From cd6bfb9efba32df2850d55c89caea72a631aa726 Mon Sep 17 00:00:00 2001
From: ancientcomputing <benchong408@gmail.com>
Date: Mon, 12 Oct 2026 20:09:51 -0700
Subject: [PATCH 1/2] sdk-guide: MCP Apps sandbox, layer by layer (CSP
 intersection, content rules, sandboxed iframe, pinned navigation)

---
 docs/sdk-guide.md | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/docs/sdk-guide.md b/docs/sdk-guide.md
index 13f2cab..c87c466 100644
--- a/docs/sdk-guide.md
+++ b/docs/sdk-guide.md
@@ -706,6 +706,36 @@ policy allows them. Shared context reaches the model with the next `respond` / `
 turn — a turn run on `languageModelSession` doesn't send it ([Running a turn](#running-a-turn-and-when-to-use-languagemodelsession)). `ConfirmingToolAuthorizer` remembers the user's answer per view and tool, so a
 polling view asks once (destructive calls ask each time).
 
+**The sandbox, layer by layer.** A view is HTML and script from someone else's server, so
+`MCPAppViewController` contains it in layers, each of which holds even if the one above it failed:
+
+1. **CSP, declared ∩ allowed.** A server's `_meta.ui.csp` is a request, not a grant: the CSP
+   actually served on the view's document is each declared origin list intersected with your
+   `MCPAppsSandboxPolicy` (`allowedConnectOrigins`, `allowedResourceOrigins`,
+   `allowedFrameOrigins`), so a server update can never widen what your app lets a view reach.
+   With the default `.closed` policy that is `default-src 'none'`, `connect-src 'none'`,
+   `frame-src 'none'`, plus `base-uri`, `form-action` and `object-src 'none'`; inline script and
+   style run, nothing loads from the network. Server-supplied origins are validated strictly
+   (`https://` / `wss://`, a DNS host, optional port) before they go into the header, and
+   `baseUriDomains` is never granted. Read `controller.effectiveCSP` for what a view really got.
+2. **A network block under the CSP.** A `WKContentRuleList` on the whole web view blocks every
+   http(s), ws(s) and ftp load outside the effective origins — so even a mis-served CSP lets
+   nothing out.
+3. **A sandboxed iframe.** The view runs in an `<iframe sandbox="allow-scripts allow-forms">`
+   inside a small relay page — the spec's arrangement: the view sees a normal `window.parent`, but
+   runs in an opaque origin with no cookies or storage. `allowsSameOrigin: true` adds
+   `allow-same-origin` for a trusted view that needs `localStorage`; it is off by default.
+4. **Navigation pinned.** Every navigation — link click, redirect, frame — is cancelled unless it
+   is one of this view's own `mcpapp://<token>/` pages. Popups and `target=_blank`, file pickers,
+   camera and microphone, and `alert` / `confirm` / `prompt` are refused. A link the view wants
+   opened goes through `ui/open-link` and your bridge policy.
+5. **One message path.** The native side accepts messages only from the relay page, only
+   JSON-RPC, and every request goes through `MCPAppsBridgePolicy` (and, for tool calls, your
+   authorizer, as above).
+
+The web view uses a non-persistent data store, so no cookies, cache or storage outlive it.
+`isInspectable: true` makes it inspectable in Safari's Develop menu; use it in debug builds only.
+
 ## 4. Keychain storage — automatic isolation, native API, sandbox-safe
 
 > **You don't reach for this — you get it for free.** There is no "set up credential storage"

From 669e12729a0d2b498f36c63f9938df160b14d608 Mon Sep 17 00:00:00 2001
From: ancientcomputing <benchong408@gmail.com>
Date: Tue, 13 Oct 2026 17:52:15 -0700
Subject: [PATCH 2/2] README: Private Cloud Compute works; it needs Apple's
 entitlement

It said PCC was inert because an Apple entitlement was still pending.
Tested in LocalLM Lab 2.0.0-GA (2026-10-13): it works; an app that uses it
needs Apple's Private Cloud Compute entitlement.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index a69ab35..a66fa6c 100644
--- a/README.md
+++ b/README.md
@@ -30,8 +30,8 @@ It's a single Dock app with five panels:
 It began local-only — hence the name — and 1.0 added the hosted providers behind
 the same interface, so "local" is now the default rather than the only option.
 On macOS 26 only Apple's on-device model runs; open-weight (MLX) models and the
-hosted providers need macOS 27. **Private Cloud Compute** is wired up but needs
-an Apple entitlement that is still pending, so it is currently inert.
+hosted providers need macOS 27. **Private Cloud Compute** works too: an app that
+uses it needs Apple's Private Cloud Compute entitlement.
 
 **Product page:** [thisbrain.ai/locallm](https://thisbrain.ai/locallm) — or
 get the app directly: