i’m affraid that we sadly won’t be able to use transparent windows in restricted mode (chromeless without transparency). I’m even not sure that will be able to use chromeless ones because of clickjacking considerations.

Here’s how I see it.

#1 A new, restricted sandbox mode for the AIR runtime

The AIR runtime would have a new restricted application sandbox which would apply for applications created as “widgets” (I’m not a fan of that term, not sure it truly defines what we’re trying to achieve here). The compiler would of course need to have an option such as -restrictedsandbox to create that kind of app.

The exact terms and limitations of the restricted sandbox are yet to be clarified, but I also think that the most important thing might be to disable full file system access, for example by limiting it to the app storage directory.

Of course, that would mean other related restrictions, such as the fact that a restricted app could not be replaced by a “normal” app, using the updater API for instance.

I don’t think the AIR framework API should be modified much. It would just throw security errors when trying to access data that is out of the sandbox, if an app runs in that mode.
I know, that’s easy to say…

# 2 A new install paradigm for those apps

Apps created to be run in restricted mode (aka “widgets”) could be installed with much less user warnings, like the “single click” install dialog you mentionned.

FlashPlayer would have the new ability to invoke the AIR runtime in order to pass it “install request” when a movie is dragged out of the browser. No need to have that movie running seamlessly during the process (I think JavaFx has this feature), it’s just the gesture we’re looking for, here. In other words, a flash movie could be used as an install badge when this gesture is performed. Simply dropping the movie out of the browser would trigger a new event which could be handled just like an “install” button of an Install Badge.

In other words, I’m not necessary talking about any movie having the ability to be installed as an AIR widget. It would still be very cool if it was the developer’s responsibility to create a separate .air file and set its URL within the flash app, like any install badge.

In fact, I think we can extract four independent killer feature requests:

1) Activation of the restricted mode on Air application export.
2) Creation of a widget mode (systray, start with the system, launch shortcut, default installation folder for all widgets, all sandboxed).
3) One click install of the application when in widget mode (as in Silverlight and Curl).
4) Enable the drag’n'drop of a Flash widget from browser to the desktop (as in JavaFX).

I will try to clarify this and post my feature requests to our beloved Air team.