Vitor PamplonaandClaude Opus 4.8 a66821d59e docs(napplets): record the per-applet storage-origin change in the security plan ...

Document the move from the opaque `allow-scripts`-only sandbox to a real per-applet
origin (https://<sha256(author:identifier)>.napplet.local, allow-same-origin) under
"Fixed in this pass", plus the residual risks it introduces: the load-bearing invariant
that the applet origin must stay distinct from the shell/bridge origin, persistent client
storage as a new persistence/exfil surface, the origin-id derivation, and service workers
now being reachable-but-unwired.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-22 18:20:57 -04:00

..

plans

docs(napplets): record the per-applet storage-origin change in the security plan

2026-06-22 18:20:57 -04:00

src

feat(napplets): prefetch blobs to disk on render + loading/unavailable screen

2026-06-22 21:32:48 +00:00

.gitignore

changes app directory to amethyst

2024-06-24 14:13:55 -04:00

build.gradle.kts

refactor(napplets): extract sandbox runtime into :nappletHost module

2026-06-22 20:45:19 +00:00

google-services.json

updates google services json

2025-08-28 11:18:01 -04:00

proguard-rules.pro

build: remove unused :ammolite module

2026-05-16 14:40:03 +00:00