Bolt.new-style Prompted App Workspace — Custom-Built for Your Market

A generated preview needs an inspectable path back to code

A product manager asks for an internal request portal. The workspace generates a form, starts a preview and displays a convincing success message when the form is submitted. The underlying request may still exist only in browser memory. A Bolt.new-style prompted app workspace must connect the visible experience to editable files, build output and acceptance evidence. The buyer needs to distinguish a rendered prototype from an application that stores data and enforces the intended permissions.

Bolt’s official Code view documentation describes opening and editing project files and switching between code and preview. That supports the category reference: a prompted application workspace with inspectable code. It does not establish affiliation, access to Bolt infrastructure or a guarantee that independently generated applications are ready to ship. App Clone Labs scopes original software around an agreed application envelope and review process.

Choose a supported application envelope before promising generation

Define the first template, language, framework, package policy and runtime before offering a blank prompt box. A static landing page, authenticated portal and application with background jobs have different acceptance needs. State which are supported and how unsupported requests are handled. The workspace should explain a limitation before spending the builder’s allowance on a project it cannot execute, persist or export coherently.

Select one representative application and name its real behavior: inputs, stored records, roles and external actions. Decide whether preview persistence survives a restart and whether email, payment or file storage is simulated. Rehearse a request for an unsupported native capability and a package requiring an unavailable runtime. The response should preserve usable work and explain the missing capability. A generated dependency name is not proof that the platform supports the service behind it.

Prompts should become bounded changes against a known version

Attach each request to a project version and identify the files or behavior it may change. Let builders distinguish a planning conversation from permission to edit or execute. Show the proposed scope and retain the prior version before applying changes. If the prompt asks for a new booking flow, the result should not quietly replace authentication or remove an unrelated report merely because those files were included in context.

Handle ambiguous requirements with visible assumptions and preserve manual edits. Rehearse a user correcting a field while generation is still running and another request arriving before the first finishes. The workspace needs an explainable conflict outcome rather than whichever response happens to arrive last. Show partial completion when some files changed but the operation stopped. An optimistic assistant message must not become the authoritative record of whether the requested change was actually applied.

Project context and secrets require different handling

Provide only the files and business information needed for the selected change. Explain the model provider, permitted use and retention decisions for submitted context. Keep credentials outside prompts, uploaded examples and model-visible logs. A builder should reference a configured service by purpose rather than paste a production key into chat. Public screenshots and fictional datasets can communicate expected behavior without exposing customer records or internal access details.

Store runtime secrets through a restricted configuration path and separate preview credentials from production credentials. Check what reaches generated files, browser bundles, error pages and exports. Redaction helps, but does not justify distributing unrestricted credentials to an untrusted process. Rehearse a provider returning a key in an error and a teammate losing project access. Record the affected permission and revoke it across connected services; hiding the settings screen alone does not remove existing access.

Generated builds must run inside declared isolation boundaries

Treat generated code, installation scripts and package commands as untrusted until reviewed. Define the execution boundary, permitted filesystem, outbound network access and available credentials. A project build should not inspect another tenant’s files or reach an internal administrative endpoint. Show the operator which limits are enforced by infrastructure and which are merely instructions to the model. A prompt asking the model to behave safely cannot substitute for a restricted execution environment.

Set limits for memory, runtime, disk and concurrent processes with useful failure messages. Cancellation should stop the actual job and its child processes, then clean temporary resources under the selected policy. Rehearse a process that never exits, an installation script attempting an unexpected connection and a workspace restart during execution. Preserve enough evidence for investigation without retaining secrets in raw logs. Returning the chat to idle does not establish that the build stopped consuming resources.

A preview should identify its version and data boundaries

Bind the preview to the files and build that produced it. Show whether the latest edit is building, failed or running, especially when an earlier preview remains visible. A reviewer should not approve a new change while unknowingly inspecting the previous version. Distinguish the application’s browser behavior from the workspace’s own controls, with an accessible route back to logs and code when navigation or a generated overlay obscures the preview.

Use synthetic records and test accounts for demonstrations. Explain which integrations are mocked and which send real requests. Restrict shared preview access and decide expiry independently of publication. Rehearse a stale preview link, a teammate opening a project after removal and a form submitting against the wrong environment. Preview acceptance should inspect persistence and authorization as well as layout. A temporary URL is an access decision, not evidence that the application has been safely released.

Dependency additions need an inventory and an accountable decision

Show which packages a generated change adds or updates, including the resolved versions and lockfile. Prefer existing capabilities when they meet the requirement rather than adding a package for every small interaction. Define permitted registries and review installation scripts, known issues and license obligations under the selected policy. The model may suggest a nonexistent package or an incompatible version; the workspace must preserve the failed resolution instead of claiming the project is complete.

Rehearse an unavailable package, a conflicting dependency and an update that changes the build result. Keep the dependency inventory with the artifact so an exported project can be reconstructed. A clean vulnerability report does not prove that a dependency is appropriate, maintained or licensed for the intended use. Give the reviewer a supported rejection or substitution path, and rerun the relevant checks after the dependency changes. Previous approval should not automatically cover a different installed tree.

Code review needs the change and the evidence together

Present file differences, deleted behavior and unresolved assumptions alongside the prompt that requested the work. Reviewers need to inspect the actual change rather than accept the assistant’s description of it. Bind review to an identifiable version. If generation modifies the files after approval, require a fresh decision for the changed artifact. Clearly distinguish a builder commenting that something looks good from an authorized reviewer accepting it for release.

Bolt’s official project security guidance describes checks covering access, authentication, inputs and exposed keys. This is a reference for review surfaces, not a security certification for generated output or this independent workspace. Rehearse a finding requiring manual action and a proposed fix that removes an existing permission check. Keep the finding, reviewed correction and remaining limitation visible together. A reassuring completion message cannot establish that every relevant risk was examined.

Meaningful checks should exercise behavior beyond a successful build

A successful build shows that the selected build process completed. It does not demonstrate that one user cannot read another user’s request or that an important record survives a reload. Choose checks tied to the agreed application behavior: rejected invalid inputs, role boundaries, persisted data and failure handling. Show the command, outcome and version tested, with failed or skipped checks distinguished from passing results.

Rehearse a test that fails for a real permission defect and confirm that correcting the defect changes its outcome. Avoid treating a generated test that merely repeats the implementation as independent evidence. The buyer should inspect a negative case, not only the intended happy path. When the environment cannot run a required check, state that gap in the review record. Do not replace missing execution evidence with invented results or a model’s confidence that the code should work.

Export must include a reproducible project and clear ownership

Agree what export contains: source files, lockfiles, configuration examples, build instructions and the relevant review record. Exclude runtime secrets and private demonstration data. Identify separately licensed templates, images and dependencies rather than promising unrestricted ownership of everything the model produced. A source download is useful only if the receiving team can understand its assumptions and recreate the supported behavior outside the original workspace.

Test export into a clean environment with fictional configuration values, then identify services that require independent accounts or permission. Repository export needs a scoped destination and an explicit decision before overwriting existing work. Deployment is a separate action with its own target, credentials, approval and recovery plan. A preview passing review does not authorize creating paid infrastructure, modifying production data or publishing publicly. Establish who maintains the exported application and resolves future dependency changes after handover.

Price workspace access and execution as separate commitments

Explain what a subscription includes and which usage is metered: model requests, build minutes, running previews or retained storage. Show enough attribution for a builder to understand an expensive failed attempt. Define caps, cancellation treatment and what happens when the allowance ends during a job. A subscription should not imply unlimited compute, guaranteed finished code or external hosting rights that have not been established.

Compare the general assistant workspace when the main need is conversational assistance rather than executing project files.

Use the reasoning workspace brief when evidence review and bounded analysis are the primary product. This application workspace instead needs executable artifacts, isolated jobs and reviewable handover. Choose the operating model before combining their features.

Inspect a synthetic app change from prompt to controlled handover

Illustrative screens demonstrate intended workflow, not a live coding service or guaranteed shippable code. Request a sandbox buyer walkthrough with a fictional internal portal. Prompt one change, conflict with a manual edit, reject a dependency and interrupt the build. Then inspect the recovered files, versioned preview, failed permission check and reviewed correction. Buyer acceptance should connect each visible state to actual code and execution evidence across builder, reviewer and administrator views.

Bring one supported template and application behavior to an app workspace scope discussion to define isolation, review responsibility and measurable acceptance.

Use the delivery process to agree source-code terms, provider permissions, runtime costs, export contents and maintenance ownership. Approve the release artifact and its destination separately from the demonstration.