The execution shell for in-browser code assignments on academy.xrpl-commons.org.
sandbox.html is served via GitHub Pages from this repo so that it lives on a
separate origin from the academy app. The app embeds it with
sandbox="allow-scripts allow-same-origin" — safe here precisely because this
origin shares nothing with the app (no cookies, storage or API access) — which
gives learner code a real origin where CDN scripts, import maps and dynamic
import() work natively.
| direction | message |
|---|---|
| app → shell | { type: 'run', html: '<full program document>' } |
| shell → app | { type: '__sandbox_ready__' } once on load |
| program → shell → app | relayed verbatim (console bridge, completion, errors) |
The shell pins the app's origin from the first run message and relays only
messages from the current program frame, only to that origin.
- Source of truth:
public/sandbox.htmlin the (private) academy app repo — this repo mirrors it. Update there first, then here. - Changes must be backward-compatible: an older app build must keep working against a newer shell (the transparent relay makes this the default).
- This file is expected to change rarely; the app-generated program document is where all runner evolution happens.
Served at: https://xrpl-commons.github.io/code-sandbox/sandbox.html