@appsforgood/next-supabase-kit 0.1.7 → 0.1.8

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.8
+
+- Added `tests/setup-server-api.test.ts` for full setup-server API route coverage (PATCH state, context import, checklists, design/messaging drafts, apply, agentic-level refresh, oversized body, 404) plus wizard draft edge cases.
+- Moved `readJsonBody` to `src/studio/shared.ts` for reuse; setup-server validates invalid `completeSection` ids with 400.
+- Added Playwright UI screenshot smoke (`scripts/smoke-ui-screens.mjs`, `npm run smoke:ui-screens`, Playwright 1.55.1) with dedicated Ubuntu CI job uploading `artifacts/ui-screens/` (not in `release:check`).
+- Completed Agent Studio Milestone 8: `POST /api/sessions/:id/note` and `/render` on studio serve, session picker, note form, and render button in live office UI; SSE broadcast for notes.
+- Updated `TESTING.md`, `QUALITY_GATES.md`, `DOCS.md`, `ROADMAP.md`, and `DECISIONS.md` for studio serve endpoints, UI smoke, and runtime adapter references.
+
 ## 0.1.7
 
 - Added **Workflow Commands** section to README and docs site: lifecycle diagram, 12 core + 8 UI slash commands, council table, skills-by-phase grouping, and explicit separation from package CLI commands.

package/DOGFOOD.md

@@ -34,6 +34,16 @@ Mode: read-only audit; no downstream files were modified.
 - Assistant adapters and upgrade lifecycle still need real activation/dogfood evidence after publication.
 - Reference-led design critique still needs a real UI change dogfood pass with screenshots or equivalent visual evidence.
 
+## 2026-07-04 Publish @0.1.8 Snapshot
+
+Date: 2026-07-04
+CLI source: local `dist/index.js` after `npm run release:check`
+
+- Setup-server API route coverage (`tests/setup-server-api.test.ts`), Playwright UI screenshot smoke (`smoke:ui-screens`, Playwright 1.55.1), and Agent Studio Milestone 8 completion (note/render POST endpoints, session picker, live office controls).
+- `readJsonBody` shared between setup and studio servers; oversized bodies return 400 without dropping the connection; studio SSE broadcasts notes.
+- Dedicated Ubuntu CI job for UI screenshots; not part of `release:check` matrix.
+- Local verification: `release:check` green (150 tests, setup-server.ts 86% statements), `smoke:ui-screens` produced 4 PNGs.
+
 ## 2026-07-04 Publish @0.1.7 Snapshot
 
 Date: 2026-07-04

package/README.md

@@ -20,10 +20,10 @@ It also includes a local Agent Studio workflow: project context, durable human c
 
 ## Quick Start
 
-Use this in a Next.js + Supabase project (latest: **v0.1.7** on npm):
+Use this in a Next.js + Supabase project (latest: **v0.1.8** on npm):
 
 ```bash
-npx @appsforgood/next-supabase-kit@0.1.7 init --stack next-supabase --setup --open
+npx @appsforgood/next-supabase-kit@0.1.8 init --stack next-supabase --setup --open
 npx @appsforgood/next-supabase-kit audit
 npx @appsforgood/next-supabase-kit audit --min-readiness baseline-setup
 ```
@@ -458,7 +458,7 @@ Release expectations:
 - Dependency Review, CodeQL, OpenSSF Scorecard, Dependabot, SBOM validation, and SBOM attestation.
 - Post-publish verification with `npm run publish:verify`.
 
-The package is published to public npm under `@appsforgood/next-supabase-kit@0.1.7`. Every release must pass `npm run release:check` before publish and `npm run publish:verify` after (registry visibility, clean `npx` doctor/init/audit). Post-publish verification last passed **2026-07-04** against the live registry: `@0.1.7` doctor, clean init, and `audit --min-readiness baseline-setup` with zero failures.
+The package is published to public npm under `@appsforgood/next-supabase-kit@0.1.8`. Every release must pass `npm run release:check` before publish and `npm run publish:verify` after (registry visibility, clean `npx` doctor/init/audit). Post-publish verification last passed **2026-07-04** against the live registry: `@0.1.7` doctor, clean init, and `audit --min-readiness baseline-setup` with zero failures.
 
 ## Repository Health
 

package/antigravity/plugin.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "name": "agent-kit-next-supabase",
   "displayName": "Agent Kit Next/Supabase",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Runtime commands and portable skills for the Agent Kit Next/Supabase council workflow.",
   "homepage": "https://github.com/lukey662/agentsandskills",
   "sourceOfTruth": [

package/dist/index.js

@@ -150,7 +150,7 @@ import { join as join12, normalize } from "path";
 
 // src/config/defaults.ts
 var PACKAGE_NAME = "@appsforgood/next-supabase-kit";
-var PACKAGE_VERSION = "0.1.7";
+var PACKAGE_VERSION = "0.1.8";
 var DEFAULT_CONFIG = {
   stack: "next-supabase",
   projectType: "saas",
@@ -362,6 +362,34 @@ function listMarkdown(items) {
 function unique(values) {
   return [...new Set(values.filter(Boolean))].sort();
 }
+function readJsonBody(request) {
+  return new Promise((resolve3, reject) => {
+    const chunks = [];
+    let bodyTooLarge = false;
+    request.on("data", (chunk) => {
+      if (bodyTooLarge) return;
+      chunks.push(chunk);
+      if (chunks.reduce((total, item) => total + item.length, 0) > 256e3) {
+        bodyTooLarge = true;
+        reject(new Error("Request body too large."));
+      }
+    });
+    request.on("end", () => {
+      if (bodyTooLarge) return;
+      const raw = Buffer.concat(chunks).toString("utf8").trim();
+      if (!raw) {
+        resolve3({});
+        return;
+      }
+      try {
+        resolve3(JSON.parse(raw));
+      } catch {
+        reject(new Error("Request body must be valid JSON."));
+      }
+    });
+    request.on("error", reject);
+  });
+}
 
 // src/install/audit.ts
 import { existsSync as existsSync11, readFileSync as readFileSync9, statSync } from "fs";
@@ -4548,7 +4576,10 @@ function redactEvent(event) {
   };
 }
 function recordNote(cwd, agentId, text) {
-  return appendSessionEvent(cwd, getActiveSessionId(cwd), { type: "agent_message", createdAt: nowIso(), agentId, text });
+  return recordSessionNote(cwd, getActiveSessionId(cwd), agentId, text);
+}
+function recordSessionNote(cwd, sessionId, agentId, text) {
+  return appendSessionEvent(cwd, sessionId, { type: "agent_message", createdAt: nowIso(), agentId, text });
 }
 function recordDecision(cwd, agentId, decision, risk) {
   return appendSessionEvent(cwd, getActiveSessionId(cwd), {
@@ -5709,7 +5740,7 @@ function renderOfficeHtml(boot, mode) {
       <div id="nameplate-layer" class="nameplate-layer" aria-hidden="true"></div>
       <div id="office-hint" class="office-hint hidden" role="status">${isStudio ? "Watching council session events\u2026" : "Click a desk or zone to brief your agent team."}</div>
     </div>
-    ${isStudio ? '<aside class="transcript-panel" id="transcript-panel" aria-label="Session transcript"><h2>Transcript</h2><ol id="transcript-list"></ol></aside>' : ""}
+    ${isStudio ? '<aside class="transcript-panel" id="transcript-panel" aria-label="Session transcript"><div class="studio-controls" id="studio-controls"><label class="studio-label" for="session-picker">Session</label><select id="session-picker" aria-label="Council session"></select><form id="studio-note-form" class="studio-note-form"><select id="studio-note-agent" aria-label="Agent for note"></select><input id="studio-note-text" type="text" maxlength="3999" placeholder="Add council note\u2026" /><button type="submit" class="btn secondary">Add note</button></form><button type="button" class="btn primary" id="studio-render-btn">Render markdown</button></div><h2>Transcript</h2><ol id="transcript-list"></ol></aside>' : ""}
   </main>
   <div id="status" class="status" role="status" aria-live="polite"></div>
   <div id="depth-modal" class="modal modal-blur" hidden>
@@ -6164,31 +6195,6 @@ function invalidateAgenticLevelCache(cwd) {
 // src/studio/setup-server.ts
 var DEFAULT_PORT = 9321;
 var DEFAULT_HOST = "127.0.0.1";
-function readJsonBody(request) {
-  return new Promise((resolve3, reject) => {
-    const chunks = [];
-    request.on("data", (chunk) => {
-      chunks.push(chunk);
-      if (chunks.reduce((total, item) => total + item.length, 0) > 256e3) {
-        reject(new Error("Request body too large."));
-        request.destroy();
-      }
-    });
-    request.on("end", () => {
-      const raw = Buffer.concat(chunks).toString("utf8").trim();
-      if (!raw) {
-        resolve3({});
-        return;
-      }
-      try {
-        resolve3(JSON.parse(raw));
-      } catch {
-        reject(new Error("Request body must be valid JSON."));
-      }
-    });
-    request.on("error", reject);
-  });
-}
 function sendJson(response, statusCode, payload) {
   response.writeHead(statusCode, {
     "Content-Type": "application/json; charset=utf-8",
@@ -6276,6 +6282,9 @@ async function handleRequest(cwd, request, response) {
     try {
       const body = await readJsonBody(request);
       if (typeof body.completeSection === "string") {
+        if (!(body.completeSection in SECTION_LABELS)) {
+          throw new Error("Invalid section id.");
+        }
         markSectionComplete(cwd, body.completeSection);
       }
       const patch = {};
@@ -6544,6 +6553,11 @@ function safeSessionId(raw) {
   return raw;
 }
 function handleRequest2(cwd, request, response) {
+  handleRequestAsync(cwd, request, response).catch((error) => {
+    sendJson2(response, 500, { error: error instanceof Error ? error.message : String(error) });
+  });
+}
+async function handleRequestAsync(cwd, request, response) {
   const url = new URL(request.url ?? "/", "http://127.0.0.1");
   if (request.method === "GET" && (url.pathname === "/" || url.pathname === "/office")) {
     sendHtml2(response, renderLiveStudioHtmlWithContext(cwd));
@@ -6618,6 +6632,57 @@ data: ${JSON.stringify({ sessionId: activeId, events: [] })}
     });
     return;
   }
+  const noteMatch = url.pathname.match(/^\/api\/sessions\/([^/]+)\/note$/);
+  if (request.method === "POST" && noteMatch) {
+    const sessionId = safeSessionId(noteMatch[1] ?? "");
+    if (!sessionId) {
+      sendJson2(response, 400, { error: "Invalid session id." });
+      return;
+    }
+    try {
+      const body = await readJsonBody(request);
+      const agent = typeof body.agent === "string" ? body.agent.trim() : "";
+      const text = typeof body.text === "string" ? body.text.trim() : "";
+      if (!agent) {
+        sendJson2(response, 400, { error: "agent is required." });
+        return;
+      }
+      if (!text) {
+        sendJson2(response, 400, { error: "text is required." });
+        return;
+      }
+      if (text.length >= 4e3) {
+        sendJson2(response, 400, { error: "text must be under 4000 characters." });
+        return;
+      }
+      const event = recordSessionNote(cwd, sessionId, agent, text);
+      broadcastSse("event", { sessionId, event, total: readSessionEvents(cwd, sessionId).length });
+      sendJson2(response, 200, { event });
+    } catch (error) {
+      sendJson2(response, 404, { error: error instanceof Error ? error.message : String(error) });
+    }
+    return;
+  }
+  const renderMatch = url.pathname.match(/^\/api\/sessions\/([^/]+)\/render$/);
+  if (request.method === "POST" && renderMatch) {
+    const sessionId = safeSessionId(renderMatch[1] ?? "");
+    if (!sessionId) {
+      sendJson2(response, 400, { error: "Invalid session id." });
+      return;
+    }
+    try {
+      const result = renderSession(cwd, sessionId);
+      sendJson2(response, 200, {
+        rendered: true,
+        sessionId: result.sessionId,
+        sessionPath: result.sessionPath,
+        files: [`${result.sessionPath}/index.md`, `${result.sessionPath}/transcript.md`]
+      });
+    } catch (error) {
+      sendJson2(response, 404, { error: error instanceof Error ? error.message : String(error) });
+    }
+    return;
+  }
   sendJson2(response, 404, { error: "Not found." });
 }
 function listen2(server, host, port) {