@guuey/create-agentic-app 0.9.0 → 0.10.0

package/dist/templates/google-adk/web/src/useAgentChat.ts

@@ -1,122 +0,0 @@
-/**
- * The from-scratch AgJSON client for the local dev chat SPA. Talks directly
- * to the agent's `POST /agent/invoke` endpoint (SSE response), parses each
- * `event: session|message|done|error` / `data: <JSON>` frame off the wire,
- * and folds `message` frames (AgJSON `AgEvent[]`) through `@silverprotocol/
- * core`'s `Reducer` into the normative `{messages, turns, artifacts, memory}`
- * snapshot `App.tsx` renders from.
- *
- * Real `@silverprotocol/core` API (verified against `core/README.md` +
- * `core/src/reduce.ts:79`): `new Reducer()` + `reducer.push(event)` are
- * correct, but the fold is read back via `reducer.result()` — there is no
- * `reducer.state` accessor. `ingestAgEvents` is the library's own
- * parse-known-else-skip validator; used here instead of an `as AgEvent[]`
- * cast so a malformed/foreign wire object degrades to "silently skipped"
- * rather than a runtime type lie.
- */
-import { useCallback, useRef, useState } from "react";
-import { Reducer, ingestAgEvents, type AgReduceResult, type JsonValue } from "@silverprotocol/core";
-
-/**
- * Normalize a `VITE_*` env URL: an empty/whitespace declaration (e.g. a
- * `VITE_X=` line copied from `.env.example`) loads as `""`, not `undefined`,
- * which would defeat a `??` fallback — treat it as unset. Shared by this
- * file's `AGENT_URL` and `App.tsx`'s `SANDBOX_URL` so both read sites agree.
- */
-export function envUrl(value: string | undefined): string | undefined {
-  const trimmed = value?.trim();
-  return trimmed ? trimmed : undefined;
-}
-
-export const AGENT_URL =
-  envUrl(import.meta.env.VITE_AGENT_ENDPOINT_URL) ?? "http://localhost:6790";
-
-/** Parse complete SSE frame blocks ("event: x\ndata: {...}") out of a growing buffer. */
-function parseFrames(buffer: string): {
-  frames: Array<{ event: string; data: string }>;
-  rest: string;
-} {
-  const parts = buffer.split("\n\n");
-  const rest = parts.pop() ?? "";
-  const frames = parts.map((block) => {
-    const event = /^event: (.*)$/m.exec(block)?.[1] ?? "message";
-    const data = /^data: (.*)$/m.exec(block)?.[1] ?? "";
-    return { event, data };
-  });
-  return { frames, rest };
-}
-
-export interface UseAgentChatResult {
-  /** The reducer's current folded state — fresh on every `message` frame. */
-  result: AgReduceResult;
-  /** True while a `send()` request is streaming. */
-  busy: boolean;
-  /** Last transport/agent error, or `null`. */
-  error: string | null;
-  /** True when the reducer detected a sequence gap and parked (needs a `messages.snapshot` to recover). */
-  needsResync: boolean;
-  send: (text: string) => Promise<void>;
-}
-
-export function useAgentChat(): UseAgentChatResult {
-  const reducerRef = useRef(new Reducer());
-  // No payload — just a re-render trigger every time the mutable reducer
-  // advances, so `reducerRef.current.result()` below re-derives fresh state.
-  const [, bump] = useState(0);
-  const [busy, setBusy] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  const send = useCallback(async (text: string) => {
-    setBusy(true);
-    setError(null);
-    const res = await fetch(`${AGENT_URL}/agent/invoke`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ input: text }),
-    });
-    if (!res.ok || !res.body) {
-      setError(`agent returned ${res.status}`);
-      setBusy(false);
-      return;
-    }
-    const decoder = new TextDecoder();
-    let buffer = "";
-    const reader = res.body.getReader();
-    for (;;) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      const { frames, rest } = parseFrames(buffer);
-      buffer = rest;
-      for (const frame of frames) {
-        if (frame.event === "message") {
-          let raw: JsonValue;
-          try {
-            raw = JSON.parse(frame.data) as JsonValue;
-          } catch {
-            continue; // malformed frame — skip rather than crash the stream
-          }
-          const events = ingestAgEvents(Array.isArray(raw) ? raw : []);
-          for (const ev of events) reducerRef.current.push(ev);
-          bump((v) => v + 1);
-        } else if (frame.event === "error") {
-          try {
-            const payload = JSON.parse(frame.data) as { message?: string };
-            setError(payload.message ?? "agent error");
-          } catch {
-            setError("agent error");
-          }
-        }
-      }
-    }
-    setBusy(false);
-  }, []);
-
-  return {
-    result: reducerRef.current.result(),
-    busy,
-    error,
-    needsResync: reducerRef.current.needsResync,
-    send,
-  };
-}

package/dist/templates/google-adk/web/src/vite-env.d.ts

@@ -1,27 +0,0 @@
-/// <reference types="vite/client" />
-
-/**
- * Typed Vite env vars. `import.meta.env` is Vite's analog of Next.js's
- * `process.env.NEXT_PUBLIC_*` — anything declared here is exposed to the
- * browser bundle at build time.
- */
-interface ImportMetaEnv {
-  /**
-   * The agent's base URL (e.g. `http://localhost:6790` in local dev, via
-   * `guuey dev`). Falls back to that same local-dev default when unset —
-   * see `useAgentChat.ts`.
-   */
-  readonly VITE_AGENT_ENDPOINT_URL?: string;
-  /**
-   * Second-origin MCP-Apps sandbox page URL for `<AppRenderer>` (e.g.
-   * `https://sandbox.example.com/sandbox.html`). Optional in dev — the
-   * `sandboxProxyPlugin` in `vite.config.ts` serves one on :6891. REQUIRED
-   * for deployed builds that render UI resources: without it the app shows
-   * a plain-text notice instead (see `App.tsx` + `../sandbox-proxy.ts`).
-   */
-  readonly VITE_SANDBOX_URL?: string;
-}
-
-interface ImportMeta {
-  readonly env: ImportMetaEnv;
-}

package/dist/templates/google-adk/web/tsconfig.json

@@ -1,20 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2023",
-    "lib": ["dom", "dom.iterable", "esnext"],
-    "useDefineForClassFields": true,
-    "allowJs": true,
-    "skipLibCheck": true,
-    "strict": true,
-    "noEmit": true,
-    "esModuleInterop": true,
-    "module": "esnext",
-    "moduleResolution": "bundler",
-    "resolveJsonModule": true,
-    "isolatedModules": true,
-    "jsx": "react-jsx",
-    "types": ["vite/client"]
-  },
-  "include": ["src", "vite.config.ts", "sandbox-proxy.ts"],
-  "exclude": ["node_modules", "dist"]
-}

package/dist/templates/google-adk/web/vite.config.ts

@@ -1,12 +0,0 @@
-import { defineConfig } from "vite";
-import react from "@vitejs/plugin-react";
-import { sandboxProxyPlugin } from "./sandbox-proxy";
-
-// Port is passed via the `dev` script's `--port 6890` flag (see package.json)
-// so it stays visible in one place; `scripts/dev.mjs` boots this on the same
-// port. The sandbox proxy plugin serves the MCP-Apps sandbox page on :6891 —
-// a SECOND origin, as the spec's double-iframe architecture requires (see
-// ./sandbox-proxy.ts).
-export default defineConfig({
-  plugins: [react(), sandboxProxyPlugin()],
-});

package/dist/templates/openai-agents-sdk/web/.env.example

@@ -1,17 +0,0 @@
-# Vite env for the web chat client. Copy to `web/.env.local` and UNCOMMENT
-# the vars you want to override. (Vite reads env files from this directory —
-# not the project root. Keep unused vars commented out: an empty
-# `VITE_X=` declaration loads as "" — not undefined.)
-
-# Agent base URL. Defaults to the local `guuey dev` router (:6790).
-# VITE_AGENT_ENDPOINT_URL=http://localhost:6790
-
-# Second-origin MCP-Apps sandbox page for @mcp-ui/client's <AppRenderer>.
-# The MCP Apps spec requires UI resources to mount from a DIFFERENT origin
-# than the app itself (double-iframe sandbox). In local dev this is served
-# automatically on http://127.0.0.1:6891/sandbox.html by the
-# sandboxProxyPlugin in vite.config.ts — leave unset. For a DEPLOYED build,
-# host ../sandbox-proxy.ts's sandbox page on its own origin and point this
-# at it; if unset in production, UI resources show a plain-text notice
-# instead of rendering.
-# VITE_SANDBOX_URL=https://sandbox.example.com/sandbox.html

package/dist/templates/openai-agents-sdk/web/sandbox-proxy.ts

@@ -1,239 +0,0 @@
-/**
- * MCP-Apps sandbox proxy for local dev — a Vite plugin that serves the
- * spec-canonical `sandbox.html` on a SECOND localhost port (:6891), i.e. a
- * different origin from the SPA (:6890).
- *
- * # Why a second origin
- *
- * The MCP Apps spec's double-iframe sandbox architecture mandates that the
- * host page and the sandbox iframe live on DIFFERENT origins: the host wraps
- * the sandbox iframe, the sandbox iframe wraps the untrusted app HTML, and
- * the origin split means a compromised app cannot reach the host's APIs via
- * same-origin DOM access. `@mcp-ui/client`'s `<AppRenderer>` takes a
- * `sandbox: { url }` prop pointing at this page. A different localhost PORT
- * is a different origin, so one extra listener is all local dev needs.
- *
- * # Reference impl
- *
- * The HTML below is adapted from the spec's reference host
- * (`github.com/modelcontextprotocol/ext-apps/examples/basic-host/` —
- * sandbox.html + src/sandbox.ts + serve.ts), matching the pattern
- * `@ggui-ai/agent-server`'s bundled sandbox proxy uses. CSP arrives as a
- * `?csp=<urlencoded-json>` query param and is applied via HTTP HEADERS
- * (tamper-proof — a `<meta>` CSP could be overridden by injected inline
- * scripts), which is why this must be a real server, not a static file.
- *
- * # Deploying `web/`
- *
- * This plugin only runs under `vite` dev (`apply: "serve"`). A deployed
- * build must point `VITE_SANDBOX_URL` at a hosted copy of this page on its
- * own origin (see `.env.example`); without it the app falls back to a
- * "UI resource received" notice instead of mounting UI same-origin.
- */
-import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
-import type { Plugin } from "vite";
-
-/**
- * The sandbox proxy's dev port. web/ runs on :6890; keep the `6891` literal
- * in `src/App.tsx` (`DEV_SANDBOX_URL`) in sync — App.tsx cannot import this
- * module (it would drag `node:http` into the browser bundle).
- */
-export const SANDBOX_PROXY_PORT = 6891;
-
-/** CSP shape `<AppRenderer>` forwards on the sandbox URL's `?csp=` param. */
-interface McpUiResourceCsp {
-  readonly resourceDomains?: readonly string[];
-  readonly connectDomains?: readonly string[];
-  readonly frameDomains?: readonly string[];
-  readonly baseUriDomains?: readonly string[];
-}
-
-/** Drop CSP entries carrying directive-injection characters (`;`, newlines, quotes, spaces). */
-function sanitizeCspDomains(domains: readonly string[] | undefined): readonly string[] {
-  if (!domains) return [];
-  return domains.filter((d) => typeof d === "string" && !/[;\r\n'" ]/.test(d));
-}
-
-/** Build the CSP header value — mirrors the upstream basic-host `serve.ts`. */
-function buildCspHeader(csp: McpUiResourceCsp | undefined): string {
-  const resourceDomains = sanitizeCspDomains(csp?.resourceDomains).join(" ");
-  const connectDomains = sanitizeCspDomains(csp?.connectDomains).join(" ");
-  const frameDomains = sanitizeCspDomains(csp?.frameDomains).join(" ");
-  const baseUriDomains = sanitizeCspDomains(csp?.baseUriDomains).join(" ");
-  return [
-    "default-src 'self' 'unsafe-inline'",
-    `script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: ${resourceDomains}`.trim(),
-    `style-src 'self' 'unsafe-inline' blob: data: ${resourceDomains}`.trim(),
-    `img-src 'self' data: blob: ${resourceDomains}`.trim(),
-    `font-src 'self' data: blob: ${resourceDomains}`.trim(),
-    `media-src 'self' data: blob: ${resourceDomains}`.trim(),
-    `connect-src 'self' ${connectDomains}`.trim(),
-    `worker-src 'self' blob: ${resourceDomains}`.trim(),
-    frameDomains.length > 0 ? `frame-src ${frameDomains}` : "frame-src 'none'",
-    "object-src 'none'",
-    baseUriDomains.length > 0 ? `base-uri ${baseUriDomains}` : "base-uri 'none'",
-  ].join("; ");
-}
-
-/**
- * The self-contained sandbox.html. The inlined script:
- *
- *   1. Asserts iframe isolation (throws if it can reach `window.top`).
- *   2. Creates an inner iframe sandboxed with `allow-scripts
- *      allow-same-origin allow-forms`.
- *   3. On `ui/notifications/sandbox-resource-ready` from the parent, writes
- *      the app HTML into the inner iframe.
- *   4. Relays every other postMessage bidirectionally, origin-checked.
- *   5. Posts `ui/notifications/sandbox-proxy-ready` once attached.
- */
-const SANDBOX_HTML = `<!doctype html>
-<html>
-  <head>
-    <meta charset="utf-8" />
-    <meta name="color-scheme" content="light dark">
-    <title>sandbox proxy</title>
-    <style>
-      html, body { margin: 0; height: 100vh; height: 100dvh; width: 100%; background-color: transparent; }
-      body { display: flex; flex-direction: column; }
-      * { box-sizing: border-box; }
-      iframe {
-        background-color: transparent;
-        border: 0px none transparent;
-        padding: 0px;
-        overflow: hidden;
-        flex-grow: 1;
-        color-scheme: inherit;
-      }
-    </style>
-  </head>
-  <body>
-    <script>
-(function(){
-  'use strict';
-  if (window.self === window.top) {
-    throw new Error('This file is only to be used in an iframe sandbox.');
-  }
-  if (!document.referrer) {
-    throw new Error('No referrer, cannot validate embedding site.');
-  }
-  var EXPECTED_HOST_ORIGIN = new URL(document.referrer).origin;
-  var OWN_ORIGIN = new URL(window.location.href).origin;
-  // Security self-test: top access MUST throw (sandbox attribute strips same-origin).
-  try {
-    window.top.alert('If you see this, the sandbox is not setup securely.');
-    throw 'FAIL';
-  } catch (e) {
-    if (e === 'FAIL') {
-      throw new Error('The sandbox is not setup securely.');
-    }
-  }
-  // Inner iframe — the untrusted app HTML lands here.
-  var inner = document.createElement('iframe');
-  inner.style = 'width:100%; height:100%; border:none;';
-  inner.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-forms');
-  document.body.appendChild(inner);
-  var RESOURCE_READY = 'ui/notifications/sandbox-resource-ready';
-  var PROXY_READY = 'ui/notifications/sandbox-proxy-ready';
-  window.addEventListener('message', function(event) {
-    if (event.source === window.parent) {
-      if (event.origin !== EXPECTED_HOST_ORIGIN) {
-        console.error('[Sandbox] Rejecting parent message from unexpected origin:', event.origin);
-        return;
-      }
-      if (event.data && event.data.method === RESOURCE_READY) {
-        var params = event.data.params || {};
-        var html = params.html;
-        var sandboxAttr = params.sandbox;
-        if (typeof sandboxAttr === 'string') {
-          inner.setAttribute('sandbox', sandboxAttr);
-        }
-        if (typeof html === 'string') {
-          var doc = inner.contentDocument || (inner.contentWindow && inner.contentWindow.document);
-          if (doc) {
-            doc.open();
-            doc.write(html);
-            doc.close();
-          } else {
-            inner.srcdoc = html;
-          }
-        }
-      } else {
-        if (inner && inner.contentWindow) {
-          inner.contentWindow.postMessage(event.data, '*');
-        }
-      }
-    } else if (event.source === inner.contentWindow) {
-      if (event.origin !== OWN_ORIGIN) {
-        console.error('[Sandbox] Rejecting inner message from unexpected origin:', event.origin);
-        return;
-      }
-      window.parent.postMessage(event.data, EXPECTED_HOST_ORIGIN);
-    }
-  });
-  window.parent.postMessage({
-    jsonrpc: '2.0',
-    method: PROXY_READY,
-    params: {},
-  }, EXPECTED_HOST_ORIGIN);
-})();
-    </script>
-  </body>
-</html>`;
-
-function handleRequest(req: IncomingMessage, res: ServerResponse): void {
-  const url = new URL(req.url ?? "/", "http://placeholder");
-  if (req.method === "GET" && (url.pathname === "/" || url.pathname === "/sandbox.html")) {
-    let csp: McpUiResourceCsp | undefined;
-    const cspParam = url.searchParams.get("csp");
-    if (cspParam !== null) {
-      try {
-        const parsed: unknown = JSON.parse(cspParam);
-        if (parsed !== null && typeof parsed === "object") {
-          csp = parsed as McpUiResourceCsp;
-        }
-      } catch {
-        // Malformed ?csp= — fall through to the default (self-only) header;
-        // an app loading external resources will surface a CSP violation in
-        // the console rather than silently widening the policy.
-      }
-    }
-    res.setHeader("Content-Security-Policy", buildCspHeader(csp));
-    res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
-    res.setHeader("Content-Type", "text/html; charset=utf-8");
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    res.statusCode = 200;
-    res.end(SANDBOX_HTML);
-    return;
-  }
-  res.statusCode = 404;
-  res.setHeader("Content-Type", "text/plain; charset=utf-8");
-  res.end("sandbox proxy: only GET /sandbox.html is served here\n");
-}
-
-/**
- * Vite plugin: boot the sandbox proxy alongside `vite` dev, tear it down
- * with it. Dev-only (`apply: "serve"`); deployed builds set
- * `VITE_SANDBOX_URL` instead.
- */
-export function sandboxProxyPlugin(): Plugin {
-  let server: Server | undefined;
-  return {
-    name: "agentic-app-template:mcp-apps-sandbox-proxy",
-    apply: "serve",
-    configureServer(vite) {
-      server = createServer(handleRequest);
-      server.on("error", (err) => {
-        vite.config.logger.error(`[sandbox-proxy] ${String(err)}`);
-      });
-      server.listen(SANDBOX_PROXY_PORT, "127.0.0.1", () => {
-        vite.config.logger.info(
-          `  sandbox proxy: http://127.0.0.1:${SANDBOX_PROXY_PORT}/sandbox.html`
-        );
-      });
-      vite.httpServer?.on("close", () => {
-        server?.close();
-        server = undefined;
-      });
-    },
-  };
-}