Sandboxed UI

Sandboxed UI

Set ui to an HTML file in the extension folder. Project members see it on the project Extensions tab in an iframe.

Host API 1 does not run a plugin VM. The panel is static HTML (inline script is allowed by CSP) that cannot read the Ordryn session.

Manifest

{
  "id": "callback-bot",
  "name": "Callback bot",
  "version": "1.0.0",
  "host_api": 1,
  "ui": "panel.html"
}

Rules:

• Relative path only (no .., no leading /, no :).
• The file must exist or the extension fails to load.
• Declaring ui is enough for the extension to appear on the project Extensions tab (along with project/member settings or fields).

See callback-bot (panel.html).

Serving

Request	What it returns
GET /api/v2/projects/{projectId}/extensions/{id}/ui	The HTML file named in ui
GET /api/v2/projects/{projectId}/extensions/{id}/ui/…	Sibling files next to that HTML (CSS, JS, images)
GET /api/v2/extensions/{id}/icon	Optional icon (authenticated)

/api/v1 is a compatibility alias for the same routes.

The iframe uses sandbox="allow-scripts allow-forms allow-popups" without allow-same-origin, so the panel cannot read cookies or the parent session.

The HTML response sets a tight Content-Security-Policy (default-src 'none', inline script/style, img-src data: https:, connect-src https:, frame-ancestors 'self').

Do not put secrets in the panel

The browser document cannot see webhook URLs, signing secrets, or callback tokens. Relays should use the callback_token on outbound JSON instead. See Callbacks and inbound.