create-ailk 0.17.0 → 0.19.0

package/templates/apps/mcp/__tests__/workspace-surface.test.ts

@@ -1,364 +0,0 @@
-// oss: false
-/**
- * The signed-in workspace surface at the transport (#3591 D15, D16 — spec
- * AC-5 and AC-6).
- *
- * Two real servers on ephemeral ports: apps/mcp's HTTP transport, and a stub
- * of apps/api that answers every twin route and REFUSES any request whose
- * `Authorization` header is not the caller's key — so a tool that forwarded
- * no key, or another one, fails here rather than passing on a mock.
- *
- * - each of the eleven tools forwards the caller's key to its twin route's
- *   path, with its query and body, and returns the twin's `data`;
- * - a POST to `/mcp/workspace` with no key, a personal-token-shaped key or
- *   another scheme is 401, and the stub sees no call;
- * - GET and DELETE are 405; a JSON-RPC batch is 400;
- * - when the stub answers 403 the tool error carries the code and status,
- *   never the key;
- * - `/mcp` is unchanged: a key sent there changes nothing, and it lists no
- *   workspace tool.
- *
- * No fixture holds a key-shaped literal: the key is built at run time.
- */
-
-import { createServer, type IncomingMessage, type Server } from "node:http";
-import type { AddressInfo } from "node:net";
-
-import type { FastifyInstance } from "fastify";
-
-import { SITE_ARGS, SITE_WIRE } from "../../../tests/parity/api-parity/fixtures/site-wire";
-import { buildHttpTransportApp } from "../src/http-transport.js";
-import { listRegisteredTools } from "../src/server.js";
-import { listWorkspaceTools } from "../src/workspace-server.js";
-
-const KEY = ["ailk", "agt", "w".repeat(43)].join("_");
-const PERSONAL_TOKEN = ["tok", "x".repeat(40)].join("_");
-
-const CONFIG = {
-  path: "/mcp",
-  stateless: true,
-  rateLimits: { readPerMin: 1000, writePerMin: 1000 },
-  cors: { writeAllowedOrigins: [] as string[] },
-  abuse: { captureLeadDailyCapPerIp: 50, blockedUserAgents: "" },
-} as const;
-
-const WS = SITE_ARGS.get_inbox_message.workspaceId;
-const LEAD = SITE_ARGS.get_inbox_message.leadId;
-const LISTING = SITE_ARGS.get_inbox_application.id;
-
-/** Each tool: the twin request the stub must see, and the `data` it answers. */
-const TWINS: ReadonlyArray<{
-  tool: keyof typeof SITE_WIRE;
-  method: string;
-  path: string;
-  body?: unknown;
-}> = [
-  { tool: "get_agent_context", method: "GET", path: "/v1/agent/context" },
-  {
-    tool: "list_inbox_messages",
-    method: "GET",
-    path: `/v1/workspaces/${WS}/messages?limit=25`,
-  },
-  {
-    tool: "get_inbox_message",
-    method: "GET",
-    path: `/v1/workspaces/${WS}/messages/${LEAD}`,
-  },
-  {
-    tool: "mark_inbox_message_done",
-    method: "PATCH",
-    path: `/v1/workspaces/${WS}/messages/${LEAD}`,
-    body: { handled: true },
-  },
-  {
-    tool: "accept_inbox_message",
-    method: "POST",
-    path: `/v1/workspaces/${WS}/messages/${LEAD}/accept`,
-    body: { accept: true },
-  },
-  {
-    tool: "list_inbox_submissions",
-    method: "GET",
-    path: `/v1/workspaces/${WS}/submissions?limit=25&state=unhandled`,
-  },
-  {
-    tool: "get_inbox_submission",
-    method: "GET",
-    path: `/v1/workspaces/${WS}/submissions/${LEAD}`,
-  },
-  {
-    tool: "mark_inbox_submission_done",
-    method: "PATCH",
-    path: `/v1/workspaces/${WS}/submissions/${LEAD}`,
-    body: { handled: true },
-  },
-  {
-    tool: "list_inbox_applications",
-    method: "GET",
-    path: "/v1/project-listings",
-  },
-  {
-    tool: "get_inbox_application",
-    method: "GET",
-    path: `/v1/project-listings/${LISTING}`,
-  },
-  {
-    tool: "decide_inbox_application",
-    method: "PATCH",
-    path: `/v1/project-listings/${LISTING}`,
-    body: { status: "active" },
-  },
-];
-
-// ── The apps/api stub ────────────────────────────────────────────────────────
-
-interface SeenCall {
-  method: string;
-  path: string;
-  authorization: string | undefined;
-  body: unknown;
-}
-
-let api: Server;
-let seen: SeenCall[] = [];
-/** When set, every call is answered with this refusal instead. */
-let refuseWith: { status: number; code: string } | null = null;
-
-async function readBody(req: IncomingMessage): Promise<unknown> {
-  let text = "";
-  for await (const chunk of req) text += chunk;
-  return text === "" ? undefined : JSON.parse(text);
-}
-
-function startApiStub(): Promise<Server> {
-  const server = createServer(async (req, res) => {
-    const body = await readBody(req);
-    seen.push({
-      method: req.method ?? "",
-      path: req.url ?? "",
-      authorization: req.headers["authorization"],
-      body,
-    });
-    const send = (status: number, payload: unknown) => {
-      res.writeHead(status, { "content-type": "application/json" });
-      res.end(JSON.stringify(payload));
-    };
-    // The stub is apps/api's one check: no key, no data.
-    if (req.headers["authorization"] !== `Bearer ${KEY}`) {
-      return send(401, {
-        ok: false,
-        error: { code: "unauthorized", message: "Authentication required" },
-      });
-    }
-    if (refuseWith) {
-      return send(refuseWith.status, {
-        ok: false,
-        error: { code: refuseWith.code, message: "Refused" },
-      });
-    }
-    const twin = TWINS.find(
-      (t) => t.method === req.method && t.path === req.url,
-    );
-    if (!twin) {
-      return send(404, {
-        ok: false,
-        error: { code: "not_found", message: "No such route" },
-      });
-    }
-    return send(200, { ok: true, data: SITE_WIRE[twin.tool] });
-  });
-  return new Promise((resolve) =>
-    server.listen(0, "127.0.0.1", () => resolve(server)),
-  );
-}
-
-// ── The apps/mcp transport ───────────────────────────────────────────────────
-
-let app: FastifyInstance;
-let port: number;
-const priorModules = process.env.AILK_ENABLED_MODULES;
-const priorApiUrl = process.env.AILK_API_URL;
-
-beforeAll(async () => {
-  process.env.AILK_ENABLED_MODULES = "workspace,multi-tenant,signal-collectors";
-  api = await startApiStub();
-  process.env.AILK_API_URL = `http://127.0.0.1:${(api.address() as AddressInfo).port}`;
-  app = await buildHttpTransportApp(CONFIG);
-  await app.listen({ host: "127.0.0.1", port: 0 });
-  port = (app.server.address() as AddressInfo).port;
-});
-
-afterAll(async () => {
-  await app.close();
-  await new Promise((resolve) => api.close(resolve));
-  if (priorModules === undefined) delete process.env.AILK_ENABLED_MODULES;
-  else process.env.AILK_ENABLED_MODULES = priorModules;
-  if (priorApiUrl === undefined) delete process.env.AILK_API_URL;
-  else process.env.AILK_API_URL = priorApiUrl;
-});
-
-beforeEach(() => {
-  seen = [];
-  refuseWith = null;
-});
-
-type JsonRpcResponse = {
-  result?: {
-    tools?: { name: string }[];
-    content?: { type: string; text: string }[];
-    isError?: boolean;
-  };
-  error?: { code: number; message: string };
-};
-
-function rpc(method: string, params: object = {}, id = 1) {
-  return { jsonrpc: "2.0", id, method, params };
-}
-
-function post(
-  path: string,
-  payload: unknown,
-  headers: Record<string, string> = {},
-): Promise<Response> {
-  return fetch(`http://127.0.0.1:${port}${path}`, {
-    method: "POST",
-    body: JSON.stringify(payload),
-    headers: {
-      "content-type": "application/json",
-      accept: "application/json, text/event-stream",
-      ...headers,
-    },
-  });
-}
-
-const withKey = { authorization: `Bearer ${KEY}` };
-
-async function callTool(name: string, args: object) {
-  const res = await post(
-    "/mcp/workspace",
-    rpc("tools/call", { name, arguments: args }),
-    withKey,
-  );
-  expect(res.status).toBe(200);
-  const text = await res.text();
-  const body = JSON.parse(text) as JsonRpcResponse;
-  return { text, result: body.result! };
-}
-
-// ── AC-5 — the eleven tools forward the key to their twins ───────────────────
-
-describe("/mcp/workspace — each tool forwards the caller's key to its twin (AC-5)", () => {
-  it("lists exactly the eleven signed-in tools", async () => {
-    const res = await post("/mcp/workspace", rpc("tools/list"), withKey);
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as JsonRpcResponse;
-    const names = body.result!.tools!.map((t) => t.name);
-    expect(names).toEqual(TWINS.map((t) => t.tool));
-    expect(names).toEqual(listWorkspaceTools());
-  });
-
-  it.each(TWINS)(
-    "$tool → $method $path, with the key, returning the twin's data",
-    async ({ tool, method, path, body }) => {
-      const { result } = await callTool(tool, SITE_ARGS[tool]);
-      expect(seen).toEqual([
-        { method, path, authorization: `Bearer ${KEY}`, body },
-      ]);
-      expect(result.isError).toBeFalsy();
-      expect(JSON.parse(result.content![0]!.text)).toEqual({
-        ok: true,
-        data: SITE_WIRE[tool],
-      });
-    },
-  );
-});
-
-describe("/mcp/workspace — refused before any tool runs (AC-5)", () => {
-  const call = rpc("tools/call", {
-    name: "list_inbox_messages",
-    arguments: SITE_ARGS.list_inbox_messages,
-  });
-
-  it.each<[string, Record<string, string>]>([
-    ["no Authorization header", {}],
-    [
-      "a personal-token-shaped bearer",
-      { authorization: `Bearer ${PERSONAL_TOKEN}` },
-    ],
-    ["an agent key under another scheme", { authorization: `Basic ${KEY}` }],
-    ["a truncated agent key", { authorization: `Bearer ${KEY.slice(0, -1)}` }],
-  ])("%s is 401, and apps/api sees no call", async (_label, headers) => {
-    const res = await post("/mcp/workspace", call, headers);
-    expect(res.status).toBe(401);
-    expect(await res.json()).toEqual({ error: "unauthorized" });
-    expect(seen).toEqual([]);
-  });
-
-  it.each(["GET", "DELETE"])("%s is 405 — the path keeps no session", async (method) => {
-    const res = await fetch(`http://127.0.0.1:${port}/mcp/workspace`, {
-      method,
-      headers: withKey,
-    });
-    expect(res.status).toBe(405);
-    expect(res.headers.get("allow")).toBe("POST");
-  });
-
-  it("a JSON-RPC batch is 400, and no call in it runs", async () => {
-    const res = await post(
-      "/mcp/workspace",
-      [call, { ...call, id: 2 }],
-      withKey,
-    );
-    expect(res.status).toBe(400);
-    expect(seen).toEqual([]);
-  });
-});
-
-describe("/mcp/workspace — a refusal from apps/api (AC-5)", () => {
-  it("a 403 becomes a tool error carrying the code and status, never the key", async () => {
-    refuseWith = { status: 403, code: "forbidden" };
-    const { text, result } = await callTool(
-      "decide_inbox_application",
-      SITE_ARGS.decide_inbox_application,
-    );
-    expect(seen).toHaveLength(1);
-    expect(result.isError).toBe(true);
-    expect(JSON.parse(result.content![0]!.text)).toEqual({
-      ok: false,
-      error: { code: "forbidden", status: 403 },
-    });
-    expect(text).not.toContain(KEY);
-  });
-});
-
-// ── AC-6 — the anonymous /mcp is unchanged ───────────────────────────────────
-
-describe("/mcp — the anonymous surface never reads Authorization (AC-6)", () => {
-  async function listAt(headers: Record<string, string>) {
-    const res = await post("/mcp", rpc("tools/list"), headers);
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as JsonRpcResponse;
-    return body.result!.tools!.map((t) => t.name);
-  }
-
-  it("lists the same anonymous tools with or without an agent key, and no workspace tool", async () => {
-    const bare = await listAt({});
-    expect(await listAt(withKey)).toEqual(bare);
-    expect(bare.sort()).toEqual(listRegisteredTools().map((t) => t.name).sort());
-    for (const name of TWINS.map((t) => t.tool)) {
-      expect(bare).not.toContain(name);
-    }
-  });
-
-  it("does not serve a workspace tool, even to a caller holding a key", async () => {
-    const res = await post(
-      "/mcp",
-      rpc("tools/call", { name: "get_agent_context", arguments: {} }),
-      withKey,
-    );
-    const text = await res.text();
-    expect(text).toMatch(/get_agent_context/);
-    expect(text).toMatch(/not found/i);
-    expect(seen).toEqual([]);
-  });
-});

package/templates/apps/web/app/[locale]/(authed)/account/settings/color-mode.tsx

@@ -1,68 +0,0 @@
-"use client"; // reads and writes the theme cookie and the root's data-theme
-
-/**
- * ColorModeSetting — User settings › General's color mode (#7430, spec 7423
- * D4; DESIGN.md §5.12a): Light · Auto · Dark as a `SegmentedControl` of
- * three equal cells. The settings page renders it only when the site's
- * theme defines more than one mode (operator fold-in 2026-10-01).
- *
- * The same cookie and the same `data-theme` contract the locale layout's
- * flash-prevention script reads: `light` / `dark` pass through; `system`
- * (Auto) follows `prefers-color-scheme`.
- */
-
-import { SegmentedControl } from "@working-theory/ui/primitives";
-import { useEffect, useState, type ReactElement } from "react";
-
-type Mode = "light" | "system" | "dark";
-
-const COOKIE_NAME = process.env.NEXT_PUBLIC_THEME_COOKIE_NAME ?? "ailk-theme";
-const ONE_YEAR = 60 * 60 * 24 * 365;
-
-function readMode(): Mode {
-  const match = document.cookie.match(new RegExp(`(?:^|;\\s*)${COOKIE_NAME}=([^;]+)`));
-  const value = match?.[1];
-  return value === "light" || value === "dark" ? value : "system";
-}
-
-function applyMode(mode: Mode): void {
-  document.cookie = `${COOKIE_NAME}=${mode}; path=/; max-age=${ONE_YEAR}; SameSite=Lax`;
-  const dark =
-    mode === "dark" ||
-    (mode === "system" &&
-      typeof window.matchMedia === "function" &&
-      window.matchMedia("(prefers-color-scheme: dark)").matches);
-  document.documentElement.setAttribute("data-theme", dark ? "dark" : "light");
-}
-
-export function ColorModeSetting({
-  labels,
-}: {
-  labels: { title: string; light: string; auto: string; dark: string };
-}): ReactElement {
-  // Auto until mounted — the server cannot read the cookie's effect, and the
-  // first client render must match it.
-  const [mode, setMode] = useState<Mode>("system");
-  useEffect(() => {
-    setMode(readMode());
-  }, []);
-
-  return (
-    <SegmentedControl
-      aria-label={labels.title}
-      options={[
-        { value: "light", label: labels.light },
-        { value: "system", label: labels.auto },
-        { value: "dark", label: labels.dark },
-      ]}
-      value={mode}
-      onValueChange={(value) => {
-        const next = value as Mode;
-        setMode(next);
-        applyMode(next);
-      }}
-      touchTargetFloor
-      data-testid="account-color-mode"
-    />
-  );
-}

package/templates/apps/web/app/[locale]/(authed)/account/settings/deletion-request.tsx

@@ -1,55 +0,0 @@
-"use client"; // submits through the account's Server Action and shows its outcome
-
-/**
- * DeletionRequest — User settings › Privacy's "Request account deletion"
- * (#7430, spec 7423 D10). Files a Support request of kind `deletion`; an
- * operator completes it (deletion needs an operator step today, so nothing
- * is deleted on click).
- */
-
-import { Button, InlineMessage } from "@working-theory/ui/primitives";
-import { useActionState, type ReactElement } from "react";
-
-import { submitSupportRequest, type SupportRequestState } from "../support-actions";
-
-export interface DeletionRequestLabels {
-  action: string;
-  subject: string;
-  message: string;
-  sent: string;
-  error: string;
-}
-
-export function DeletionRequest({ labels }: { labels: DeletionRequestLabels }): ReactElement {
-  const [state, formAction, pending] = useActionState<SupportRequestState, FormData>(
-    submitSupportRequest,
-    { kind: "idle" },
-  );
-
-  if (state.kind === "success") {
-    return (
-      <InlineMessage variant="success" role="status" className="text-body-sm">
-        {labels.sent}
-      </InlineMessage>
-    );
-  }
-
-  return (
-    <form action={formAction} className="flex flex-col items-start gap-2">
-      <input type="hidden" name="kind" value="deletion" />
-      <input type="hidden" name="subject" value={labels.subject} />
-      <input type="hidden" name="message" value={labels.message} />
-      <Button
-        type="submit"
-        variant="secondary"
-        disabled={pending}
-        data-testid="account-deletion-request"
-      >
-        {labels.action}
-      </Button>
-      {state.kind === "error" ? (
-        <InlineMessage variant="error">{labels.error}</InlineMessage>
-      ) : null}
-    </form>
-  );
-}

package/templates/apps/web/app/[locale]/(authed)/account/settings/name-form.tsx

@@ -1,118 +0,0 @@
-"use client"; // edits the session's name through Better Auth's client, then refreshes the route
-
-/**
- * NameForm — User settings › General's name field (#7430, operator fold-in
- * 2026-10-01). An accepted applicant arrives with no name (#7418), so the
- * member SETS it here, and edits it later. Saved through Better Auth's own
- * `updateUser` (its `/update-user` endpoint — no new API), then the route
- * refreshes so the frame's avatar and the "Add your name" For-you item
- * re-read the session.
- *
- * DESIGN.md §5.12: the form ends with a hairline and a save row — "No
- * unsaved changes" / "Unsaved changes" and a Save that is disabled until
- * dirty.
- */
-
-import { Button, Input, InlineMessage, Label, Text } from "@working-theory/ui/primitives";
-import { createAuthClient } from "better-auth/react";
-import { useRouter } from "next/navigation";
-import { useId, useState, type FormEvent, type ReactElement } from "react";
-
-const authClient = createAuthClient();
-
-export interface NameFormLabels {
-  name: string;
-  placeholder: string;
-  save: string;
-  saving: string;
-  saved: string;
-  unsaved: string;
-  clean: string;
-  required: string;
-  error: string;
-}
-
-export function NameForm({
-  initialName,
-  labels,
-}: {
-  initialName: string;
-  labels: NameFormLabels;
-}): ReactElement {
-  const router = useRouter();
-  const inputId = useId();
-  const [saved, setSaved] = useState(initialName);
-  const [name, setName] = useState(initialName);
-  const [state, setState] = useState<"idle" | "saving" | "saved" | "required" | "error">("idle");
-  const dirty = name !== saved;
-
-  const onSubmit = async (event: FormEvent<HTMLFormElement>): Promise<void> => {
-    event.preventDefault();
-    const next = name.trim();
-    if (!next) {
-      setState("required");
-      return;
-    }
-    setState("saving");
-    try {
-      const { error } = await authClient.updateUser({ name: next });
-      if (error) {
-        setState("error");
-        return;
-      }
-    } catch {
-      // A network failure throws rather than answering `error`.
-      setState("error");
-      return;
-    }
-    setSaved(next);
-    setName(next);
-    setState("saved");
-    router.refresh();
-  };
-
-  const status =
-    state === "saved" && !dirty ? labels.saved : dirty ? labels.unsaved : labels.clean;
-
-  return (
-    <form
-      onSubmit={(event) => void onSubmit(event)}
-      className="flex flex-col gap-2"
-      data-testid="account-name-form"
-    >
-      <Label htmlFor={inputId}>{labels.name}</Label>
-      <Input
-        id={inputId}
-        name="name"
-        autoComplete="name"
-        value={name}
-        placeholder={labels.placeholder}
-        onChange={(event) => {
-          setName(event.target.value);
-          if (state !== "saving") setState("idle");
-        }}
-        className="max-w-md"
-        data-testid="account-name-input"
-      />
-      {state === "required" || state === "error" ? (
-        <InlineMessage variant="error">
-          {state === "required" ? labels.required : labels.error}
-        </InlineMessage>
-      ) : null}
-      <div className="mt-2 flex items-center justify-between gap-4 border-t border-(--color-border) pt-4">
-        <div aria-live="polite" data-testid="account-name-status">
-          <Text as="p" variant="caption" tone="muted">
-            {status}
-          </Text>
-        </div>
-        <Button
-          type="submit"
-          disabled={!dirty || state === "saving"}
-          data-testid="account-name-save"
-        >
-          {state === "saving" ? labels.saving : labels.save}
-        </Button>
-      </div>
-    </form>
-  );
-}