feat: design inside fusion by sidmohanty11 · Pull Request #2814 · BuilderIO/agent-native

sidmohanty11 · 2026-08-12T12:33:12Z

No description provided.

builder-io-integration

Builder reviewed your changes and found 8 potential issues 🔴

Review Details

Code Review Summary

PR #2814 adds Builder-hosted Fusion designs inside the Design editor: a signed partner handshake, branch-backed design records, same-origin preview proxying, runtime DOM projections, host chat handoff, and editor mode/navigation changes. The overall direction is coherent and well tested, especially around token claims, source-mode distinctions, and live runtime editing. This is high risk because it introduces authentication, bearer tokens, authorization boundaries, and an executable same-origin preview proxy.

Key Findings

🔴 HIGH — The public preview proxy bypasses design authorization and can expose private branch previews.
🔴 HIGH — Upstream Set-Cookie headers are copied onto the Design origin.
🔴 HIGH — The same-origin bridge is inserted as inert HTML and never executes, blocking live editing.
🔴 HIGH — The partner route re-export resolves to the wrong filesystem path and can make the handshake unavailable.
🟡 MEDIUM — Tokens without jti are replayable; route inputs can escape the validated preview origin; concurrent first opens can create duplicate designs; and live layer rename is not persisted or handed off.

The implementation includes good defensive URL parsing, explicit JWT issuer/audience/algorithm checks, bounded route parsing in the partner handler, and regression coverage for runtime projection and navigation behavior.

🧪 Browser testing: Will run after this review (PR touches UI code)

builder-io-integration · 2026-08-12T12:38:42Z

        name,
      );
      if (!nextContent || nextContent === sourceContent) return;
+      if (renameLiveSnapshot) {


🟡 Persist live layer renames through the source handoff

When a selected layer has a live snapshot, this branch updates only the in-memory/live preview HTML and returns. For localhost/fusion screens the stored content is a route URL, so the rename disappears on reload/HMR and never reaches the app source; queue it through the pending live/source handoff path instead of returning after snapshot sync.

Additional Info

Found by 1 review agent.

github-actions · 2026-08-12T13:13:08Z

Visual recap — generation failed

Recap authentication failed — the PLAN_RECAP_TOKEN secret may be expired or revoked. Re-mint it with npx -y @agent-native/core@latest reconnect <app-url> (or npx @agent-native/core@latest connect <app-url> for first-time setup) and update the repo secret.

builder-io-integration

Builder reviewed your changes and found 6 potential issues 🔴

Review Details

Incremental Code Review Summary

The latest commit substantially expands runtime nudge handling and adds URL-content safety audits, lock/hide live-screen coverage, and pending-structure verification changes. The direction improves fail-closed behavior for route-backed screens, but the new verification and layout fallbacks introduce additional regressions. This remains high risk because the PR still contains unresolved preview authorization and same-origin bridge concerns, and it handles executable preview content and source mutations.

New Findings

🔴 HIGH — The broad .fly.dev allowlist permits arbitrary Fly deployments to be proxied as same-origin Builder previews.
🟡 MEDIUM — Applying mixed localhost/Fusion structure edits can wait forever for Fusion runtime verification that is never produced.
🟡 MEDIUM — Pending edits are cleared after merely prefilling the host chat with submit: false.
🟡 MEDIUM — The module-level embed-chrome cache still leaks the flag across SPA navigation despite design-scoped storage.
🟡 MEDIUM — Stylesheet-driven grids are treated as horizontal flex layouts for keyboard nudge behavior.
🟡 MEDIUM — Missing rendered parent display is assumed to be block flow, causing incorrect reorders for inline/non-block containers.

Existing unresolved comments were not reposted.

🧪 Browser testing: Will run after this review (PR touches UI code)

builder-io-integration

Builder reviewed your changes and found 2 potential issues 🔴

Review Details

Code Review Summary

PR #2814 integrates Builder-hosted Fusion branches into the Design editor through a signed partner handoff, branch-backed design records, a preview proxy, runtime DOM projections, and source/chat handoff flows. The overall architecture has good separation between the Builder JWT handshake and the private embed helper, and the latest changes add useful regression coverage for route-backed content, live screens, and keyboard movement. I verified that several earlier findings were addressed (public action exposure, missing jti, route validation, upstream cookies, and design-scoped storage), and I did not repost the still-open findings listed on the PR.

This remains high risk because it crosses authentication, same-origin iframe boundaries, preview execution, and persistent editor state.

New findings

🔴 HIGH — The new same-origin preview proxy gives external preview code allow-scripts plus allow-same-origin, allowing it to execute as trusted Design-origin content and potentially reach the parent/editor context or bearer embed URL. This is separate from the already-open authorization and bridge-execution findings; an isolated proxy origin or message-only bridge is required.
🟡 MEDIUM — Fusion lock/hide operations fall back to a client-only preview when the source content is a route URL, so the visible layer state is lost on reload and is not sent through the Builder source handoff.

🧪 Browser testing: Will run after this review (PR touches UI code)

builder-io-integration

Builder reviewed your changes and found 2 potential issues 🟡

Review Details

Code Review Summary

This update expands the Builder/Fusion integration with host-origin tracking, broader preview-proxy coverage, and additional DesignEditor state and nudge behavior. The direction remains coherent, and the added tests cover several important route-backed and editor regressions. I rechecked the three existing open comments and found no verified fixes to resolve; unchanged issues were not reposted.

This remains high risk because the feature combines embedded editor state, Builder-origin trust, external preview execution, and server-side proxying.

New findings

🟡 MEDIUM — Builder-host confirmation is stored as a module-global sticky flag, so navigating within the SPA from a valid Builder-host design to another design can incorrectly retain host-owned UI/chat behavior and send the second design's context to the original embedding host.
🟡 MEDIUM — The preview proxy buffers an entire chunked or lengthless upstream response before enforcing its 32 MiB limit, allowing a malicious or compromised preview to cause excessive memory allocation under concurrent requests.

Previously reported issues involving live rename handoff, arbitrary Fly preview trust, and same-origin preview execution remain open and were intentionally skipped.

🧪 Browser testing: Will run after this review (PR touches UI code)

builder-io-integration · 2026-08-13T11:16:23Z

+export function markBuilderHostEmbed(value: boolean): void {
+  if (value) serverConfirmedHost = true;


🟡 Scope Builder-host confirmation to the current design

markBuilderHostEmbed(true) sets the module-global serverConfirmedHost permanently, and isBuilderHostEmbed() returns it before checking the current design key or token. After opening one Builder-host design, an SPA navigation to another embedded design can incorrectly enable host-owned chat/UI behavior and send that design's context or source handoffs to the previous embedding host. Scope the confirmation to the current design id (and clear it when the design changes), or derive it from the current design's linkage/token.

Additional Info

Found independently by 2 of 3 parallel reviewers; distinct from the listed open comments.

sanyamkamat · 2026-08-17T13:52:20Z

    },
  },
  multiScreenCanvas: {
+    preparingLiveEditor: "正在準備即時編輯器…",


is it not required in other locales?

design inside fusion

8154996

builder-io-integration Bot reviewed Aug 12, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

merge main

8d1081a

This comment was marked as outdated.

Sign in to view

fixes

0a90600

This comment has been minimized.

Sign in to view

This comment was marked as outdated.

Sign in to view

fix

61318c6

builder-io-integration Bot reviewed Aug 12, 2026

View reviewed changes

fix

1ea2f10

builder-io-integration Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread templates/design/actions/open-builder-visual-edit.ts Outdated

Comment thread templates/design/app/pages/DesignEditor.tsx

steve8708 approved these changes Aug 12, 2026

View reviewed changes

changes

edd7625

builder-io-integration Bot reviewed Aug 13, 2026

View reviewed changes

sidmohanty11 added 4 commits August 13, 2026 13:20

merge main

d64be41

changes

37651ae

Merge branch 'main' into design-inside-fusion

4d1ce87

fixes

3394701

sanyamkamat reviewed Aug 17, 2026

View reviewed changes

steve8708 approved these changes Aug 17, 2026

View reviewed changes

sidmohanty11 added 4 commits August 18, 2026 12:15

remove minting, make it work like a shell

f0cfca6

remove

17dd649

updates

d4272c4

fix

136f5e7

This comment has been minimized.

Sign in to view

sidmohanty11 merged commit 3c54d4e into main Aug 18, 2026
97 checks passed

sidmohanty11 deleted the design-inside-fusion branch August 18, 2026 12:26

		export function markBuilderHostEmbed(value: boolean): void {
		if (value) serverConfirmedHost = true;

Uh oh!

Conversation

sidmohanty11 commented Aug 12, 2026

Uh oh!

builder-io-integration Bot left a comment

Choose a reason for hiding this comment

Code Review Summary

Key Findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

builder-io-integration Bot Aug 12, 2026

Choose a reason for hiding this comment

🟡 Persist live layer renames through the source handoff

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment was marked as outdated.

Uh oh!

github-actions Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Visual recap — generation failed

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment was marked as outdated.

Uh oh!

builder-io-integration Bot left a comment

Choose a reason for hiding this comment

Incremental Code Review Summary

New Findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

builder-io-integration Bot left a comment

Choose a reason for hiding this comment

Code Review Summary

New findings

Uh oh!

Uh oh!

Uh oh!

builder-io-integration Bot left a comment

Choose a reason for hiding this comment

Code Review Summary

New findings

Uh oh!

builder-io-integration Bot Aug 13, 2026

Choose a reason for hiding this comment

🟡 Scope Builder-host confirmation to the current design

Uh oh!

Uh oh!

sanyamkamat Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

github-actions Bot commented Aug 12, 2026 •

edited

Loading