Repository navigation
feat(mcp-apps): bundle pinned chart, icon, motion and 3D libraries - #6463
Merged
Merged
Conversation
Apps built in OpenWork could only use injected React, so charts, icons, animation and 3D had to be hand-drawn or were impossible. With the mcpAppLibraries feature on for the editor, an App may import lucide-react, recharts, motion/react, and three with OrbitControls. Den bundles its own pinned copy into the App's hash-authorized script; authors never install a package or load a CDN, and an App carries only what it imports. One catalogue (generated-app-libraries.ts) drives the compiler's import policy, prepare_app's nextSteps and the build errors, which name the import to change. Library code reaches React through checked modules, so elements a library renders pass the same element and attribute checks as authored JSX. With libraries on, Apps may also draw inline SVG (minus elements that load or rewrite content) and use requestAnimationFrame. The App CSP is unchanged: no network, data: images only. Apps with libraries may compile to 1536 KiB and store 2 MiB; the desktop host now reads resources up to the same bound. Apps without libraries build the same bytes as before and keep the 768 KiB and 1 MiB limits. Signed-off-by: Jalil <reachjalil@gmail.com>
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
reachjalil
enabled auto-merge (squash)
October 24, 2026 01:16
Contributor
Warden: approvedNo high or medium security findings and no confidentiality findings. Reviewed |
![diff-warden[bot]](https://avatars.githubusercontent.com/u/118544361?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Warden clearance. Complete security and confidentiality review of 0c9a2f2e342777d9dac0109d3c522c95d631dd05 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this about?
Apps built in OpenWork can use a small set of libraries for icons, charts, animation and 3D, plus SVG drawing, behind one feature flag.
What problem does it solve?
Agents could only write plain React, so dashboards lacked real charts and icons, and 3D or animated views were impossible.
What was the situation before?
Any import failed with "cannot use module imports or reexports", and
<svg>was refused.How is this implemented?
ee/apps/den-api/src/generated-app-libraries.tslists the libraries:lucide-react,recharts,motion/react,threeand its OrbitControls. All are pinned in den-api'spackage.json.mcpAppLibraries(default off) is read for the editor on every create and update. When it is on,prepare_applists the imports and how to use each one.apps/serverreads resources up to that bound. Builds without libraries are byte-identical to before.What else changed?
Release note
Apps built in OpenWork can show charts, icons, animation and 3D views when built-in libraries are turned on for you.
Evidence
No E2E.
ee/apps/den-api/test/generated-app-libraries.test.ts: before, each library import is refused; after, each builds into a self-contained App, and off builds are unchanged.