From 10cf3264fbbb42d02f7dee45a8b19adcf9085e4e Mon Sep 17 00:00:00 2001 From: Mario Zechner Date: Mon, 2 Nov 2026 20:26:54 +0000 Subject: [PATCH] =?UTF-8?q?docs(chord):=20design=20=C2=A723,=20the=20termi?= =?UTF-8?q?nal's=20sandbox=20is=20a=20child=20process?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- packages/chord/docs/next/design.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/packages/chord/docs/next/design.md b/packages/chord/docs/next/design.md index 4c56352f2..69ebfd0aa 100644 --- a/packages/chord/docs/next/design.md +++ b/packages/chord/docs/next/design.md @@ -2305,8 +2305,10 @@ Decision "Slice 11's points" and "Slice 11, P3" to "P9". the page); pages learn of them through an object the web component serves (the current set); a base code change reloads the page. - `chord/next/react`: `HostProvider`, `useHold`, `useWatch`, `useRegistry`, `useRefState`. -- `chord/next/tui`: a Node client connecting with a token, always running the downloaded code in a sandbox (a - permission-dropped worker thread, a bridge terminal, the trusted launcher outside); a component scope (`hold`, +- `chord/next/tui`: a Node client connecting with a token, always running the downloaded code in a sandbox (decision + "The terminal's sandbox is a child process": a child process on pipes with an empty environment, `--permission` + granting nothing and no SQLite; the builtin allowlist and a frozen substitute `process` inside; a bridge terminal; + the trusted launcher outside, confirming copy, open and attach on its own prompt); a component scope (`hold`, `watch`, `registry`, released on dispose, one `changed` callback for the app's redraw), no pi-tui dependency. ### Channels