@foldspace_npm/harness 0.1.26 → 0.1.28

package/templates/agent-starter/docs/app-profile.md

@@ -3,9 +3,10 @@
 Durable facts about `{{APP_DOMAIN}}` and its API, established by observing the
 running app on **<date>** from a logged-in session.
 
-**Everything here should be observed.** Each entry says how. Where something is
-only believed, say so in the same breath — do not promote an assumption by
-quoting this file. Re-run the probe before trusting an entry that matters.
+**Every entry says how it was established.** Where something is only
+believed, mark it **assumed** in the same breath - do not promote an
+assumption by quoting this file. Re-run the probe before trusting an entry
+that matters.
 
 Do not store secrets, cookies, HAR files, tokens, or session data here. Record
 *where* the token lives and *what a redacted value looks like*, never the value.
@@ -13,9 +14,9 @@ Do not store secrets, cookies, HAR files, tokens, or session data here. Record
 How to re-run any probe below:
 
 ```bash
-npm run inject
-# Sign in, then read the running app with foldspace observe. It reads the
-# window you signed in to, and works while foldspace attach runs.
+npm run inject   # only if the test window is closed; the human signs in there
+npx foldspace observe wait-login
+# observe reads the test window, and works while attach runs.
 npx foldspace observe screen --click "<a label from observe menu>" --match "<words for the data>"
 npx foldspace observe read "<the GET path screen returned>"
 ```
@@ -27,9 +28,9 @@ Start URL: `{{START_URL}}`
 ## Auth
 
 - Where the token lives (cookie name, `localStorage` key, custom header), and
-  how you know — wrapping XHR/`fetch` on the live page beats guessing.
-- Its lifetime, measured. (One app's expired in ~52 minutes and killed three
-  probing sessions.)
+  how you know: `npx foldspace observe auth` reports where each header value
+  comes from, never the value.
+- Its lifetime, measured: a short one ends probing sessions halfway.
 - What an expired or refused response looks like, verbatim. A CORS-less refusal
   often surfaces as `TypeError: Failed to fetch` with no status — that is not
   "host down".
@@ -43,8 +44,11 @@ Start URL: `{{START_URL}}`
 
 ## Account contents
 
-Row counts from the signed-in account **before** choosing the experience. On an
-empty account the only useful first action is one that creates data.
+Row counts for the experience being built, checked when you observe it. Zero
+rows makes a demo of an empty state: say so and offer the next experience. On
+an account with nothing to read at all, say so and offer first a card that
+creates a record when the end user approves
+(`node_modules/@foldspace_npm/harness/recipes/create-a-record`).
 
 | Resource | Count | How established |
 |---|---|---|
@@ -93,9 +97,10 @@ Mark which you verified and which came from reading the app bundle.
 
 ## Brand (sampled, not guessed)
 
-Colour, typeface, greys, base size and radii from the running app's computed
-styles — not from a screenshot. Re-sample per tenant; do not carry values
-across.
+`npx foldspace observe styles --write` samples the app's accent, text, border,
+font and radius and writes `agent/views/brand.ts`. Record here the page and
+date it sampled, and anything it fell back on. Re-sample per product; never
+copy values across.
 
 ## Endpoints seen in the bundle but NOT called
 

package/templates/agent-starter/foldspace.dev.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Generated by foldspace init. Use the bare product ID, not the EU-… SDK key.",
+  "$comment": "Generated by foldspace init. Use the bare product ID, not the SDK key (the one that starts with EU-, in every region).",
   "defaultTarget": "app",
   "region": {{REGION_JSON}},
   "sdkUrl": {{SDK_URL_JSON}},

package/recipes/several-hosts/fixtures/nav-record.json

@@ -1,5 +0,0 @@
-{
-  "payload": { "conversationId": "conv_123", "actionName": "navigate" },
-  "normalizedUrl": "https://communicate.example-campus.net/applications/acme/test",
-  "expiry": 9999999999999
-}