function appSandboxFigure(host) {
ensureStyles();
var shell = document.createElement('div');
shell.className = 'mf-shell';
shell.innerHTML = [
'
Rendering an Interactive Interface negotiate, review, then render or fall back
',
'
',
'',
'
',
'
A tool\'s ui:// resource only becomes a sandboxed app after the host checks its mime type and CSP origins against its own allowlist; failing either check, or never declaring the extension at all, routes to the same text fallback every tool already returns. An app-initiated tool call still crosses the host\'s consent gate before it reaches the server as an ordinary tools/call.