SDK v2 Phase 5 (2/3): net.fetch — external services for backendless apps
Radin committed
- Author
- Radin · radin@coline.appAug 10, 2026 at 19:38
- Committer
- Radin · radin@coline.appAug 10, 2026 at 19:38
- Parents
- b70ff4cb544b
SDK v2 Phase 5 (2/3): net.fetch — external services for backendless apps
Answers 'what if an app needs to talk to something external?' without
weakening the sandbox. Guest code still cannot make a network request
(connect-src 'none' stands); instead the coline.net.fetch capability
crosses the bridge like everything else, and COLINE makes the request:
1. Permission: the install must be granted network.external (new vocab
entry with consent copy).
2. Allowlist: the target host must match manifest.network.allowedHosts
(exact or *.wildcard). HTTPS only, redirects blocked, 15s timeout,
2MB response cap, set-cookie stripped.
3. Credential injection (plan §12.3): header values may carry
{{secret:KEY}} placeholders resolved server-side from the install's
encrypted secrets — app code composes authenticated requests without
ever holding a credential, on every execution path (sandbox, hosted
Dynamic Worker, external backend alike).
Wired end to end: SDK types + HTTP transport + guest bridge + operation
table (read-class: the allowlist and permission are the boundary;
outward-reaching Kairo tools still declare effect 'external' for
approval gating) + capability-ops dispatch. The hosted bootstrap's
path-proxy picks it up with zero changes. 81 sdk tests green.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>5 files changed+57−0