No runtime errors, blocked requests or console errors from the current preview.
Build and references
All files have valid names, references resolve, and brackets balance.
Safety and secrets APPROX
No eval, parent-window access, network calls or credential-like strings found.
Pattern-based. The real boundary is the sandboxed, network-off preview.
Accessibility APPROX
No static accessibility problems found in the HTML and theme tokens.
Checks markup and token contrast. Content created by scripts at runtime is not inspected; test with a keyboard and screen reader too.
Acceptance checklist 0/9
Generated from the plan. Exported with the project in SPEC.md.
Isolation by default
The preview frame runs with only scripts and forms allowed. It has an opaque origin, so generated code cannot read this site’s storage, cookies or page, and a content security policy blocks all network requests, external scripts and form posts. Code that tries to reach the parent window is stopped before it runs.
Browser storage is unavailable inside that sandbox, so generated apps fall back to in-memory storage and say so in their footer. In the exported app, localStorage works normally.
Errors with file and line
When a script throws, the preview reports the message and maps the line back to the original file — “todo.js line 42”, not a line in a combined document. Blocked network requests and console errors are listed in the Checks tab too.
Switch between 360px, 768px and 1280px widths, or type a custom width, to check responsive behaviour. The preview also warns if a page scrolls sideways.
Frequently asked questions
Why does my fetch() call fail in the preview?
Network access is off in the preview by design. It will work in the exported app if the API allows requests from your site.
Can I open the preview in a new tab?
Download the single-file HTML from the Export tab and open it locally. The live preview stays sandboxed.