@cairnvibe/indexer 0.2.3 → 0.2.5

package/dist/inject-widget.js

@@ -36,12 +36,17 @@ const WRAPPER_COMPONENT_NAME = "CairnCopilot";
 function wrapperSource(voice) {
     // Real bug this closes: choosing voice during `cairn setup` used to save a
     // DEEPGRAM_API_KEY that nothing ever read — the generated wrapper never
-    // passed speakEndpoint/transcribeEndpoint, so the widget had no way to
-    // know voice existed regardless of whether a valid key was configured.
-    // These routes only exist when ensure-transpile.ts's sibling in setup.ts
-    // asked init.ts to scaffold them (voice: true) — never reference them here
-    // unwired to a real backend route.
-    const voiceProps = voice ? '\n      speakEndpoint="/api/copilot/speak"\n      transcribeEndpoint="/api/copilot/transcribe"' : "";
+    // passed speakEndpoint/transcribeEndpoint/realtimeUrl, so the widget had
+    // no way to know voice existed regardless of whether a valid key was
+    // configured. These routes only exist when setup.ts asked init.ts to
+    // scaffold them (voice: true) — never reference them here unwired to a
+    // real backend. realtimeUrl points at the port `cairn-realtime --with`
+    // (setup.ts rewrites the dev script to start it alongside next dev) —
+    // without that, a widget with realtimeUrl set just fails to connect,
+    // which reads as "voice doesn't work" with no clue why.
+    const voiceProps = voice
+        ? '\n      speakEndpoint="/api/copilot/speak"\n      transcribeEndpoint="/api/copilot/transcribe"\n      realtimeUrl="ws://localhost:3010"'
+        : "";
     return `"use client";
 
 import { Copilot } from "@cairnvibe/sdk";

package/dist/manifest.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.assembleManifest = assembleManifest;
+exports.parseApiCall = parseApiCall;
 const node_child_process_1 = require("node:child_process");
 function assembleManifest(rootDir, facts, l2, l3) {
     const globalElements = facts.frameworkElements.map((el) => toManifestElement(el, l3.globalElements.find((e) => e.id === el.id), "present in the root layout"));
@@ -27,6 +28,40 @@ function assembleManifest(rootDir, facts, l2, l3) {
         conflicts: l2.conflicts,
     };
 }
+const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+/**
+ * Turns l1-scan's traced `"POST /api/items"`-shaped string into structured,
+ * executable data — this is what lets a `do` action actually run
+ * (verb-executor.ts) instead of only ever describing itself. Only real
+ * mutating methods count as an action; `"navigate ..."` (a Link) and a bare
+ * GET aren't "do" material — see ApiCallSchema's doc comment in
+ * @cairnvibe/core for the safety reasoning (bounded to calls a human
+ * developer already wrote and shipped, nothing invented at runtime).
+ *
+ * Only accepts a clean, static, same-origin relative path. l1-scan.ts's URL
+ * capture falls back to a call's raw source text when the first argument
+ * isn't a plain string literal — for a template literal (a per-row action
+ * built as `` `/api/items/${id}/archive` ``) that's literal backticks and a
+ * "${...}" hole, not a real fetchable URL; for a bare identifier or some
+ * other expression it isn't a URL at all. Rejecting both instead of
+ * guessing at resolving them is what keeps this bounded to calls that are
+ * actually safe to fire as-is — see ApiCallSchema's doc comment for the
+ * real gap this leaves (per-row actions aren't auto-executable yet).
+ */
+function parseApiCall(handlerCall) {
+    if (!handlerCall)
+        return null;
+    const spaceIndex = handlerCall.indexOf(" ");
+    if (spaceIndex === -1)
+        return null;
+    const method = handlerCall.slice(0, spaceIndex);
+    const url = handlerCall.slice(spaceIndex + 1);
+    if (!MUTATING_METHODS.has(method) || !url)
+        return null;
+    if (!/^\/[a-zA-Z0-9/_.-]*$/.test(url))
+        return null;
+    return { method: method, url };
+}
 function toManifestElement(el, elDesc, baseEvidence) {
     const evidence = [baseEvidence];
     if (el.handlerCall)
@@ -41,6 +76,7 @@ function toManifestElement(el, elDesc, baseEvidence) {
         does: elDesc?.does ?? "Unknown — no description generated for this element.",
         confidence: elDesc?.confidence ?? 0,
         evidence,
+        apiCall: parseApiCall(el.handlerCall),
     };
 }
 function elementFallbackSelector(el) {

package/dist/setup.js

@@ -295,5 +295,24 @@ async function runSetup(dir) {
         console.log((0, ui_1.dim)("(--if-configured means a build with no key set yet skips this step instead of failing the whole build —"));
         console.log((0, ui_1.dim)(" set the same key as an environment variable on whatever platform you deploy to.)"));
     }
+    // 8. Wire the realtime voice relay into the normal dev workflow — the
+    // other real half of "voice was completely unwired." realtimeUrl on the
+    // widget (wired above) just fails to connect if nothing's actually
+    // listening on that port; found live, and indistinguishable from "voice
+    // doesn't work" with zero indication that a whole separate process needs
+    // to be running. `cairn-realtime --with "<original dev command>"` runs
+    // both from the one command a project's dev workflow already uses,
+    // instead of a second terminal nobody remembers to open. Wraps whatever
+    // `dev` already does (a custom server, Turbopack, anything) rather than
+    // replacing it — the realtime relay runs alongside it, not instead of it.
+    if (wantsVoice && pkg?.scripts?.dev && !pkg.scripts.dev.includes("cairn-realtime")) {
+        const pkgPath = node_path_1.default.join(absDir, "package.json");
+        const fresh = JSON.parse(node_fs_1.default.readFileSync(pkgPath, "utf8"));
+        const originalDev = fresh.scripts.dev;
+        fresh.scripts.dev = `cairn-realtime --port 3010 --with ${JSON.stringify(originalDev)}`;
+        node_fs_1.default.writeFileSync(pkgPath, JSON.stringify(fresh, null, 2) + "\n");
+        console.log((0, ui_1.green)('✓ wired the realtime voice relay into `npm run dev` — it now starts alongside your app automatically.'));
+        console.log((0, ui_1.dim)("(a missing/invalid Deepgram key skips voice only, never blocks your app's own dev server from starting.)"));
+    }
     console.log(`\n${(0, ui_1.bold)("Done.")} \`npm run dev\` and ask it something.`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cairnvibe/indexer",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Cairn's analyzer and installer (the `cairn` CLI) — scans Next.js source or crawls any running app, and scaffolds the backend either way.",
   "license": "MIT",
   "publishConfig": { "access": "public" },