An agent-native, multi-tenant code CMS for web projects.
TheWebBlock lets indie makers run websites, blogs, and interactive apps where AI agents edit project code and structured content directly. Every agent run is confined to a single project by kernel-enforced sandboxing, auto-publishes versioned static builds upon completion, and integrates with host-managed platform services.
- Agent-Native Editing: AI agents edit project code and structured content files directly within the project tree.
- Kernel-Enforced Confinement: Every agent run executes inside a dedicated Linux sandbox process (
sandboxd) restricted by Landlock, seccomp filters, cgroups v2, and network namespaces. - Atomic Static Publishing: Completed agent edits build into static releases that are hashed, stored, and activated atomically with crash-safe database tracking.
- Composable Capability Grants: Projects expand functionality through platform-defined capability grants (e.g., devlogs, custom styling) rather than rigid project types.
- Hosted Platform Services: Dynamic functionality—including comments, forms, user saves, and leaderboards—is handled by host platform services with tenant-scoped API keys.
- OIDC Authentication: Secure authentication with PKCE verification and
__Host-scoped session cookies.
TheWebBlock is organized as a monorepo containing TypeScript packages and a Rust sandbox runner:
| Directory | Language | Description |
|---|---|---|
contracts/ |
TypeScript | Protocol contracts, Zod schemas, state machines, and sandbox protocol specs. |
server/ |
TypeScript | Fastify API server, worker queues, OIDC auth, project persistence, static file server, and SSE live events. |
apps/dashboard/ |
TypeScript | Web console dashboard interface. |
crates/sandbox-runner/ |
Rust | High-performance sandbox daemon (sandboxd) enforcing Landlock, seccomp, and cgroup resource limits. |
- Node.js:
24.18.0(managed via.node-version) - npm:
11.16.0 - Rust:
1.97.1(managed viarust-toolchain.toml) - Git:
2.53.0or higher - PostgreSQL: Required for running integration tests and production server persistence.
Verify local toolchain setup:
npm run check:toolchainsInstall Node.js dependencies across all workspaces:
npm installCompile TypeScript packages and Rust workspace:
# Build TypeScript workspaces
npm run build
# Build Rust sandbox runner
cargo build -p sandbox-runner --lockedRun workspace boundary validation, Biome formatting, linting, and TypeScript typechecking:
npm run check:workspace-boundaries
npm run check:format
npm run lint
npm run typecheckThe test suite is organized into unit, integration, security, and migration checks:
# Run all workspace unit tests
npm run test:unit
# Run PostgreSQL integration tests (requires TEST_DATABASE_URL environment variable)
TEST_DATABASE_URL="postgresql://thewebblock:thewebblock@127.0.0.1:54329/thewebblock_test" npm run test:integration
# Run database migration verification
TEST_DATABASE_URL="postgresql://thewebblock:thewebblock@127.0.0.1:54329/thewebblock_test" npm run test:migrations
# Run security and tenant isolation tests
TEST_DATABASE_URL="postgresql://thewebblock:thewebblock@127.0.0.1:54329/thewebblock_test" npm run test:security
# Run Rust sandbox runner confinement tests
npm run test:sandbox:adversarial
# Run publishing crash-matrix recovery tests
TEST_DATABASE_URL="postgresql://thewebblock:thewebblock@127.0.0.1:54329/thewebblock_test" npm run test:publication:crash-matrixThis project is licensed under the Elastic License 2.0 (ELv2).