@frankieai/core 0.2.3 → 0.2.4

package/dist/index.cjs

@@ -49,6 +49,8 @@ __export(index_exports, {
   planHostedInstall: () => planHostedInstall,
   sdkUpdateWorkflow: () => sdkUpdateWorkflow,
   skillSchema: () => skillSchema,
+  starterPromptSchema: () => starterPromptSchema,
+  suggestedPromptsFromSkills: () => suggestedPromptsFromSkills,
   thinkingLevelSchema: () => thinkingLevelSchema,
   toolDescriptions: () => toolDescriptions,
   toolPolicySchema: () => toolPolicySchema,
@@ -141,6 +143,36 @@ function toolDescriptions(config, toolIds) {
   }
   return toolIds.map((id) => ({ id, description: found.get(id) ?? id }));
 }
+function suggestedPromptsFromSkills(config) {
+  const seen = /* @__PURE__ */ new Set();
+  const prompts = [];
+  for (const skill of activeSkills(config)) {
+    const title = cleanSkillName(skill.name);
+    if (!title) continue;
+    const key = title.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const detail = summarizeGoal(skill.goal, title);
+    prompts.push(detail ? `${title} \u2014 ${detail}` : title);
+    if (prompts.length >= 6) break;
+  }
+  return prompts;
+}
+function cleanSkillName(name) {
+  const trimmed = name.trim();
+  const withoutSource = trimmed.replace(/^[^·/:]{1,40}?\s*[·/:]\s*/, "");
+  const cleaned = (withoutSource || trimmed).replace(/[·/_]+/g, " ").replace(/\s+/g, " ").trim();
+  return cleaned ? cleaned.charAt(0).toUpperCase() + cleaned.slice(1) : "";
+}
+function summarizeGoal(goal, title) {
+  let cleaned = goal.trim().replace(/^use this(?: skill)?(?: when (?:the user (?:asks?(?: you)?(?: to| for| about)?|wants?(?: to)?|needs?(?: to)?)|you (?:need|want) to)| to)\s+/i, "").replace(/\s+/g, " ").replace(/[.\s]+$/, "");
+  const restatement = cleaned.match(/^.{1,40}?\s+[—–-]\s+(.+)$/);
+  if (restatement) cleaned = restatement[1];
+  if (/^(listing|creating|reading|updating|managing)\b/i.test(cleaned) || /^(create|read|update|delete|list|manage),/i.test(cleaned)) return "";
+  if (!cleaned || cleaned.toLowerCase() === title.toLowerCase()) return "";
+  const capped = cleaned.length > 80 ? cleaned.slice(0, 80).replace(/\s+\S*$/, "") + "\u2026" : cleaned;
+  return capped.charAt(0).toUpperCase() + capped.slice(1);
+}
 function draftSkill(goal, tools) {
   return [
     `Use this when: ${goal}`,
@@ -393,12 +425,23 @@ var toolPolicySchema = import_zod2.z.object({
    */
   denyByDefault: import_zod2.z.boolean().default(true)
 });
+var starterPromptSchema = import_zod2.z.object({
+  title: import_zod2.z.string().trim().min(1).max(80),
+  description: import_zod2.z.string().trim().max(160).optional(),
+  message: import_zod2.z.string().trim().min(1).max(2e3)
+});
 var agentConfigSchema = import_zod2.z.object({
   /** Prepended to the runtime's own operating instructions. */
   systemPrompt: import_zod2.z.string().default(""),
   /** First message the widget shows before the user types anything. */
   greeting: import_zod2.z.string().default("Hi! I can walk you through getting set up. What are you trying to do?"),
   suggestedPrompts: import_zod2.z.array(import_zod2.z.string()).max(6).default([]),
+  /**
+   * Explicit starter cards for the empty chat screen (title + description +
+   * the message clicking sends). When set, these take precedence over
+   * `suggestedPrompts` and over any skill-derived defaults.
+   */
+  starterPrompts: import_zod2.z.array(starterPromptSchema).max(6).default([]),
   maxTurns: import_zod2.z.number().int().positive().max(50).default(12),
   /** Hard stop on estimated spend per session. */
   maxBudgetUsd: import_zod2.z.number().positive().optional(),
@@ -549,6 +592,17 @@ async function getUserToken() {
   throw new Error("The chat sign-in endpoint returned " + response.status + ".");
 }
 `;
+  const hostApiHeaders = auth?.client && !workspace.allowAnonymous ? `
+  headers: async () => {
+    const session = (await ${auth.client.name}?.auth.getSession())?.data.session;
+    return session?.access_token ? { Authorization: \`Bearer \${session.access_token}\` } : {};
+  },` : "";
+  const hostApi = `const hostApi = {
+  baseUrl: typeof window !== "undefined" ? window.location.origin : "",
+  credentials: "${auth?.client || workspace.allowAnonymous ? "same-origin" : "include"}" as const,${hostApiHeaders}
+};
+`;
+  const apiProp = " api={hostApi}";
   let priorChat;
   try {
     const previous = JSON.parse(files[root + "frankie.install.json"] ?? "{}");
@@ -561,17 +615,17 @@ async function getUserToken() {
   if (chatPath !== "/chat") notes.push("Existing /chat preserved. Frankie chat is available at /frankie/chat.");
   const mount = `"use client";
 import { usePathname } from "next/navigation";
-${shared}${clientAuthImport}${getToken}
+${shared}${clientAuthImport}${getToken}${hostApi}
 export function FrankieWidgetMount() {
   const pathname = usePathname();
   const key = process.env.NEXT_PUBLIC_FRANKIE_KEY;
   if (!key || pathname === ${JSON.stringify(chatPath)}) return null;
-  return <FrankieProvider publishableKey={key}${authProp}><FrankieWidget /></FrankieProvider>;
+  return <FrankieProvider publishableKey={key}${authProp}${apiProp}><FrankieWidget /></FrankieProvider>;
 }
 export function WorkspaceChatPage() {
   const key = process.env.NEXT_PUBLIC_FRANKIE_KEY;
   if (!key) return <p>Chat is not configured. Set NEXT_PUBLIC_FRANKIE_KEY in your deployment.</p>;
-  return <FrankieChatPage publishableKey={key}${authProp} />;
+  return <FrankieChatPage publishableKey={key}${authProp}${apiProp} />;
 }
 `;
   const moduleName = existingMount ? "FrankieSetupChat" : "FrankieWidgetMount";
@@ -682,7 +736,7 @@ export async function GET() {
   if (!operationCount) notes.push("No supported API routes detected. The OpenAPI draft has no operations; add the real schema before connecting tools.");
   if (withheld) notes.push(`Withheld ${withheld} newly discovered write operation(s) with no detected authorization guard (no Express/Fastify middleware argument, Next.js middleware.ts matcher covering the route, or in-handler auth check). Add them to the spec yourself once they're protected.`);
   notes.push("Generated OpenAPI includes read and write routes. Review schemas before approving tools; new connections still default to GET-only access.");
-  notes.push("Verify the public spec URL is reachable without dashboard authentication before connecting it.");
+  notes.push("No public spec endpoint is required: Frankie connects this committed spec on install and reads later changes from your repository through the GitHub connection.");
   notes.push("The token endpoint issues a signed user JWT, but your product API must validate it and enforce user/resource permissions before exposing tools.");
   const envPath = root + ".env.example";
   const env = (files[envPath] ?? "").replace(/^NEXT_PUBLIC_FRANKIE_KEY=.*\n?/gm, "").replace(/^FRANKIE_JWT_SECRET=.*\n?/gm, "").trimEnd();
@@ -693,9 +747,9 @@ Workspace: ${workspace.name}
 
 1. Copy NEXT_PUBLIC_FRANKIE_KEY from Frankie \u2192 Workspace \u2192 Developer details into the frontend deployment environment. Frankie deliberately leaves the value blank in this PR.
 ${workspace.allowAnonymous ? "" : "2. Add FRANKIE_JWT_SECRET from this workspace to the server hosting /api/frankie/token. Never commit the value.\n"}3. Run your package manager and commit the updated lockfile (for pnpm: pnpm install --lockfile-only). The remote GitHub installer cannot safely synthesize a lockfile.
-4. Confirm https://YOUR_APP/frankie.openapi.json is public. If your Next.js middleware protects all paths, explicitly bypass /frankie.openapi.json before connecting it.
+4. Nothing to expose: this PR commits your spec to the repository, Frankie connects it for you on install, and later spec changes are read from your repository through the GitHub connection \u2014 no public spec endpoint or middleware bypass is required.
 5. Open ${chatPath}. It is created inside the detected authenticated dashboard group when one exists; add its link to the host sidebar during review.
-6. Connect https://YOUR_APP/frankie.openapi.json in Frankie \u2192 Tools & MCP. The document includes read and write routes; approve tools and choose access limits separately.
+6. In Frankie \u2192 Tools & MCP, approve the operations you want and choose access limits (the spec is already connected from this PR; it includes read and write routes). After merging later spec changes, use GitHub integration \u2192 Refresh Frankie from merged spec.
 7. Forwarding sends the Frankie-signed JWT. Your API must validate it and enforce user/resource permissions. It is not automatically interchangeable with a Firebase or OAuth access token.
 8. Add NEXT_PUBLIC_FRANKIE_KEY to every frontend deployment environment (Preview and Production). ${workspace.allowAnonymous ? "" : "Add FRANKIE_JWT_SECRET only to the server environment running /api/frankie/token; never expose it to the browser.\n"}9. Review conversations in Workspace \u2192 Chat sessions.
 
@@ -1086,6 +1140,8 @@ function compareApiDocuments(before, after) {
   planHostedInstall,
   sdkUpdateWorkflow,
   skillSchema,
+  starterPromptSchema,
+  suggestedPromptsFromSkills,
   thinkingLevelSchema,
   toolDescriptions,
   toolPolicySchema,