32 Bot Widgets

32 Bot Widgets

Source: docs/design/32-bot-widgets.md

Status

P0–P2 implemented (2026-10-11). P3 authoring pipeline + P4 delivery tiers (D87) designed, not implemented.

Trust model (D81)

Bots deliver single-file HTML widgets via task tools; cards load in sandboxed iframe (kepcup-app://, host prefix widget-). Default no network; human confirm per HTML sha256 (+ query summary); versions append-only; HTML never enters model context.

Capability bridge (KV / pre-approved read-only queries / links / theme height) executes in core SQLite — generated code never touches Node, filesystem, or network.

Authoring (D87, pending)

Task surface becomes widget_craft (+ widget_publish); create/update are service endpoints. Host state machine drives independent widget_authoring loops: SPEC → BUILD → GATE (S0/S1/S2) → REVIEW → FIX → deliver with check receipt only in task context.

Delivery tiers (P4, pending)

L1 present declarative cards; L2 ask_user forms; L3 widget → chat (kepcup.reply / widget_read_state). Full WebApp-tier preview alignment with 47-File-WebApp-Viewer.