErrorReporter\";\nimport PostHogRelay from \"./posthog-relay\";\nimport { EditorSelection } from \"./select-mode/EditorSelection\";\n\nexport function SandboxRuntime({ children }: React.PropsWithChildren) {\n  // The editor only embeds dev servers (`next dev`), so editor-integration components render there only \u2014 production builds ship none of them and behave like plain Next apps.\n  const isDevServer = process.env.NODE_ENV === \"development\";\n\n  return isDevServer ? (\n    <>\n      <DocumentReadyBeacon />\n      {/* NOTE (Max, 2026-06-08): Outside ClientErrorBoundary on purpose \u2014 when\n          the boundary catches a runtime error it swaps its children for a\n          neutral cover, which would unmount the reporter and freeze it in the\n          error state. It must stay mounted to observe Next's overlay across\n          error <-> recover. */}\n      <NextErrorReporter />\n      <ClientErrorBoundary>\n        <LinkInterceptor />\n        <NavigationReceiver />\n        <PostHogRelay />\n        <EditorSelection />\n        <AnnotationLayerMount />\n        <DesignLibraryPreview />\n        {children}\n      </ClientErrorBoundary>\n    </>\n  ) : (\n    children\n  );\n}\n"],
-  "mappings": ";AAiBI,mBACE,KAOA,YARF;AAfJ,SAAS,4BAA4B;AACrC,SAAS,2BAA2B;AACpC,SAAS,4BAA4B;AACrC,SAAS,2BAA2B;AACpC,OAAO,qBAAqB;AAC5B,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC,OAAO,kBAAkB;AACzB,SAAS,uBAAuB;AAEzB,SAAS,eAAe,EAAE,SAAS,GAA4B;AAEpE,QAAM,cAAc,QAAQ,IAAI,aAAa;AAE7C,SAAO,cACL,iCACE;AAAA,wBAAC,uBAAoB;AAAA,IAMrB,oBAAC,qBAAkB;AAAA,IACnB,qBAAC,uBACC;AAAA,0BAAC,mBAAgB;AAAA,MACjB,oBAAC,sBAAmB;AAAA,MACpB,oBAAC,gBAAa;AAAA,MACd,oBAAC,mBAAgB;AAAA,MACjB,oBAAC,wBAAqB;AAAA,MACtB,oBAAC,wBAAqB;AAAA,MACrB;AAAA,OACH;AAAA,KACF,IAEA;AAEJ;",
+  "sourcesContent": ["\"use client\";\n\nimport { useViewportSnapshotResponder } from \"replo-utils/react/use-viewport-snapshot-responder\";\n\nimport { AnnotationLayerMount } from \"./annotations/AnnotationLayerMount\";\nimport { ClientErrorBoundary } from \"./ClientErrorBoundary\";\nimport { DesignLibraryPreview } from \"./design-library-preview/DesignLibraryPreview\";\nimport { DocumentReadyBeacon } from \"./DocumentReadyBeacon\";\nimport LinkInterceptor from \"./LinkInterceptor\";\nimport { NavigationReceiver } from \"./NavigationReceiver\";\nimport { NextErrorReporter } from \"./NextErrorReporter\";\nimport PostHogRelay from \"./posthog-relay\";\nimport { EditorSelection } from \"./select-mode/EditorSelection\";\n\nfunction ViewportSnapshotResponder() {\n  useViewportSnapshotResponder();\n  return null;\n}\n\nexport function SandboxRuntime({ children }: React.PropsWithChildren) {\n  // The editor only embeds dev servers (`next dev`), so editor-integration components render there only \u2014 production builds ship none of them and behave like plain Next apps.\n  const isDevServer = process.env.NODE_ENV === \"development\";\n\n  return isDevServer ? (\n    <>\n      <DocumentReadyBeacon />\n      {/* NOTE (Max, 2026-06-08): Outside ClientErrorBoundary on purpose \u2014 when\n          the boundary catches a runtime error it swaps its children for a\n          neutral cover, which would unmount the reporter and freeze it in the\n          error state. It must stay mounted to observe Next's overlay across\n          error <-> recover. */}\n      <NextErrorReporter />\n      <ClientErrorBoundary>\n        <LinkInterceptor />\n        <NavigationReceiver />\n        <PostHogRelay />\n        <ViewportSnapshotResponder />\n        <EditorSelection />\n        <AnnotationLayerMount />\n        <DesignLibraryPreview />\n        {children}\n      </ClientErrorBoundary>\n    </>\n  ) : (\n    children\n  );\n}\n"],
+  "mappings": ";AAwBI,mBACE,KAOA,YARF;AAtBJ,SAAS,oCAAoC;AAE7C,SAAS,4BAA4B;AACrC,SAAS,2BAA2B;AACpC,SAAS,4BAA4B;AACrC,SAAS,2BAA2B;AACpC,OAAO,qBAAqB;AAC5B,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC,OAAO,kBAAkB;AACzB,SAAS,uBAAuB;AAEhC,SAAS,4BAA4B;AACnC,+BAA6B;AAC7B,SAAO;AACT;AAEO,SAAS,eAAe,EAAE,SAAS,GAA4B;AAEpE,QAAM,cAAc,QAAQ,IAAI,aAAa;AAE7C,SAAO,cACL,iCACE;AAAA,wBAAC,uBAAoB;AAAA,IAMrB,oBAAC,qBAAkB;AAAA,IACnB,qBAAC,uBACC;AAAA,0BAAC,mBAAgB;AAAA,MACjB,oBAAC,sBAAmB;AAAA,MACpB,oBAAC,gBAAa;AAAA,MACd,oBAAC,6BAA0B;AAAA,MAC3B,oBAAC,mBAAgB;AAAA,MACjB,oBAAC,wBAAqB;AAAA,MACtB,oBAAC,wBAAqB;AAAA,MACrB;AAAA,OACH;AAAA,KACF,IAEA;AAEJ;",
   "names": []
 }