create-langgraph-app 1.5.0 → 1.5.1

package/README.md

@@ -2,8 +2,6 @@
 
 Interactive CLI to scaffold a new LangGraph multi-agent project in seconds.
 
-## Usage
-
 ```bash
 npx create-langgraph-app
 ```
@@ -11,28 +9,68 @@ npx create-langgraph-app
 ## What it does
 
 1. Asks for your project name
-2. Lets you pick an LLM provider (OpenAI, Anthropic, Google, Groq, DeepSeek, Ollama)
+2. Lets you pick an LLM provider — OpenAI, Anthropic, Google, Groq, DeepSeek, or Ollama
 3. Lets you select which agent patterns to include:
-   - **Supervisor** — central coordinator + worker agents
+   - **Supervisor** — central coordinator delegating to worker agents
    - **Swarm** — peer-to-peer agent handoffs
    - **Human-in-the-Loop** — approval before dangerous actions
-   - **Structured Output** — typed JSON responses
-   - **RAG** — retrieval-augmented generation
-4. Generates a ready-to-run project with only the patterns you selected
+   - **Structured Output** — typed JSON responses validated by Zod
+   - **RAG** — retrieval-augmented generation over an in-memory vector store
+4. Generates a ready-to-run project containing only the patterns you picked
 5. Installs dependencies
 
+## What you get
+
+```
+src/
+├── config/      env validation, LLM factory, embeddings (with RAG)
+├── agents/      makeAgent() and the helpers your patterns need
+├── apps/        one file per selected pattern
+├── tools/       retrieval tool + vector store (with RAG)
+├── server.ts    Fastify server — invoke, stream, resume, threads
+└── index.ts     CLI demo running each pattern
+tests/           offline tests that need no API key
+```
+
+Everything is built on LangChain's `createAgent` — the **subagents** pattern for
+supervisors, **handoffs** for swarms. No deprecated packages.
+
+## RAG and embeddings
+
+Selecting RAG generates a working implementation: chunking, embedding,
+cosine-similarity search, and a retrieval tool the agent calls before answering.
+Swap `SAMPLE_DOCS` in `src/tools/rag.ts` for your own documents.
+
+Embeddings are a separate capability from chat. OpenAI, Google and Ollama have
+their own; **Anthropic, Groq and DeepSeek do not**, so those projects use OpenAI
+embeddings and need `OPENAI_API_KEY` in addition to the chat provider's key. The
+generated `.env` says so, and `EMBEDDINGS_MODEL` overrides the model.
+
+To run RAG with no API key at all, scaffold with Ollama.
+
+If embeddings are unavailable, only RAG is affected — the other patterns and
+routes keep working, and the server logs why `/rag` is disabled.
+
 ## Development
 
 ```bash
 cd create-langgraph-app
 npm install
-npm run dev  # Run locally
+npm run dev      # run the CLI locally
+npm run build    # typecheck and emit dist/
 ```
 
-## Publishing
+Generated projects are compiled in CI, so a change that breaks the output fails
+the build. See `tests/scaffolder/` in the [starter kit](https://github.com/ac12644/langgraph-starter-kit).
+
+## Releasing
+
+Publishing is automated. Bump the version in `package.json`, then push a
+matching `cli-v*` tag:
 
 ```bash
-cd create-langgraph-app
-npm run build
-npm publish
+git tag -a cli-v1.5.0 -m "create-langgraph-app v1.5.0"
+git push origin cli-v1.5.0
 ```
+
+The `Publish CLI to npm` workflow builds and publishes with provenance.

package/dist/create.js

@@ -485,19 +485,35 @@ function httpError(status: number, message: string) {
   return Object.assign(new Error(message), { statusCode: status });
 }
 
+// \`system\` is excluded: the app owns its system prompt, and accepting one
+// from the request lets any caller override it.
+const CLIENT_ROLES = ["user", "assistant"];
+
 /** Reject malformed bodies before they reach the agent. */
 function validateMessages(raw: unknown): { role: string; content: string }[] {
-  if (raw === undefined) return [];
   if (!Array.isArray(raw)) throw httpError(400, '"messages" must be an array');
+  if (raw.length === 0) throw httpError(400, '"messages" must not be empty');
   return raw.map((m, i) => {
     const { role, content } = (m ?? {}) as Record<string, unknown>;
     if (typeof role !== "string" || typeof content !== "string") {
       throw httpError(400, \`messages[\${i}] needs string "role" and "content"\`);
     }
+    if (!CLIENT_ROLES.includes(role)) {
+      throw httpError(400, \`messages[\${i}].role must be one of: \${CLIENT_ROLES.join(", ")}\`);
+    }
     return { role, content };
   });
 }
 
+/** Defaults to "default"; anything but a non-empty string is a 400, not a 500. */
+function validateThreadId(raw: unknown): string {
+  if (raw === undefined) return "default";
+  if (typeof raw !== "string" || raw.trim() === "") {
+    throw httpError(400, '"thread_id" must be a non-empty string');
+  }
+  return raw;
+}
+
 const server = fastify({ logger: false });
 
 server.setErrorHandler(async (error: FastifyError, _req: FastifyRequest, reply: FastifyReply) => {
@@ -518,9 +534,9 @@ ${entries}${ragEntry}
 
   server.post<{ Params: { app: string } }>("/:app/invoke", async (req, reply) => {
     const app = getApp(req.params.app);
-    const body = (req.body ?? {}) as { messages?: unknown; thread_id?: string };
+    const body = (req.body ?? {}) as { messages?: unknown; thread_id?: unknown };
     const messages = validateMessages(body.messages);
-    const thread_id = body.thread_id ?? "default";
+    const thread_id = validateThreadId(body.thread_id);
 
     const result = await app.invoke({ messages }, { configurable: { thread_id } });
     const last = result.messages.at(-1);
@@ -533,9 +549,9 @@ ${entries}${ragEntry}
 
   server.post<{ Params: { app: string } }>("/:app/stream", async (req, reply) => {
     const app = getApp(req.params.app);
-    const body = (req.body ?? {}) as { messages?: unknown; thread_id?: string };
+    const body = (req.body ?? {}) as { messages?: unknown; thread_id?: unknown };
     const messages = validateMessages(body.messages);
-    const thread_id = body.thread_id ?? "default";
+    const thread_id = validateThreadId(body.thread_id);
 
     reply.raw.writeHead(200, {
       "Content-Type": "text/event-stream",
@@ -561,12 +577,13 @@ ${entries}${ragEntry}
 
   server.post<{ Params: { app: string } }>("/:app/resume", async (req, reply) => {
     const app = getApp(req.params.app);
-    const body = (req.body ?? {}) as { thread_id?: string; decision?: string };
+    const body = (req.body ?? {}) as { thread_id?: unknown; decision?: string };
+    const thread_id = validateThreadId(body.thread_id);
     if (body.decision === undefined) {
       return reply.status(400).send({ error: '"decision" field is required' });
     }
     const result = await app.invoke(new Command({ resume: body.decision }), {
-      configurable: { thread_id: body.thread_id ?? "default" },
+      configurable: { thread_id },
     });
     const last = result.messages.at(-1);
     return reply.send({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-langgraph-app",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Scaffold a new LangGraph multi-agent project in seconds",
   "type": "module",
   "bin": {