makersclaw 0.5.2 → 0.7.0

package/templates/next/files/next.config.mjs

@@ -1,3 +1,22 @@
+import { readFileSync } from "node:fs";
+
+// The app's mode, from its manifest (makersclaw.json, beside this file).
+// A browser app builds to files (output: "export"): the platform serves
+// them, and its data door answers their reads and writes. A server app
+// runs `next start`. Absent or unreadable is a server app, as every app
+// before 0.7.0 is (none has a `mode`); only the exact word "browser"
+// makes an export. `makersclaw mode` is what changes the key, never an
+// edit here.
+function mode() {
+  try {
+    const m = JSON.parse(readFileSync(new URL("./makersclaw.json", import.meta.url), "utf8"));
+    return m && m.mode === "browser" ? "browser" : "server";
+  } catch {
+    return "server";
+  }
+}
+const BROWSER = mode() === "browser";
+
 // The dashboard reaches this app at /p/<label>/ through the workspace proxy,
 // so every link and asset must carry that prefix. product_run sets
 // CLAW_BASE_PATH at build AND start time; leave it unset to run at /.
@@ -7,8 +26,8 @@
 // attribute app/layout.jsx renders is the runtime copy and is read first, so
 // a start under a different prefix than the build still resolves.
 //
-// allowedOrigins is NOT optional here, and it is not yours to edit. Next 15
-// refuses a Server Action whose `Origin` header disagrees with
+// allowedOrigins is NOT optional here, and it is not yours to edit. Next
+// (15 and 16) refuses a Server Action whose `Origin` header disagrees with
 // `x-forwarded-host` — and in this stack they always disagree, because the
 // sandbox ingress rewrites `x-forwarded-host` to its own vercel.run name
 // while the browser is on the product host. Without this the app loads
@@ -17,25 +36,82 @@
 // (src/lib/products.ts productAllowedOrigins): the product's own FQDN in
 // production, the dashboard's dev origin under a path prefix. Hardcoding a
 // localhost origin here ships an app that works in dev and refuses every
-// write in production.
+// write in production. A browser app has no Server Actions, so it takes
+// none: its writes go to the platform's data door (lib/door.js).
 const allowedOrigins = (process.env.CLAW_ALLOWED_ORIGINS || "")
   .split(",")
   .map((o) => o.trim())
   .filter(Boolean);
 
+// The same hosts, for `next dev` alone. Next 16 refuses a request for a
+// dev resource (/_next/*, /__nextjs*: the HMR socket, the error overlay's
+// lookups) whose Origin host is not localhost or listed here; Next 15 only
+// warned. The preview's browser is on the product host, so without this
+// every such request answers 403. Hostnames only: Next compares no port.
+// Both modes: a browser app still previews on `next dev` while it is
+// built, so CLAW_ALLOWED_ORIGINS stays its preview's rule.
+const allowedDevOrigins = [
+  ...new Set(
+    allowedOrigins
+      .map((o) => o.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").replace(/\/.*$/, "").replace(/:\d+$/, "").toLowerCase())
+      .filter(Boolean),
+  ),
+];
+
 // `npm run check` builds into its own folder (CLAW_DIST_DIR=.next-check,
-// check/run.mjs) so it never touches `.next`: in the sandbox the running
-// dev server owns that folder as another user, and a second `next build`
-// there dies with EACCES on .next/trace before it starts.
+// check/run.mjs) so it never touches `.next`, which is not the check's:
+// in a working copy it is the dev server's, and in a live app it holds
+// the production build the platform made, serves and reads as its proof
+// (.next/BUILD_ID). check/run.mjs says more.
+//
+// Under output: "export" a custom distDir is where the export goes, and
+// the build then works in .next anyway (Next 16, build/index.js). So a
+// browser app is built with the default: the build in .next, the files
+// in out/, which is what the platform publishes. Its check builds in a
+// copy of the app, never in the tree.
+//
+// CLAW_TURBOPACK_ROOT is set by `npm run check` alone, when it builds a
+// copy of an app folder it cannot write (check/run.mjs buildSite). The
+// copy's node_modules is a symlink back to the app's, and Turbopack (Next
+// 16's bundler for build as well as dev) refuses a symlink that leaves its
+// root: "Symlink [project]/node_modules is invalid, it points out of the
+// filesystem root". The check names the nearest folder holding both.
+// Unset, Turbopack finds the root itself.
+const turbopackRoot = process.env.CLAW_TURBOPACK_ROOT || "";
+
+// agentRules: false. Next 16's `next dev` writes AGENTS.md and CLAUDE.md
+// into the app folder when it sees an AI agent in its environment
+// (AI_AGENT, CLAUDECODE…), telling the agent to read Next's own docs.
+// This app's agent brief is the platform's, beside the app, and the app
+// folder holds only what the template and the app's own screens put there.
+//
+// mcpServer: false. Next 16's `next dev` also serves an MCP endpoint at
+// /_next/mcp (the app's routes, logs and errors, the errors of every
+// browser on the page, a route compile) and answers it before proxy.js
+// runs, so no product token guards it. Off: the token check is meant to
+// be the preview's only door. One more answers there that no setting
+// turns off, the dev overlay's /__nextjs_attach-nodejs-inspector (it
+// opens a Node debugger on loopback); only the platform can wall that
+// (CHANGELOG, 0.6.0).
+//
+// Browser mode adds three: output "export" (every page a file); images
+// unoptimized, a guard, since the export has no image server (nothing in
+// the template uses next/image); and trailingSlash false, so a page is
+// s/<key>.html, the file the platform's router looks for.
 const nextConfig = {
   basePath: process.env.CLAW_BASE_PATH || "",
   distDir: process.env.CLAW_DIST_DIR || ".next",
   env: {
     CLAW_BASE_PATH: process.env.CLAW_BASE_PATH || "",
   },
-  ...(allowedOrigins.length > 0
-    ? { experimental: { serverActions: { allowedOrigins } } }
-    : {}),
+  agentRules: false,
+  ...(BROWSER ? { output: "export", images: { unoptimized: true }, trailingSlash: false } : {}),
+  ...(allowedDevOrigins.length > 0 ? { allowedDevOrigins } : {}),
+  ...(turbopackRoot ? { turbopack: { root: turbopackRoot }, outputFileTracingRoot: turbopackRoot } : {}),
+  experimental: {
+    mcpServer: false,
+    ...(!BROWSER && allowedOrigins.length > 0 ? { serverActions: { allowedOrigins } } : {}),
+  },
 };
 
 export default nextConfig;

package/templates/next/files/package.json

@@ -10,10 +10,10 @@
   },
   "dependencies": {
     "@tailwindcss/postcss": "^4",
-    "next": "^15.4.0",
+    "next": "^16.3.7",
     "pg": "^8.16.0",
-    "react": "^19.1.0",
-    "react-dom": "^19.1.0",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
     "tailwindcss": "^4"
   }
 }

package/templates/next/files/{middleware.js → proxy.js}

@@ -1,8 +1,15 @@
 import { NextResponse } from "next/server";
 
-// The only door is the Makersclaw dashboard proxy, which stamps this token
-// on every request. The sandbox port itself is public, so without this
-// check anyone with the URL could read the founder's data.
+// Next runs this before every request. Until 0.6.0 it was middleware.js
+// (Next 15's name for it); Next 16 renamed the file and its export to
+// `proxy`, and runs it on Node, never the edge runtime. A middleware.js
+// beside this file fails the build, so `makersclaw update` removes the old
+// one. Not to be confused with the product proxy, the Makersclaw dashboard
+// door that sits in front of the whole app.
+//
+// The only door is that product proxy, which stamps this token on every
+// request. The sandbox port itself is public, so without this check
+// anyone with the URL could read the founder's data.
 //
 // It also tells the server which surface a request is for: /s/<key> becomes
 // the x-claw-surface request header, so lib/data.js and lib/actions.js can
@@ -13,12 +20,12 @@ import { NextResponse } from "next/server";
 // the desk, and the product proxy carries it as the x-claw-theme header
 // on every later request (the browser's cookies never reach the app).
 // ?theme= on any URL wins for that request and sets the claw_theme cookie
-// too, so the app keeps its theme when run without the proxy (local
-// `next dev`). app/layout.jsx reads header, then cookie, onto
+// too, so the app keeps its theme when run without the product proxy
+// (local `next dev`). app/layout.jsx reads header, then cookie, onto
 // <html data-theme>.
 const THEMES = new Set(["light", "dark"]);
 
-export function middleware(request) {
+export function proxy(request) {
   const expected = process.env.CLAW_PRODUCT_TOKEN;
   if (expected && request.headers.get("x-claw-product-token") !== expected) {
     return new NextResponse("Open this app from your Makersclaw dashboard.", {

package/templates/next/files/surfaces.js

@@ -7,7 +7,8 @@
  *   label      what the nav shows
  *   kind       optional, free text, one or two words for the checklist
  *              ("board", "inbox", "report") — not an enum, nothing keys on it
- *   source     the table the surface reads, when it reads one
+ *   source     the table the surface reads, when it reads one: its bare name
+ *              ("investors"), which the app's own schema answers
  *   home       true on the one surface / opens; otherwise the first entry
  *   component  the surface's component. LEAVE IT OUT while the surface is
  *              still planned: the nav shows it as planned and its page says
@@ -27,7 +28,7 @@
 // A domain surface, once built, looks like this:
 //
 //   import Investors from "./surfaces/investors";
-//   { key: "investors", label: "Investors", kind: "board", source: "public.investors", home: true, component: Investors },
+//   { key: "investors", label: "Investors", kind: "board", source: "investors", home: true, component: Investors },
 
 const surfaces = [];