@frontera-sdk/cli 1.52.44 → 1.52.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontera-sdk/cli",
-  "version": "1.52.44",
+  "version": "1.52.45",
   "description": "The frontera CLI — scaffold, pull, save and deploy Frontera apps and automations.",
   "keywords": [
     "frontera",
@@ -40,8 +40,8 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.251",
     "@faker-js/faker": "10.6.0",
-    "@frontera-sdk/core": "1.52.44",
-    "@frontera-sdk/functions": "1.52.44",
+    "@frontera-sdk/core": "1.52.45",
+    "@frontera-sdk/functions": "1.52.45",
     "ai": "^6.0.116",
     "axe-core": "4.12.1",
     "gray-matter": "^4.0.3",
@@ -49,7 +49,7 @@
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@frontera-sdk/forge-contracts": "1.52.44",
+    "@frontera-sdk/forge-contracts": "1.52.45",
     "@types/bun": "^1.3.14",
     "typescript": "^5.9.3"
   }

package/src/commands/kit/vendor.ts

@@ -44,55 +44,8 @@ export const kitVendor: Command = {
     requireCompatible()
 
     const root = kitRoot(ctx)
-    const rendered = renderKit()
-    const lock = readLock(root)
     const force = flagBool(ctx, 'force')
-
-    const report = writeGenerated(root, rendered.generated, lock, { force })
-
-    const edited: string[] = []
-    const repaired: string[] = []
-
-    if (rendered.agentsMd !== null) {
-      const path = join(root, 'AGENTS.md')
-      const existing = existsSync(path) ? readFileSync(path, 'utf8') : null
-      const next = applyManagedBlock(existing, rendered.agentsMd)
-      if (next !== existing) {
-        writeFileSync(path, next)
-        edited.push('AGENTS.md')
-      }
-    }
-
-    if (rendered.claudeMd !== null) {
-      const path = join(root, 'CLAUDE.md')
-      const existing = existsSync(path) ? readFileSync(path, 'utf8') : null
-      const result = applyClaudeImport(existing, rendered.claudeMd)
-      if (result.content !== existing) {
-        writeFileSync(path, result.content)
-        edited.push('CLAUDE.md')
-      }
-      if (result.repaired) repaired.push('CLAUDE.md')
-    }
-
-    // The lock records what WAS written. A conflicted file keeps whatever digest
-    // it had, so the next run still reports it rather than adopting the local
-    // edit as ours.
-    const locked = Object.fromEntries(
-      Object.entries(rendered.generated).filter(([rel]) => !report.conflicts.includes(rel)),
-    )
-    writeLock(root, locked, cliVersion())
-
-    const data = {
-      root,
-      kitVersion: KIT.kitVersion,
-      hosts: KIT.hosts,
-      written: report.written,
-      unchanged: report.unchanged,
-      conflicts: report.conflicts,
-      edited,
-      repaired,
-      lock: LOCK_FILE,
-    }
+    const { data, report, edited, repaired } = vendorKit(root, { force })
 
     const lines = [
       ...report.written.map((f) => `  + ${f}`),
@@ -117,4 +70,65 @@ export const kitVendor: Command = {
   },
 }
 
+/**
+ * Write the kit into `root`: the skills in both host directories, the managed
+ * AGENTS.md block, the CLAUDE.md import and the lock.
+ *
+ * Shared with `frontera local init`, so a project folder Forge opens carries the
+ * whole kit, the solution skills included, rather than only the CLI skill.
+ */
+export function vendorKit(root: string, opts: { force?: boolean } = {}) {
+  const rendered = renderKit()
+  const lock = readLock(root)
+  const force = opts.force === true
+
+  const report = writeGenerated(root, rendered.generated, lock, { force })
+
+  const edited: string[] = []
+  const repaired: string[] = []
+
+  if (rendered.agentsMd !== null) {
+    const path = join(root, 'AGENTS.md')
+    const existing = existsSync(path) ? readFileSync(path, 'utf8') : null
+    const next = applyManagedBlock(existing, rendered.agentsMd)
+    if (next !== existing) {
+      writeFileSync(path, next)
+      edited.push('AGENTS.md')
+    }
+  }
+
+  if (rendered.claudeMd !== null) {
+    const path = join(root, 'CLAUDE.md')
+    const existing = existsSync(path) ? readFileSync(path, 'utf8') : null
+    const result = applyClaudeImport(existing, rendered.claudeMd)
+    if (result.content !== existing) {
+      writeFileSync(path, result.content)
+      edited.push('CLAUDE.md')
+    }
+    if (result.repaired) repaired.push('CLAUDE.md')
+  }
+
+  // The lock records what WAS written. A conflicted file keeps whatever digest
+  // it had, so the next run still reports it rather than adopting the local
+  // edit as ours.
+  const locked = Object.fromEntries(
+    Object.entries(rendered.generated).filter(([rel]) => !report.conflicts.includes(rel)),
+  )
+  writeLock(root, locked, cliVersion())
+
+  const data = {
+    root,
+    kitVersion: KIT.kitVersion,
+    hosts: KIT.hosts,
+    written: report.written,
+    unchanged: report.unchanged,
+    conflicts: report.conflicts,
+    edited,
+    repaired,
+    lock: LOCK_FILE,
+  }
+
+  return { data, report, edited, repaired }
+}
+
 export { CliError }

package/src/commands/local/init.ts

@@ -10,6 +10,9 @@ import { readLink } from '../../local/local-sync-link'
 import { generateSyntheticData, addMissingBackings, loadScenario, SCENARIO_TEMPLATE } from '../../local/local-synthetic-data'
 import { isoDay, writeSampleOptions } from '../../local/local-sample-remake'
 import { migrateMcpConfigs, writeSolutionScaffold } from '../../local/local-scaffold'
+import { checkCompatibility } from '../../kit'
+import { cliVersion } from '../kit/shared'
+import { vendorKit } from '../kit/vendor'
 import { flagBool, flagString, type Command, type CommandContext } from '../types'
 import { localSync } from './sync'
 
@@ -39,6 +42,7 @@ export const localInit: Command = {
       kinds: 'string',
       'no-sample-data': 'boolean',
       'no-app-code': 'boolean',
+      'no-kit': 'boolean',
       rows: 'string',
       seed: 'string',
     },
@@ -80,9 +84,25 @@ export const localInit: Command = {
       const at = scaffold.skipped.indexOf(file)
       if (at >= 0) scaffold.skipped.splice(at, 1)
     }
+    // The whole authoring kit, after the scaffold so its managed block lands in
+    // the project's AGENTS.md: the solution skills (delivery, Agents, workflows,
+    // Functions, Apps, embeds, review) reach every coding agent working here,
+    // not only the CLI skill. `--no-kit` leaves it out, for a machine that uses
+    // the installed plugin instead (`frontera kit doctor` finds duplicates).
+    const kit = { written: [] as string[], skipped: [] as string[] }
+    if (!flagBool(ctx, 'no-kit')) {
+      const compat = checkCompatibility(cliVersion())
+      if (compat.compatible) {
+        const vendored = vendorKit(target, { force })
+        kit.written.push(...vendored.report.written, ...vendored.edited)
+        kit.skipped.push(...vendored.report.conflicts)
+      } else {
+        ctx.output.note(`  the Frontera skills were not added: ${compat.reason}; run \`frontera kit vendor\` after updating the CLI`)
+      }
+    }
     const listed = (files: string[]) => files.filter((f) => !f.startsWith('vendor/'))
-    const written = [...new Set(listed([...scaffold.written, ...harness.written]))]
-    const skipped = listed([...scaffold.skipped, ...harness.skipped]).filter((f) => !written.includes(f))
+    const written = [...new Set(listed([...scaffold.written, ...harness.written, ...kit.written]))]
+    const skipped = listed([...scaffold.skipped, ...harness.skipped, ...kit.skipped]).filter((f) => !written.includes(f))
 
     let installed: boolean | null = null
     if (!flagBool(ctx, 'no-install') && scaffold.written.includes('package.json')) {

package/src/flag-help.ts

@@ -276,6 +276,7 @@ export const FLAG_HELP: Readonly<Record<string, string>> = {
   conflicts: 'the conflicts the picks were chosen against, as `diff --json` names them; refused if they moved',
   'from-workspace': 'start the project from a platform workspace instead of the examples',
   'no-sample-data': 'do not generate sample rows for the pulled Blueprint',
+  'no-kit': 'leave out the Frontera skills (the kit) that local init vendors into the project; for a machine that uses the installed plugin instead',
   'keep-sample-data': 'leave the sample datasets as they are; by default they are made again (same seed, rows and day) after a pull that brings Blueprint items, or when an older generator made them',
   'remake-sample-data': 'make the sample datasets again with the newest sample rules (same seed, rows and day), even the ones a pull wrote, which local dev otherwise keeps as pulled',
   synthetic: 'generate sample rows for the Blueprint: values fit each property, links stay consistent',

package/src/local/local-keys.ts

@@ -21,8 +21,8 @@ const SERVICE = 'frontera-local-model-key'
 export interface ProviderSpec {
   id: string
   label: string
-  /** The variable the service reads for this provider. */
-  envVar: string
+  /** The variable the service reads for this provider; none for a key only an organization holds. */
+  envVar?: string
 }
 
 /** Providers the local runtime can pass a key to; mirrors the service's built-in providers. */
@@ -32,6 +32,8 @@ export const LOCAL_PROVIDERS: readonly ProviderSpec[] = [
   { id: 'openrouter', label: 'OpenRouter', envVar: 'OPENROUTER_API_KEY' },
   { id: 'google', label: 'Google Gemini', envVar: 'GOOGLE_GENERATIVE_AI_API_KEY' },
   { id: 'cohere', label: 'Cohere (reranking)', envVar: 'COHERE_API_KEY' },
+  // Agents' web search; stored as the local organization's own key, never an environment variable.
+  { id: 'openrouter-web-search', label: 'OpenRouter web search' },
 ]
 
 export function findProvider(id: string): ProviderSpec | undefined {
@@ -100,7 +102,7 @@ export function providerEnv(): Record<string, string> {
   const env: Record<string, string> = {}
   for (const p of LOCAL_PROVIDERS) {
     const key = getKey(p.id)
-    if (key) env[p.envVar] = key
+    if (key && p.envVar) env[p.envVar] = key
   }
   return env
 }

package/src/local/local-seed.ts

@@ -166,7 +166,7 @@ export async function seedLocalRuntime(args: SeedArgs): Promise<LocalCredentials
 }
 
 /** Provider ids the service stores as organization credentials, each with an `apiKey` field. */
-const CREDENTIAL_PROVIDERS = new Set(['anthropic', 'openai', 'openrouter', 'google'])
+const CREDENTIAL_PROVIDERS = new Set(['anthropic', 'openai', 'openrouter', 'google', 'openrouter-web-search'])
 
 /** Embedding defaults by provider, in preference order; the service requires 1536-wide vectors. */
 const EMBEDDING: Array<{ provider: string; model: string }> = [

package/src/local/local-studio-server.ts

@@ -386,14 +386,20 @@ export function startStudioServer(opts: StudioServerOptions) {
     if (state?.credentials?.workspaceId && !headers.has('x-workspace-id')) {
       headers.set('x-workspace-id', state.credentials.workspaceId)
     }
+    // A page sends the session token it kept (`bearer_token`) itself. After
+    // `frontera local reset` that session is gone, so a session the service
+    // refuses is answered as the owner; an API key or a signed token is not.
+    const kept = headers.get('authorization')?.match(/^Bearer ([A-Za-z0-9]{32})$/)?.[1]
+    const fallback = kept && bearer && kept !== bearer ? bearer : null
+    const hasBody = req.method !== 'GET' && req.method !== 'HEAD'
+    const body = hasBody && fallback ? await req.arrayBuffer() : hasBody ? req.body : undefined
     try {
-      const res = await fetch(target, {
-        method: req.method,
-        headers,
-        body: req.method === 'GET' || req.method === 'HEAD' ? undefined : req.body,
-        redirect: 'manual',
-        duplex: 'half',
-      })
+      const send = () => fetch(target, { method: req.method, headers, body, redirect: 'manual', duplex: 'half' })
+      let res = await send()
+      if (res.status === 401 && fallback) {
+        headers.set('authorization', `Bearer ${fallback}`)
+        res = await send()
+      }
       const out = new Headers(res.headers)
       out.delete('content-encoding')
       out.delete('content-length')