Simon Willison’s Weblog

Subscribe
Atom feed for datasette-apps Random

9 posts tagged “datasette-apps”

Use Datasette Apps to build HTML+JavaScript apps that live inside Datasette.

2026

Release datasette-apps 0.2a0

Changes that improve Datasette Apps when created and edited using Datasette Agent:

  • New app_debug() tool allowing agent to open an app (invisibly) and test it using JavaScript. #33
  • New app_list() tool for listing apps the user has permission to edit, so the agent can edit them. #36

The app_debug() tool is pretty neat: it works by displaying the app in a opacity: 0 iframe with pointer-events: none (so it can't be seen or interacted with) and then executing agent-provided JavaScript inside that sandboxed iframe. This means the agent can smoke test that the app is working and even do things like measure the dimensions of different elements.

This uses the new context.browser_task() mechanism added in datasette-agent 0.4a0.

1st Aug 2026, 9:23 pm · iframes, datasette, datasette-apps
Release datasette-apps 0.1a4 — Apps that live inside Datasette
14th Jul 2026, 11:44 pm · datasette, datasette-apps

DOOMQL (via) Peter Gostev built this using GPT-5.6 Sol. This is a lot of fun:

DOOMQL started with a deliberately unreasonable question: what if SQLite were the game engine, not merely the place where a game stores data?

The result is a small, original Doom-like game in which SQL owns movement, collision, enemies, combat, progression and every RGB pixel on screen.

It's implemented as a Python terminal script - I tried it out like this:

cd /tmp
git clone https://github.com/petergpt/doomql
cd doomql
uv run host/doomql.py

Screenshot of a macOS terminal window titled "doomql — python3.14 ◂ uv run host/doomql.py — 134×31" showing a retro Doom-style game rendered as text-mode pixel art. The scene is a pixelated first-person corridor with gray paneled walls, dark red doors on the far left and right, a floating cyan-and-gold coin pickup on the right side, a white crosshair near the center, and a dark weapon barrel rising from the bottom center. A status bar below the scene reads "HP 100/100 AMMO 037 SCORE 00225 INDEX MISSING TICK 0028450", followed by an orange line "FIND THE INDEX TOKEN" and a cyan controls line "WASD MOVE J/L OR ARROWS TURN SPACE FIRE E USE P PAUSE CTRL-C EXIT".

Here's the huge SQL query that implements a full ray tracer in SQLite using a recursive CTE.

Running the above script creates a /tmp/doomql/.doomql/doomql.sqlite SQLite database, which you can explore using Datasette like this:

uvx --prerelease=allow  --with datasette-apps datasette \
  /tmp/doomql/.doomql/doomql.sqlite \
  -p 4444 --root --secret 1 --internal internal.db

The --with datasette-apps option installs the new Datasette Apps plugin, which supports creating custom HTML+JavaScript apps that can run SQL queries directly within the Datasette interface.

I created a new app, pasted the copy-paste prompt into Claude chat (Fable 5) and told it:

Build an app that displays the current state of the screen using the frame_pixels view with its x, y, r, g, b columns. have it refresh once a second.

This got me a working HTML+JavaScript app inside Datasette that could reflect the current state while I played the game in my terminal. Then I added:

add a minimap

And now my Datasette App looks like this:

Screenshot of a dark-themed web app running a retro Doom-style game rendered from SQL queries. The page header reads "DOOMQL" with buttons "All apps", "Edit app", "Pin", and "Full screen". Inside the game panel, the title "DOOMQL" sits above the subtitle "auto-refreshing once a second · frame and tactical map straight from SQL". The left side shows a pixelated first-person corridor view with gray walls, dark red doors, a floating cyan-and-gold coin pickup, a white crosshair, and a weapon barrel at bottom center. A status bar below reads "HP 100/100 AMMO 037 SCORE 00225 INDEX MISSING TICK 0027847". On the right, a panel titled "TACTICAL MAP" shows a top-down grid map with a player triangle, a red enemy circle, yellow pickup dots, red wall markers, and a green exit square, with a legend reading "you", "enemy", "pickup", "locked door", "door", "exit". Below the game view, an orange banner reads "FIND THE INDEX TOKEN", followed by the cyan line "READ-ONLY VIEWER · SELECT x, y, r, g, b FROM frame_pixels". At the bottom, a green "RUNNING" badge appears beside the stats "160×54 · 8,640 pixels · 3 hostiles · query 89 ms · refreshing every 1 s".

Here's the HTML app code - paste that into your own Datasette instance (using the uvx --with datasette-apps recipe from above) to try it yourself.

# 13th July 2026, 10:34 pm / games, sql, sqlite, ai, datasette, generative-ai, llms, ai-assisted-programming, gpt, datasette-apps

Datasette Apps: Host custom HTML applications inside Datasette

Visit Datasette Apps: Host custom HTML applications inside Datasette

Today we launched a new plugin for Datasette, datasette-apps, with this launch announcement post on the Datasette project blog. That post has the what, but I’m going to expand on that a little bit here to provide the why.

[... 2,301 words]

11:58 pm / 18th June 2026 / iframes, javascript, projects, sandboxing, ai, datasette, generative-ai, llms, ai-assisted-programming, content-security-policy, datasette-apps
Release datasette-apps 0.1a3
  • Fixed a bug where users without the create-app permission could still create apps. #27
  • Fixed a bug where it was impossible to grant permission to edit an app to users who were not the app's owner. The rules for edit/delete are now the same as view: if the app is private only the owner can modify it, otherwise permission is controlled by Datasette's regular permission system. #29
15th Jun 2026, 8:25 pm · datasette, datasette-apps
Release datasette-apps 0.1a2
  • Custom network/CSP origins for apps are now guarded by a new apps-set-csp permission, with an optional allowed_csp_origins plugin allow-list for non-privileged users. The Datasette Agent app creation tool enforces the same rules. #24
  • Stored query picker now supports keyboard navigation and shows the three most recent accessible stored queries when focused.
  • #fragment links inside apps are no longer intercepted by the external-link confirmation modal. #23
  • Fixed link confirmation modal and logging panels in ?full=1 full-screen mode. #26
15th Jun 2026, 5:26 pm · datasette, datasette-apps
Release datasette-apps 0.1a1
  • Switch to using MessageChannel() to communicate between parent and child frames. #15
  • Now registers tools to Datasette Agent can create and modify apps. #16
  • SQL queries and console.log() executed by an app are now shown in a collapsible logging panel. #20
  • Full screen mode for apps. #21
  • Performance optimizations for the create/edit pages. #22
9th Jun 2026, 4:26 pm · datasette, datasette-apps
Release datasette-apps 0.1a0

First alpha release.

4th Jun 2026, 10:44 pm · datasette, datasette-apps
Research Can JavaScript Escape a CSP Meta Tag Inside an Iframe?

In trying to build my own version of Claude Artifacts I got curious about options for applying CSP headers to content in sandboxed iframes without using a separate domain to host the files. Turns out you can inject <meta http-equiv="Content-Security-Policy"...> tags at the top of the iframe content and they'll be obeyed even if subsequent untrusted JavaScript tries to manipulate them.

3rd Apr 2026, 4:05 pm · iframes, javascript, sandboxing, security, content-security-policy, datasette-apps

Related