RCWeb Apps

AI app development without backend drag

RCWeb: A Sandbox for AI-Built Collaborative Apps

RCWeb gives an AI model a deliberately small place to build something surprisingly social: a browser app that can coordinate phones, displays, laptops, kiosks, and other browsers in real time.

Small enough to fit in context. Powerful enough to fill a room.

Each RCWeb App is an independent bundle of HTML, CSS, and vanilla JavaScript. A permanent communications layer supplies virtual rooms, WebSocket transport, client identity, targeting, and reconnect behavior. The app supplies the idea. This separation lets a coding model concentrate on the experience instead of first inventing a backend, protocol, deployment pipeline, and dependency graph.

New game mechanics, collaborative tools, controls, visualisations, and experiments can be added without a new server endpoint or application-specific server release. For app-only work, edit the files and refresh the browser.

Static app files Virtual rooms Targeted function calls Browser-owned state No build system

The sandbox Models & context Isolation & security Development loop


AI-Generated and AI-Powered Are Different

AI-Generated Apps

An AI coding model designs and implements the app, but the finished experience runs as ordinary, deterministic browser code. It needs no model, inference service, token budget, or AI account at runtime. Most of RCWeb's catalogue fits this description.

AI-Powered Apps

The running app deliberately calls a language, vision, speech, or media model. RCWeb still handles collaboration between browsers; the model becomes one bounded capability inside the experience, not the transport, room manager, or source of truth for every event.

That distinction matters. RCWeb captures the productivity of AI-generated software without forcing every user interaction through probabilistic inference. When runtime AI is useful, it can be added at a narrow, explicit boundary while ordinary code continues to own routing, validation, state, rate limits, and failure handling.

The Sandbox: Four Stable Layers

The RCWeb server is deliberately generic. It does not need to understand a score, a brush stroke, a slide, a player, or a prompt. It connects browsers and forwards commands; each browser page interprets the small message vocabulary defined by its app.

1App Capsule

One directory contains the app's page, styles, script, metadata, and optional local assets. Its DOM, JavaScript globals, and runtime state live in its own browser page.

2Room

A room ID in the URL creates a lightweight collaboration scope. Only connected clients in that room participate in its live traffic.

3Broker

The Java host maintains WebSockets and routes payloads by app name, client ID, wildcard, and allow or deny list. It does not execute app JavaScript.

4Browser

Matching pages receive a remote event, validate it, update local state, and render. The browser owns the experience and its normal permission boundaries.

One Transport, Unlimited App Vocabularies

Apps normally expose a small global callback API and use rc.sendFunctionCall to invoke it on selected peers. The server routes the call without knowing what it means:

var wall = {
    addIdea: function (senderId, text) {
        // Validate the remote arguments, update state, then render.
    }
};

rc.onConnected = function () {
    rc.sendFunctionCall("idea-wall", "wall.addIdea", rc.client, "Build together");
};

rc.connect();

A quiz can define submitAnswer, a game can define jump, and a presentation can define showSlide. All three use the same server contract. A new app can invent its own message vocabulary without requesting or deploying a server-side API change.

The server-side API can remain stable indefinitely. The useful innovation happens in browser code and app-level function calls. RCWeb's backend only needs to keep doing a small number of durable jobs well: serve files, establish identity and room context, maintain connections, route messages, and support shared file transfer.

Collaboration Is a Primitive, Not a Feature Request

Many conventional prototypes begin as single-user pages and acquire collaboration later through a database, accounts, polling, conflict rules, and bespoke APIs. In RCWeb, the first prototype already knows how to find and address other browsers.

Viewer + Controllers

A large display owns the shared scene while phones send compact intents. Each device gets an interface suited to its role, and private responses can target one controller.

Games, presentations, dashboards, installations

Symmetric Peers

Every browser runs the same app and exchanges events or state snapshots. Join and reconnect flows let late clients catch up without making the server understand the data.

Chat, notes, drawing, voting, group instruments

Mixed Roles

App names and client IDs let one room contain displays, producers, moderators, players, observers, and AI-assisted workers while keeping commands precisely targeted.

Workshops, classrooms, performances, control surfaces

Why Coding Models Thrive Here

Context Has a Natural Boundary

A model rarely needs the whole RCWeb repository. A focused task can be described by the communications guide, the four or five files belonging to one app, and one nearby example with the same collaboration pattern. This is a high-signal context packet: the model can often see the complete behavior it is changing rather than guessing through framework layers, generated code, package internals, and distant services.

Plain, Durable Materials

  • HTML describes the interface and content.
  • CSS describes the visual system and responsive layout.
  • Vanilla JavaScript owns behavior and state.
  • comms.js supplies the shared runtime contract.

There is no framework-specific component language for the model to imitate and no generated bundle hiding the code that users actually run.

A Useful Context Recipe

  1. State the user experience and target devices.
  2. Provide RCWeb's communication and compatibility rules.
  3. Include the complete target app and its closest sibling.
  4. Give concrete success criteria and test room URLs.
  5. Return browser evidence and errors for the next iteration.

This context is portable between model families and remains understandable to a human reviewer.

Model Choice Stays Open

RCWeb does not couple source code to a particular AI vendor. OpenAI GPT, Google Gemini, Anthropic Claude, and other capable coding models can work on the same plain-text files. A model can start an app, another can review its protocol, and a later model can repair a visual defect without translating the project into a proprietary agent format.

The catalogue has been shaped by more than 1.5 billion development tokens across multiple generations of AI coding models. That history is valuable not merely as volume, but as repeated evidence: tightly bounded apps, explicit conventions, and browser feedback allow models to improve real interactive software over many iterations.

Short Feedback Loops Produce Better Code

There is no app compilation step and no development server to rebuild. A model can edit a file, refresh two browsers in a valid test room, inspect desktop and phone layouts, reproduce a reconnect, and correct the result. Failures are visible in the receiving page's console and remain close to the code that caused them. The loop is quick enough that visual and multi-client verification can be part of development rather than a final ceremony.

Isolation, Security, and Honest Trust Boundaries

RCWeb is a productive sandbox for small collaborative apps because it separates application experimentation from the server process. It is not a claim that arbitrary participants may safely execute arbitrary code together. The boundaries are clear enough for models and humans to reason about explicitly.

Process Isolation

App JavaScript executes in browser pages, never inside the Java server. A rendering exception or bad state transition can break that page, but it does not become application code running in the host process.

App Isolation

Each app has its own files, URL, DOM, globals, and state. Changes are surgical: an experiment in one app does not require rewriting a shared frontend or migrating every other app.

Room Isolation

The broker distributes live commands within one room, then applies app and client targeting. Traffic from an unrelated room is not part of that collaboration session.

Failure Containment

The server does not parse an app's domain objects or maintain its game state. App-level schema and logic failures stay at the edge, where the browser can report them visibly and reload cleanly.

The Collaboration Channel Carries Trusted Code

RCWeb intentionally delivers JavaScript calls to matching browser pages. A room ID scopes routing, but should not be treated as user authentication or permission to mix hostile participants. Apps should use trusted rooms, expose the smallest practical remote API, prefer rc.sendFunctionCall over hand-built JavaScript, validate every remote argument, render user text with textContent, and keep secrets out of browser source.

This is a strength when used deliberately: the trust model is compact and visible. An AI model can be instructed to defend a handful of callback boundaries instead of trying to infer security rules scattered across controllers, REST endpoints, serializers, queues, and database policies.

What the Browser Sandbox Contributes

RCWeb Apps inherit ordinary browser protections around the local operating system, device capabilities, and user permissions. Camera, microphone, sensors, clipboard, storage, and cross-origin network access remain subject to browser rules. Those protections complement RCWeb's app and room boundaries; they do not replace input validation or access control where an app needs it.

Runtime AI Without Letting the Model Run the System

An AI-powered RCWeb App can send a carefully selected prompt or media item to a model and share the result with the room. The robust pattern is a deterministic shell around a probabilistic capability:

Before Inference

Ordinary code authenticates where required, limits input size and frequency, selects only necessary context, and keeps provider credentials outside the browser.

During Inference

The model receives a bounded task. Provider choice, model version, and prompt strategy can change without altering RCWeb's room or messaging protocol.

After Inference

Code validates and labels the result, handles timeouts and refusals visibly, and decides which app or client should receive it. The model does not silently become the router or authority.

This architecture also protects context budgets. A runtime model need not receive every WebSocket event or the server's internal state. The app can construct the smallest context needed for one useful decision, while the browser keeps immediate interaction responsive and deterministic.

A Development Loop Designed for Iteration

1Describe the Room

Define who has a phone, who watches a display, what state is shared, and what should happen when a client joins late or reconnects.

2Generate the Capsule

The model creates or edits the app's HTML, CSS, JavaScript, and documentation while following the stable communication and browser-compatibility contract.

3Open Two Browsers

Load the relevant apps with the same room ID. Exercise targeting, touch controls, layout, late join, network recovery, and error reporting on the devices the experience is meant to use.

4Refine by Evidence

Return screenshots, console errors, and observed behavior to the model. Refresh after each app-only edit; promote the result when the experience, not merely a test, is convincing.

The Few RCWeb Rules Worth Keeping in Every Model's Context

  • Load /assets/core/comms.js, define remote APIs and hooks, then call rc.connect().
  • Wait for rc.onConnected() before using room, client, and WebSocket values supplied by setup.
  • Keep remote callbacks globally reachable and validate their arguments at the boundary.
  • Prefer targeted rc.sendFunctionCall messages to raw constructed JavaScript.
  • Synchronise state for late joiners and reconnecting symmetric peers.
  • Debounce high-frequency typing, pointer, sensor, and game-control traffic.
  • Use conservative ES5-compatible JavaScript and broadly supported CSS for older displays.
  • Test the shared experience at phone, portrait display, and landscape display sizes where relevant.

The Right Scale for AI-Native Software

RCWeb is not trying to turn every enterprise backend into generated browser code. It is optimised for something more focused and often more delightful: a small collaborative communication app with a clear audience, a small state model, and an immediate shared result.

An Excellent Fit

Shared-screen games, workshop tools, classroom activities, audience participation, phone remotes, live dashboards, collaborative canvases, installations, ambient displays, prototype interfaces, and model-assisted group experiences.

Add Purpose-Built Services When Needed

Durable records, regulated data, strong identity, financial transactions, long-term permissions, private model credentials, and authoritative cross-session state deserve an explicit trusted service. RCWeb can remain the collaborative browser layer without pretending those concerns do not exist.


The practical result

A Model Can Spend Its Context on the Idea

RCWeb removes the repeated infrastructure work while preserving the web's simplest materials. The server stays small and stable. Each app stays understandable and replaceable. Collaboration is available from the first refresh. That combination makes RCWeb an unusually strong sandbox for turning an AI-generated idea into a real multi-device experience.

Explore RCWeb Apps Read the Developer Guide

DocumentationServer TelemetryServer StatsServer HTTP LogServer WebSocket Log