mirror of
https://github.com/t8y2/dbx.git
synced 2026-10-21 12:41:39 +00:00
The workbench sandbox inlines only the entry script, so code-split chunks had no runtime address and dynamic imports 404'd. Serve each installed plugin's ui.root through dbx-plugin://localhost/<id>/<path> (WebView2 maps the scheme to http://dbx-plugin.localhost), inject the platform-correct form as the sandbox document <base>, and allow it in the resource CSP. Reads reuse the registry's ui-asset validation (traversal confinement, 32 MiB cap, sha256 etag) and answer CORS with ACAO:* for the opaque-origin iframe; responses are no-store so plugin updates land immediately. Existing plugins are unaffected. Builds that emit relative asset URLs (vite base "./" / webpack publicPath "./") additionally regain lazy loading and font loading; documented for plugin authors in both languages.