[danielehrhardt]

Artifacts: dashboards and small apps you change by chatting

Agents can now build small web apps, like a sales dashboard, a KPI tracker, a deal board or a price calculator, as artifacts. An artifact opens next to the chat, you use it right there, and you change it by writing to the agent. Every code change is a version you can go back to. Refresh asks the agent to fetch fresh data.

Core

• Migration 102 adds artifacts (current HTML, JSON data, version, refresh prompt, pin, agent, chat, workspace) and artifact_versions (the code of the last 50 versions with a note). Both are shared in device groups, move with their workspace, and are included in backups.
• MCP tools for every agent in chats (not in condition checks, dreams, connected apps or runners): artifact_create, artifact_update (whole html or exact find/replace edits, data, refreshPrompt, note), artifact_get, artifact_list. Agents change their own artifacts, managers anyone's. The system prompt gets an Artifacts section.
• /api/artifacts: list, get, patch (title, pin, refresh instructions), PUT /data (saves from the app), versions, restore, message (to the artifact's chat, or a new chat when that one is gone or on a runner), refresh (skipped while the agent already works there), start (new chat that builds one). All routes are classified for Godmode Cloud.
• Sandbox: GET /api/artifacts/frame serves a page with no data. Its own CSP makes it a sandbox with an opaque origin: scripts, styles and fonts from https CDNs, connect-src https: wss: (never the core), no same-origin, no modals, form-action 'none'. The app posts the document into it. A srcdoc frame wouldn't work, because it inherits the app's script-src 'self'. Tauri CSP gets frame-src for the local core.

App

• Bridge (window.godmode): data, onData, setData (saves close together are coalesced, with no stale echo), ask and refresh (both wait for the human's click, and the agent is told the text came from the page), theme/onTheme and --gm-* CSS variables for light and dark. Links open in the default browser. Script errors show a bar that asks the agent to fix them, with the error passed as fenced data.
• In the chat: a card for each create or update, plus a side panel that opens by itself when the agent builds or changes an artifact. The panel has preview, code and data tabs, a version picker with restore, refresh, editable refresh instructions, full screen, download as one HTML file, pin and delete.
• Artifacts page: a gallery with live previews that load as they scroll into view, a "describe it" composer, an agent picker and six starters (sales dashboard, KPI tracker, deal pipeline, budget planner, content calendar, price calculator). /artifacts/:id shows one artifact full screen with a line to ask for changes.
• Nav: "Artifacts" (shown as "Dashboards & apps" in easy mode).

Tests

• packages/core/test/artifacts.test.ts (16 tests): tools, edits, versions and pruning, ownership, the HTTP routes, change requests and refresh through the chat, a refresh skipped while the agent is busy, a fallback chat, the sandbox page headers, and a real run whose artifact_create call lands in the chat (new ARTIFACT_FROM: directive in the fake Claude).
• Full core suite: 2,130 pass. The 5 failures are the known environment failures on this Mac and fail on main too (maintenance, mods x2, tool updates x2).
• Typecheck passes for shared, core, desktop, cloud and mobile. The desktop build passes.
• Manual checks with a sandbox core, vite and Playwright:
  • The agent builds an artifact, and the panel and its card render.
  • ask shows the confirm bar.
  • A change request goes through the chat, and the open panel reloads to v2 by itself.
  • Dark theme reaches the frame.
  • 5 rapid setData calls become one save.
  • localStorage and fetches to the core are blocked inside the frame.