ix-windows: correct sandbox docs (opaque origin, not a network block)

[Andrew Gazelka (andrewgazelka)]

What

Follow-up to #1334: correct the ix-windows sandbox docs. The merged wording overstated the sandbox as a network block ("external CDN scripts/styles ... are blocked", mermaid "silently fails").

sandbox="allow-scripts" (no allow-same-origin) creates an opaque origin — that removes same-origin fetch, cookies, and storage, but it is not a CSP/network block: absolute HTTPS subresources can still load subject to CORS. What I actually observed failing was an ES-module import from a CDN under the opaque origin. Docs now say exactly that, and keep the real guidance: for a reproducible offline pane, inline assets and pre-render libraries (mermaid → SVG).

Matches the same correction made to the register_resource docstring in #1335 (flagged by the AI reviewer there).

🤖 Authored with Claude Code (Opus).

Note

Correct sandbox docs to clarify opaque-origin behavior in ix-windows

Updates overview.md and README.md to fix a mis-description of the sandboxed shell: the restriction is opaque-origin (not a network block), meaning same-origin fetch, cookies, and storage are unavailable, but absolute HTTPS subresources may still load subject to CORS. ES-module imports from a CDN may fail. The recommendation is updated from "self-contained HTML only" to "prefer self-contained HTML" with pre-rendered assets (e.g., mermaid rendered to SVG) for reliable offline panes.

^{Macroscope summarized 85c69a3.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

Blast radius

23 of 1485 checks would rebuild between base 072d3cd and head 876b1b7.

pie showData title Rebuilt checks by category
  "image" : 15
  "rust" : 2
  "site" : 2
  "agent" : 1
  "blast" : 1
  "eval" : 1
  "lint" : 1

Loading

flowchart LR
  c0["ix-mcp"]
  c1["blast-radius-test"]
  c2["agent-skills"]
  c3["lint"]
  c4["site-test"]
  c5["site-case-tests"]
  c0 --> k0["agent-skills"]
  c0 --> k2["eval"]
  c0 --> k3["image-development-base"]
  c0 --> k4["image-kernel-dev"]
  c0 --> k5["image-minecraft"]

Loading

changed checks (23)

• agent-skills
• blast-radius-test
• eval
• image-development-base
• image-kernel-dev
• image-minecraft
• image-minecraft-bedrock
• image-minecraft-status
• image-minecraft_1.21.11-fabric
• image-minecraft_1.21.11-paper
• image-minecraft_26.1.2-fabric
• image-minecraft_26.1.2-paper
• image-minecraft_26w17a-fabric
• image-minestom
• image-neovim-ci
• image-remote-desktop
• image-symphony-codex
• image-test-cluster-bootstrap
• lint
• rust-mcp.evalSmoke
• rust-mcp.requirementsSmoke
• site-case-tests
• site-test