Preview and builds

The preview route returns HTML only after esbuild produces a bundle. That HTML runs in an iframe with allow-scripts and without allow-same-origin, so the preview cannot read the parent app’s cookies.

The BuildItOmi server bundles the files. It does not execute the generated application. Imports are limited to React and relative files.

This is a local convenience, not the production sandbox. Before other people use the product, builds should move to an isolated runner that does not hold SaaS credentials. See the architecture notes in the repository.