ix-windows: draggable, non-resizable, rounded overlay + docs#1334
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Blast radius
pie showData title Rebuilt checks by category
"image" : 15
"rust" : 2
"site" : 2
"agent" : 1
"blast" : 1
"eval" : 1
"lint" : 1
flowchart LR
c0["ix-mcp"]
c1["blast-radius-test"]
c2["agent-skills"]
c3["lint"]
c4["site-test"]
c5["site-case-tests"]
c0 --> k0["agent-skills"]
c0 --> k2["eval"]
c0 --> k3["image-development-base"]
c0 --> k4["image-kernel-dev"]
c0 --> k5["image-minecraft"]
changed checks (23)
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
AI review found issues in this pull request.
Verdict: patch is incorrect
Confidence: 0.78
The runtime changes look scoped, but the PR introduces documentation that claims a sandbox/network guarantee the implementation does not provide.
- P2
packages/ix-windows/README.md:40Sandbox docs overstate network blocking
| A resource's HTML is rendered inside a sandboxed, opaque-origin `<iframe>` | ||
| (`sandbox="allow-scripts"`, no `allow-same-origin`) loaded with no page origin, so | ||
| it must be **self-contained**: inline all CSS and JS and data. External CDN | ||
| scripts/styles, same-origin `fetch`, cookies, and storage are blocked by the | ||
| sandbox. Pre-render anything that needs a library and embed the result -- e.g. | ||
| render a mermaid diagram to SVG server-side (`kroki.io`, the `mermaid` CLI, ...) | ||
| and put the static `<svg>` in the HTML, rather than loading `mermaid.js` from a | ||
| CDN (which silently fails). |
There was a problem hiding this comment.
The new self-contained section says the iframe sandbox blocks external CDN scripts/styles. With only sandbox="allow-scripts" and no CSP, the opaque origin prevents access to parent/cookies/storage, but it does not by itself block absolute external subresources such as <script src="https://..."> or <link rel="stylesheet">. This creates a misleading security/developer guarantee; either enforce self-contained rendering in code or soften the docs here and in the matching overview text.
1 participant
What
Polish the
ix-windowsresource overlay so it behaves like a proper floating card.OUTER_JSstarts a window drag on a primary-buttonmousedownover the card chrome (UserEvent::Drag->begin_drag->drag_window). Content inside the sandboxed iframe stays interactive (only the chrome is a move handle).with_resizable(false)) — the size is owned by the content (auto-fit), so a manual resize just fought the next content report.MEASURE_JS/#ix-rootinner-HTML swap) and the newDrag/begin_dragsurface.Test
nix build .#ix-windowsgreen.Notes
Mermaid-in-overlay confirmed working only when the SVG is pre-rendered and embedded (CDN
mermaid.jsis blocked by the opaque-origin sandbox); documented in the README.Reviewed by the adversarial review-changes workflow: approve-with-fixes, 0 blockers; the confirmed doc-staleness findings are fixed here.
🤖 Authored with Claude Code (Opus).
Note
Add draggable, non-resizable, rounded overlay windows to ix-windows
UserEvent::Dragvariant andWindowManager::begin_dragmethod to initiate a native OS window drag when the webview posts a"drag"IPC message from the card chrome.with_resizable(false); users move them by dragging the chrome instead.masksToBoundson the content view after blur installation.Macroscope summarized 2427e06.