frappe-builder 1.1.0-dev.24 → 1.1.0-dev.26

package/.frappe-builder/po-approval/implementation-artifacts/sprint-status.yaml

@@ -2,13 +2,13 @@ feature_id: po-approval
 feature_name: "PO Approval"
 mode: full
 phase: testing
-updated_at: 2026-03-28T14:23:24.878Z
+updated_at: 2026-03-28T14:38:26.634Z
 
 components:
   - id: final-comp
     sort_order: 0
     status: complete
-    completed_at: 2026-03-28T14:23:24.878Z
+    completed_at: 2026-03-28T14:38:26.633Z
 
 progress:
   done: 1

package/config/defaults.ts

@@ -11,7 +11,6 @@ export interface AppConfig {
   allowSubAgents: boolean;
   requirePermission: boolean;
   rules: SpawnRule[];
-  frappeMcpUrl?: string;       // URL of Frappe MCP server for frappe_query (e.g. "http://localhost:8000")
   defaultMode?: "full" | "quick";  // default feature mode: "quick" skips planning phases
   chainModel?: string;         // model for chain subprocess agents (inherits parent model when unset)
   permissionMode?: PermissionMode; // agent autonomy level: auto | default | plan

package/config/loader.ts

@@ -1,96 +1,16 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { readFileSync, existsSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { defaults } from "./defaults.js";
 import type { AppConfig } from "./defaults.js";
 
-// ── Credential config types (NFR6, NFR9) ────────────────────────────────────
-
-export interface GlobalConfig {
-  llm_api_key: string;
-  llm_provider?: string;
-  [key: string]: unknown;
-}
-
-export interface ProjectConfig {
-  site_url: string;
-  api_key: string;
-  api_secret: string;
-  [key: string]: unknown;
-}
-
-export interface CredentialConfig {
-  global: GlobalConfig;
-  project: ProjectConfig;
-  sessionLogDir: string;
-}
-
-/** Always ~/.frappe-builder/sessions/ — never the project directory (NFR9). */
+/** Always ~/.frappe-builder/sessions/ — never the project directory. */
 export const SESSION_LOG_DIR = join(homedir(), ".frappe-builder", "sessions");
 
-const GITIGNORE_ERROR =
-  "Site credentials file is not gitignored. Add .frappe-builder-config.json to .gitignore before proceeding.";
-
-/**
- * Validates that {projectRoot}/.gitignore lists .frappe-builder-config.json.
- * Throws with the exact AC error message if missing or absent.
- */
-export function validateGitignore(projectRoot: string): void {
-  const gitignorePath = join(projectRoot, ".gitignore");
-  if (!existsSync(gitignorePath)) {
-    throw new Error(GITIGNORE_ERROR);
-  }
-  const contents = readFileSync(gitignorePath, "utf8");
-  const lines = contents.split("\n").map((l) => l.trim());
-  if (!lines.includes(".frappe-builder-config.json")) {
-    throw new Error(GITIGNORE_ERROR);
-  }
-}
-
-/**
- * Reads LLM API keys from ~/.frappe-builder/config.json (user-global, never project).
- * Creates ~/.frappe-builder/ on first run. Returns empty defaults if file absent.
- */
-export function loadGlobalConfig(): GlobalConfig {
-  const configDir = join(homedir(), ".frappe-builder");
-  mkdirSync(configDir, { recursive: true });
-  const configPath = join(configDir, "config.json");
-  if (!existsSync(configPath)) return { llm_api_key: "" };
-  try {
-    return JSON.parse(readFileSync(configPath, "utf8")) as GlobalConfig;
-  } catch {
-    return { llm_api_key: "" };
-  }
-}
-
-/**
- * Reads Frappe site credentials from {projectRoot}/.frappe-builder-config.json.
- * Returns empty defaults if file absent (caller should surface a warning).
- */
-export function loadProjectConfig(projectRoot: string): ProjectConfig {
-  const configPath = join(projectRoot, ".frappe-builder-config.json");
-  if (!existsSync(configPath)) return { site_url: "", api_key: "", api_secret: "" };
-  try {
-    return JSON.parse(readFileSync(configPath, "utf8")) as ProjectConfig;
-  } catch {
-    return { site_url: "", api_key: "", api_secret: "" };
-  }
-}
-
-/**
- * Full credential loader: validates gitignore, loads global + project configs.
- * Throws if .frappe-builder-config.json is not gitignored.
- * API keys are only ever read from ~/.frappe-builder/ — never from projectRoot.
- */
-export function loadCredentials(projectRoot: string): CredentialConfig {
-  validateGitignore(projectRoot);
-  const global = loadGlobalConfig();
-  const project = loadProjectConfig(projectRoot);
-  return { global, project, sessionLogDir: SESSION_LOG_DIR };
-}
-
 /**
  * Loads ~/.frappe-builder/config.json and merges with defaults.
+ * Stores agent behaviour preferences (permissionMode, requirePermission, etc.).
+ * Site credentials live in the session DB — not in this file.
  * Never throws — returns defaults on any read/parse failure.
  */
 export function loadConfig(): AppConfig {
@@ -103,3 +23,17 @@ export function loadConfig(): AppConfig {
     return { ...defaults };
   }
 }
+
+/**
+ * Writes a partial config merged over the current config to ~/.frappe-builder/config.json.
+ * Creates the directory if needed. Non-fatal — never throws.
+ */
+export function saveConfig(partial: Partial<AppConfig>): void {
+  try {
+    const configDir = join(homedir(), ".frappe-builder");
+    mkdirSync(configDir, { recursive: true });
+    const configPath = join(configDir, "config.json");
+    const merged = { ...loadConfig(), ...partial };
+    writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  } catch { /* non-fatal */ }
+}

package/dist/cli.mjs

@@ -1,20 +1,21 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
-import { resolve } from "node:path";
+import { join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
+import { homedir } from "node:os";
 //#region src/cli.ts
 /**
 * src/cli.ts — frappe-builder CLI entry point
 *
 * Commands:
-*   frappe-builder init    — interactive setup wizard (run once per project)
+*   frappe-builder init    — bootstrap agent toolchain (run once per machine)
 *   frappe-builder         — start a pi session with frappe-builder extensions loaded
 */
 const cmd = process.argv[2];
 if (cmd === "init") {
-	const { runInit } = await import("./init-Gp1MgJD2.mjs");
+	const { runInit } = await import("./init-CkLSZ_3g.mjs");
 	await runInit();
 	process.exit(0);
 }
@@ -23,7 +24,7 @@ if (cmd === "--help" || cmd === "-h") {
 Usage: frappe-builder [command]
 
 Commands:
-  init    Configure frappe-builder for this project (run once per project)
+  init    Bootstrap agent toolchain: context-mode, mcp2cli, context7 (run once per machine)
   (none)  Start a frappe-builder session
 
 Options:
@@ -31,8 +32,8 @@ Options:
 `);
 	process.exit(0);
 }
-if (!existsSync(resolve(process.cwd(), ".frappe-builder-config.json"))) {
-	console.error("frappe-builder is not configured in this directory.");
+if (!existsSync(join(homedir(), ".frappe-builder", ".initialized"))) {
+	console.error("frappe-builder toolchain not set up.");
 	console.error("Run: frappe-builder init");
 	process.exit(1);
 }

package/dist/{init-Gp1MgJD2.mjs → init-CkLSZ_3g.mjs}

@@ -3,42 +3,16 @@ import { join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { createInterface } from "node:readline";
 //#region src/init.ts
 /**
-* src/init.ts — interactive setup wizard for frappe-builder
+* src/init.ts — toolchain setup for frappe-builder
 *
-* Handles: global config (~/.frappe-builder/config.json),
-*          project config (.frappe-builder-config.json),
-*          and .gitignore patching.
+* Bootstraps the agent environment: context-mode, mcp2cli, context7.
+* No credential prompts — site credentials are collected at runtime via set_active_project.
 *
 * No imports from state/, extensions/, or gates/.
-* Uses Node.js built-ins only — no external prompt libraries.
+* Uses Node.js built-ins only.
 */
-let cancelled = false;
-process.on("SIGINT", () => {
-	cancelled = true;
-});
-function promptLine(question) {
-	return new Promise((resolve) => {
-		if (cancelled) {
-			resolve("");
-			return;
-		}
-		const rl = createInterface({
-			input: process.stdin,
-			output: process.stdout
-		});
-		rl.question(question, (answer) => {
-			rl.close();
-			resolve(answer);
-		});
-	});
-}
-async function promptYN(question) {
-	const answer = await promptLine(question + " (y/N): ");
-	return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
-}
 function writeAtomic(filePath, content) {
 	const tmp = filePath + ".tmp";
 	writeFileSync(tmp, content, "utf-8");
@@ -59,107 +33,23 @@ function patchGitignore(projectRoot, entry) {
 async function runInit(opts = {}) {
 	const projectRoot = opts.projectRoot ?? process.cwd();
 	const homeDir = homedir();
-	const globalConfigDir = join(homeDir, ".frappe-builder");
-	const globalConfigPath = join(globalConfigDir, "config.json");
-	const projectConfigPath = join(projectRoot, ".frappe-builder-config.json");
+	const markerPath = join(homeDir, ".frappe-builder", ".initialized");
 	console.log("\n=== frappe-builder Setup ===\n");
-	console.log(`[Global config: ${globalConfigPath}]`);
-	let globalConfig = {};
-	let globalAction = "written";
-	if (existsSync(globalConfigPath)) {
-		try {
-			globalConfig = JSON.parse(readFileSync(globalConfigPath, "utf-8"));
-		} catch {}
-		if (!cancelled) {
-			const overwrite = await promptYN(`Overwrite existing ${globalConfigPath}?`);
-			if (cancelled) {
-				printCancelled();
-				return;
-			}
-			if (!overwrite) {
-				globalAction = "skipped";
-				console.log("  Keeping existing global config.\n");
-			}
-		}
-	}
-	if (!cancelled && globalAction === "written") {
-		const llmKey = await promptLine("LLM API key (leave blank to skip): ");
-		if (cancelled) {
-			printCancelled();
-			return;
-		}
-		globalConfig.llm_api_key = llmKey.trim();
-	}
-	console.log(`\n[Project config: ${projectConfigPath}]`);
-	let projectConfig = {};
-	let projectAction = "written";
-	if (existsSync(projectConfigPath)) {
-		try {
-			projectConfig = JSON.parse(readFileSync(projectConfigPath, "utf-8"));
-		} catch {}
-		if (!cancelled) {
-			const overwrite = await promptYN(`Overwrite existing ${projectConfigPath}?`);
-			if (cancelled) {
-				printCancelled();
-				return;
-			}
-			if (!overwrite) {
-				projectAction = "skipped";
-				console.log("  Keeping existing project config.\n");
-			}
-		}
-	}
-	if (!cancelled && projectAction === "written") {
-		const siteUrl = await promptLine("Frappe site URL (e.g. http://site1.localhost): ");
-		if (cancelled) {
-			printCancelled();
-			return;
-		}
-		const apiKey = await promptLine("Frappe API key: ");
-		if (cancelled) {
-			printCancelled();
-			return;
-		}
-		const apiSecret = await promptLine("Frappe API secret: ");
-		if (cancelled) {
-			printCancelled();
-			return;
-		}
-		projectConfig = {
-			site_url: siteUrl.trim(),
-			api_key: apiKey.trim(),
-			api_secret: apiSecret.trim()
-		};
-	}
+	mkdirSync(join(homeDir, ".frappe-builder"), { recursive: true });
+	writeFileSync(markerPath, (/* @__PURE__ */ new Date()).toISOString() + "\n", "utf-8");
+	const gitignoreResult = patchGitignore(projectRoot, ".fb/");
 	const written = [];
-	const skipped = [];
-	if (globalAction === "written") {
-		mkdirSync(globalConfigDir, { recursive: true });
-		writeAtomic(globalConfigPath, JSON.stringify(globalConfig, null, 2) + "\n");
-		written.push(`~/.frappe-builder/config.json`);
-	} else skipped.push(`~/.frappe-builder/config.json`);
-	if (projectAction === "written") {
-		writeAtomic(projectConfigPath, JSON.stringify(projectConfig, null, 2) + "\n");
-		written.push(`.frappe-builder-config.json`);
-	} else skipped.push(`.frappe-builder-config.json`);
-	const gitignoreResult = patchGitignore(projectRoot, ".frappe-builder-config.json");
-	if (gitignoreResult === "patched") written.push(".gitignore (patched)");
-	else if (gitignoreResult === "created") written.push(".gitignore (created)");
-	else skipped.push(".gitignore (entry already present)");
+	if (gitignoreResult === "patched") written.push(".gitignore (patched with .fb/)");
+	else if (gitignoreResult === "created") written.push(".gitignore (created with .fb/)");
 	await setupContextMode(homeDir);
 	setupMcp2cli(homeDir);
 	setupContext7();
-	console.log("\nFiles written:");
-	for (const f of written) console.log(`  ✓ ${f}`);
-	if (skipped.length > 0) {
-		console.log("Skipped:");
-		for (const f of skipped) console.log(`  - ${f}`);
+	if (written.length > 0) {
+		console.log("\nFiles written:");
+		for (const f of written) console.log(`  ✓ ${f}`);
 	}
 	console.log("\nReady. Run: frappe-builder\n");
 }
-function printCancelled() {
-	console.log("\nSetup cancelled. No files were written.\n");
-}
 /**
 * Installs and configures the context-mode pi MCP extension.
 * Clones https://github.com/mksglu/context-mode into ~/.pi/extensions/context-mode,

package/extensions/frappe-state.ts

@@ -3,7 +3,6 @@ import type { TextContent } from "@mariozechner/pi-ai";
 import { db, getCurrentPhase } from "../state/db.js";
 import { appendEntry } from "../state/journal.js";
 import { buildStateContext, loadSpecialist, loadDebuggerSpecialist } from "./frappe-session.js";
-import { loadCredentials } from "../config/loader.js";
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export default function (pi: any) {
@@ -110,18 +109,6 @@ function applyPhaseTransition(featureId: string, newPhase: string): void {
   })();
 }
 
-/**
- * Session start hook — validates gitignore and loads credentials before any session setup.
- * Throws with AC error message if .frappe-builder-config.json is not gitignored.
- * Call this early in the session_start lifecycle; on throw, halt and surface the message.
- * projectRoot defaults to process.cwd() when not supplied by the pi extension system.
- *
- * TODO: wire this into the pi extension system's session_start event once the
- * session_start hook type is confirmed in @mariozechner/pi-agent-core.
- */
-export function handleSessionStart(projectRoot: string = process.cwd()): void {
-  loadCredentials(projectRoot);
-}
 
 /**
  * afterToolCall hook — appends a JSONL journal entry and updates the sessions

package/extensions/frappe-tools.ts

@@ -82,6 +82,9 @@ export default function (pi: any) {
     parameters: Type.Object({
       projectId: Type.String({ description: "Project identifier (e.g. 'my-frappe-site')" }),
       sitePath: Type.String({ description: "Absolute path to the Frappe bench site (e.g. '/home/user/frappe-bench/sites/site1.local')" }),
+      siteUrl: Type.Optional(Type.String({ description: "Frappe site URL (e.g. 'http://site1.localhost'). Required for frappe_query." })),
+      apiKey: Type.Optional(Type.String({ description: "Frappe API key from User > API Access. Required for frappe_query." })),
+      apiSecret: Type.Optional(Type.String({ description: "Frappe API secret from User > API Access. Required for frappe_query." })),
     }),
     execute: async (_toolCallId: string, params: ToolParams) => {
       const result = await setActiveProject(params);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frappe-builder",
-  "version": "1.1.0-dev.24",
+  "version": "1.1.0-dev.26",
   "description": "Frappe-native AI co-pilot for building and customising Frappe/ERPNext applications",
   "type": "module",
   "bin": {

package/state/db.ts

@@ -27,7 +27,16 @@ export function setDb(instance: DatabaseType): void {
  *
  * sitePath and appPath are optional so existing callers without them continue to work.
  */
-export function switchProject(newProjectId: string, sitePath?: string, appPath?: string): void {
+export interface ProjectCredentials {
+  sitePath?: string;
+  appPath?: string;
+  siteUrl?: string;
+  apiKey?: string;
+  apiSecret?: string;
+}
+
+export function switchProject(newProjectId: string, creds: ProjectCredentials = {}): void {
+  const { sitePath, appPath, siteUrl, apiKey, apiSecret } = creds;
   db.transaction(() => {
     // 1. Read current active session before closing
     const current = db
@@ -63,13 +72,16 @@ export function switchProject(newProjectId: string, sitePath?: string, appPath?:
 
     // 5. Create new session, restoring prior phase if available; feature_id defaults to NULL
     db.prepare(
-      "INSERT INTO sessions (session_id, project_id, current_phase, site_path, app_path, started_at, is_active) VALUES (?, ?, ?, ?, ?, ?, 1)"
+      "INSERT INTO sessions (session_id, project_id, current_phase, site_path, app_path, site_url, api_key, api_secret, started_at, is_active) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 1)"
     ).run(
       crypto.randomUUID(),
       newProjectId,
       prior?.current_phase ?? "idle",
       sitePath ?? null,
       appPath ?? null,
+      siteUrl ?? null,
+      apiKey ?? null,
+      apiSecret ?? null,
       new Date().toISOString()
     );
   })();

package/state/schema.ts

@@ -36,6 +36,9 @@ export function initSchema(db: Database): void {
       current_phase TEXT NOT NULL DEFAULT 'idle',
       site_path     TEXT,
       app_path      TEXT,
+      site_url      TEXT,
+      api_key       TEXT,
+      api_secret    TEXT,
       chain_step    TEXT,
       chain_pid     INTEGER,
       feature_id    TEXT,
@@ -62,6 +65,9 @@ export function migrateSchema(db: Database): void {
     "ALTER TABLE sessions ADD COLUMN app_path TEXT",
     "ALTER TABLE sessions ADD COLUMN chain_step TEXT",
     "ALTER TABLE sessions ADD COLUMN chain_pid INTEGER",
+    "ALTER TABLE sessions ADD COLUMN site_url TEXT",
+    "ALTER TABLE sessions ADD COLUMN api_key TEXT",
+    "ALTER TABLE sessions ADD COLUMN api_secret TEXT",
   ];
   for (const sql of alters) {
     try { db.exec(sql); } catch { /* column already exists — safe to ignore */ }

package/tools/frappe-query-tools.ts

@@ -1,6 +1,5 @@
-import { execa } from "execa";
-import { loadConfig } from "../config/loader.js";
-import { routeThroughContextMode } from "./context-sandbox.js";
+import { db } from "../state/db.js";
+import { applyTruncationFallback } from "./context-sandbox.js";
 
 export interface FrappeQueryArgs {
   doctype: string;
@@ -12,33 +11,50 @@ export interface FrappeQueryResult {
   error?: string;
 }
 
+interface SessionCredentials {
+  site_url: string | null;
+  api_key: string | null;
+  api_secret: string | null;
+}
+
 /**
- * Dispatches a Frappe get_list query via mcp2cli subprocess.
- * Raw output is routed through context-mode sandbox — never returned directly.
+ * Queries Frappe data via direct REST API call using credentials stored in the
+ * active session (set via set_active_project).
+ * Output is truncation-guarded — never returns raw payloads over 8K tokens.
  * Returns structured error on failure, never throws.
- *
- * Note: mcp2cli command syntax uses --mcp <url> --raw <tool_name> <json_args>.
- * Adapt args array if actual mcp2cli CLI syntax differs.
  */
 export async function frappeQuery({ doctype, filters }: FrappeQueryArgs): Promise<FrappeQueryResult> {
-  const config = loadConfig();
+  const session = db
+    .prepare("SELECT site_url, api_key, api_secret FROM sessions WHERE is_active = 1 LIMIT 1")
+    .get() as SessionCredentials | undefined;
 
-  if (!config.frappeMcpUrl) {
-    return { error: "frappeMcpUrl not configured in ~/.frappe-builder/config.json" };
+  if (!session?.site_url) {
+    return { error: "No site_url configured. Call set_active_project with siteUrl, apiKey, and apiSecret first." };
+  }
+  if (!session.api_key || !session.api_secret) {
+    return { error: "No API credentials configured. Call set_active_project with apiKey and apiSecret." };
   }
 
   try {
-    const payload = JSON.stringify({ doctype, filters: filters ?? {} });
-    const { stdout, stderr } = await execa("mcp2cli", [
-      "--mcp", config.frappeMcpUrl,
-      "--raw",
-      "frappe_get_list",
-      payload,
-    ]);
+    const params = new URLSearchParams();
+    if (filters && Object.keys(filters).length > 0) {
+      params.set("filters", JSON.stringify(filters));
+    }
+
+    const url = `${session.site_url}/api/resource/${encodeURIComponent(doctype)}?${params.toString()}`;
+    const response = await fetch(url, {
+      headers: {
+        Authorization: `token ${session.api_key}:${session.api_secret}`,
+        "Content-Type": "application/json",
+      },
+    });
 
-    if (stderr) console.warn(`[frappe_query mcp2cli stderr: ${stderr}]`);
+    if (!response.ok) {
+      return { error: `Frappe API error ${response.status}: ${response.statusText}` };
+    }
 
-    const summary = await routeThroughContextMode(stdout);
+    const raw = await response.text();
+    const summary = applyTruncationFallback(raw);
     return { summary };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);

package/tools/project-tools.ts

@@ -1,4 +1,4 @@
-import { db, switchProject } from "../state/db.js";
+import { db, switchProject, type ProjectCredentials } from "../state/db.js";
 import { reloadSessionContext } from "../extensions/frappe-session.js";
 
 export interface ComponentStatus {
@@ -78,31 +78,32 @@ interface SetActiveProjectArgs {
   projectId: string;
   sitePath: string;
   appPath?: string;
+  siteUrl?: string;
+  apiKey?: string;
+  apiSecret?: string;
 }
 
 /**
  * Switches the active Frappe project and site, flushes current session state,
  * creates a new session, and reloads the system prompt context.
- *
- * The state_transition JSONL entry is written inside switchProject() —
- * no second appendEntry() call here.
+ * Site credentials (siteUrl, apiKey, apiSecret) are stored in the session row
+ * and used by frappe_query for direct REST API calls.
  */
-export async function setActiveProject({ projectId, sitePath, appPath }: SetActiveProjectArgs) {
-  // Flush current state + create new session (JSONL entry written internally)
-  switchProject(projectId, sitePath, appPath);
+export async function setActiveProject({ projectId, sitePath, appPath, siteUrl, apiKey, apiSecret }: SetActiveProjectArgs) {
+  const creds: ProjectCredentials = { sitePath, appPath, siteUrl, apiKey, apiSecret };
+  switchProject(projectId, creds);
 
-  // Reload system prompt with new project context
   await reloadSessionContext();
 
-  // Read restored phase for return value
   const session = db
-    .prepare("SELECT current_phase FROM sessions WHERE is_active = 1 LIMIT 1")
-    .get() as { current_phase: string } | undefined;
+    .prepare("SELECT current_phase, site_url FROM sessions WHERE is_active = 1 LIMIT 1")
+    .get() as { current_phase: string; site_url: string | null } | undefined;
 
   return {
     project_id: projectId,
     site_path: sitePath,
     app_path: appPath ?? null,
+    site_url: session?.site_url ?? null,
     phase: session?.current_phase ?? "idle",
     context_reloaded: true,
   };