230
webview
also WKWebView, WebView2
A browser inside the app. Remote pages do not get the app’s files or IPC.
What is webview?
A webview embeds web content in a native window. Your own UI can have a narrow bridge. A webview that loads arbitrary URLs is a browser: no Node, no broad IPC, no shared cookie jar with the shell unless you mean it. WKWebView and WebView2 are the OS controls. An old Electron `<webview>` tag with node is the dangerous one.
Why does webview matter when vibe coding?
The draft loads the marketing site, the docs, or user-supplied HTML in the same window as the app and shares the preload. The remote page can then call the file bridge.
How do you do webview?
Split origins. App UI gets the bridge. Remote content gets a separate webview with no bridge, no node, and a locked navigation handler.
How do you ask a model for webview?
Load (remote URL) in a webview with no Node and no IPC. Do not share the app preload or cookies with it. Block navigation off (origin).
What goes wrong with webview?
Disabling web security so a local file can call an API. That flag removes the boundary you needed.