Nexus
Resources, communication, and access boundaries
Understand trusted local pages, resource isolation, and remote page restrictions to identify supported use cases.
Trust depends on loading method and current document
A file being local does not automatically grant Blender access. The framework supplies communication only to the client's trusted local document. Reloads and navigation affect identity.
| Source or boundary | Capabilities and limits |
|---|---|
| Trusted local add-on page | Loaded through the supported local entry, with this client's public actions, state, events, resources, and interactions. |
| Ordinary browser preview | Frontend checks only, no host bridge. The website does not connect to local Blender. |
| Loopback development server | Frontend development display without an application bridge. |
| Remote page or navigation to an external address | Ordinary-page display within existing limits, without local add-on APIs. Remote bridging is unsupported. |
Local documents use a virtual localhost origin intercepted inside the runtime, not an author-run HTTP server. This differs from a loopback development server; a localhost-looking address alone does not establish permissions.
Page files and runtime resources are managed separately
Local paths resolve within registered roots and must remain inside them. HTML, styles, and helpers use their respective relative paths, not .. traversal into other add-ons. Equal root names do not share resources across clients/add-ons.
Publish runtime images, files, and meshes through resource APIs. Pages obtain references, then content or temporary URLs. One-time capabilities use the nexus-web resource channel, not arbitrary disk/script/cross-add-on access. See Resources and file configuration.
Trusted local pages still have script constraints
Current policy allows external scripts/styles and corresponding HTTP(S) resources/connections, plus inline styles. Inline scripts, eval, iframe/object embedding, form submission, and external base URLs are prohibited. Service, browser, and system rules also govern network access.
Loadable network code is not necessarily safe. Manage third-party scripts as trusted dependencies. Source isolation does not audit their content or imported files. Cross-add-on isolation does not remove risks introduced by the add-on itself.
For frontend structure, see Local pages and resource paths. Fix script organization for CSP errors rather than weakening the whole policy.
Uploading is not writing to an application target
Uploads stage bytes temporarily. Python actions need resource-write permission to consume them, and temporary files exist only for that action. Guarded writes require matching targets/snapshots. Pages cannot choose arbitrary object names or Python paths as write destinations.
These checks do not replace business validation. Validate input, allowed targets, and results. Page-supplied user-initiation claims are not independent authorization. Check denied contracts rather than deleting protective fields.
Import/export does not expose real disk paths
Pickers, desktop drops, and paste deliver references. Save destinations are opaque references too. Inspect individual results; picker completion is not task success.
Type and budget limits constrain inputs but do not audit content security. Uploads, leases, URLs, and destinations have different lifetimes. Do not reuse old capabilities after document invalidation. Cancellation is normal, not a reason for endless retries.
For supported methods, see File import and File export.
Capabilities you must not infer
- Ordinary pages cannot acquire or forge a local application bridge.
- Do not read other add-ons' resources or persist old document references as file addresses.
- Cookie/cache sharing scope is not resource authorization.
- Changing identities, disabling protection, or constructing internal URLs cannot make unsupported remote integration a supported feature.
For API limits, check Action troubleshooting or Resource troubleshooting, preserve the actual rejection, and let the author adjust application behavior.