robodev 0.45.1 → 0.47.0

package/src/mcp.test.ts

@@ -0,0 +1,336 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  failure,
+  initializeResult,
+  isNotification,
+  MCP_PROTOCOL_VERSION,
+  METHOD_NOT_FOUND,
+  negotiateProtocolVersion,
+  parseMessage,
+  takeCompleteLines,
+  toolResult,
+} from "./mcp-protocol.js";
+import {
+  backendPathError,
+  deployPathFor,
+  formatFileList,
+  formatPublishResult,
+  MCP_TOOLS,
+  parsePublishFile,
+  parsePublishFiles,
+} from "./mcp-tools.js";
+import {
+  callTool,
+  handleRequest,
+  NO_AUTH_ERROR,
+  NO_PROJECT_ERROR,
+  READ_NEEDS_USER_AUTH,
+  openSession,
+} from "./mcp.js";
+import type { McpSession } from "./mcp.js";
+
+type Call = { path: string; init?: RequestInit };
+
+function fakeSession(
+  responses: Record<string, unknown>,
+  calls: Call[] = [],
+  auth: "user" | "deploy-key" = "user",
+): McpSession {
+  return {
+    projectId: "prj-test",
+    auth,
+    request: async <T>(path: string, init?: RequestInit): Promise<T> => {
+      calls.push({ path, init });
+      const key = Object.keys(responses).find((candidate) => path.includes(candidate));
+      if (!key) throw new Error(`unexpected request: ${path}`);
+      return responses[key] as T;
+    },
+  };
+}
+
+function textOf(result: Record<string, unknown>): string {
+  const content = result.content as { type: string; text: string }[];
+  return content.map((part) => part.text).join("\n");
+}
+
+test("a stdio chunk is split into whole frames and the remainder is kept", () => {
+  const first = takeCompleteLines("", '{"a":1}\n{"b":2}\n{"c"');
+  assert.deepEqual(first.lines, ['{"a":1}', '{"b":2}']);
+  assert.equal(first.buffer, '{"c"');
+  const second = takeCompleteLines(first.buffer, ":3}\n");
+  assert.deepEqual(second.lines, ['{"c":3}']);
+  assert.equal(second.buffer, "");
+});
+
+test("malformed and non-request frames are ignored, not answered", () => {
+  assert.equal(parseMessage("not json"), null);
+  assert.equal(parseMessage("[1,2]"), null);
+  assert.equal(parseMessage('{"jsonrpc":"2.0","id":1}'), null);
+  assert.equal(parseMessage("   "), null);
+  const notification = parseMessage('{"jsonrpc":"2.0","method":"notifications/initialized"}');
+  assert.ok(notification);
+  assert.equal(isNotification(notification), true);
+});
+
+test("the client's protocol version is echoed when we speak it", () => {
+  assert.equal(negotiateProtocolVersion("2024-11-05"), "2024-11-05");
+  assert.equal(negotiateProtocolVersion("1999-01-01"), MCP_PROTOCOL_VERSION);
+  assert.equal(negotiateProtocolVersion(undefined), MCP_PROTOCOL_VERSION);
+  const result = initializeResult({
+    requestedProtocolVersion: "2025-03-26",
+    serverName: "robodev",
+    serverVersion: "1.2.3",
+  });
+  assert.equal(result.protocolVersion, "2025-03-26");
+  assert.deepEqual(result.serverInfo, { name: "robodev", version: "1.2.3" });
+  assert.deepEqual(result.capabilities, { tools: { listChanged: false } });
+});
+
+test("a notification is never answered and an unknown method is a protocol error", async () => {
+  const session = fakeSession({});
+  const notification = await handleRequest(session, {
+    jsonrpc: "2.0",
+    method: "notifications/initialized",
+  });
+  assert.equal(notification, null);
+  const unknown = await handleRequest(session, { jsonrpc: "2.0", id: 7, method: "resources/list" });
+  assert.equal(unknown?.error?.code, METHOD_NOT_FOUND);
+  assert.deepEqual(failure(1, METHOD_NOT_FOUND, "x").error, {
+    code: METHOD_NOT_FOUND,
+    message: "x",
+  });
+});
+
+test("tools/list advertises every tool with a usable schema", async () => {
+  const response = await handleRequest(fakeSession({}), {
+    jsonrpc: "2.0",
+    id: 1,
+    method: "tools/list",
+  });
+  const tools = (response?.result as { tools: typeof MCP_TOOLS }).tools;
+  assert.deepEqual(tools.map((tool) => tool.name).sort(), [
+    "list_backend_files",
+    "project_info",
+    "publish_backend_file",
+    "publish_backend_files",
+    "read_backend_file",
+  ]);
+  for (const tool of tools) {
+    assert.ok(tool.description.length > 20, `${tool.name} needs a real description`);
+    assert.equal((tool.inputSchema as { type: string }).type, "object");
+  }
+});
+
+test("publishing one file sends only that file and reports the live URL", async () => {
+  const calls: Call[] = [];
+  const session = fakeSession(
+    {
+      "/deploy/backend": {
+        published: ["packages/be/api/todos.ts"],
+        apiUrl: "https://prj-test.robodev.povio.dev",
+        docsUrl: "https://prj-test.robodev.povio.dev/_robodev/docs",
+      },
+    },
+    calls,
+  );
+  const result = await callTool(session, "publish_backend_file", {
+    path: "packages/be/api/todos.ts",
+    content: "export default defineApi({});",
+  });
+  assert.equal(result.isError, false);
+  assert.match(textOf(result), /Published 1 file and redeployed/);
+  assert.match(textOf(result), /packages\/be\/api\/todos\.ts/);
+  assert.match(textOf(result), /https:\/\/prj-test\.robodev\.povio\.dev/);
+
+  assert.equal(calls.length, 1, "one publish is one request — no full-tree round trip");
+  assert.equal(calls[0].path, "/v1/projects/prj-test/deploy/backend");
+  const body = JSON.parse(String(calls[0].init?.body)) as {
+    files: { path: string; content: string }[];
+    force: boolean;
+  };
+  assert.deepEqual(body.files, [
+    { path: "packages/be/api/todos.ts", content: "export default defineApi({});" },
+  ]);
+  assert.equal(body.force, false, "a destructive schema change stays opt-in");
+});
+
+test("force is passed through only when asked for", async () => {
+  const calls: Call[] = [];
+  const session = fakeSession(
+    { "/deploy/backend": { published: ["packages/be/database.ts"] } },
+    calls,
+  );
+  await callTool(session, "publish_backend_file", {
+    path: "packages/be/database.ts",
+    content: "x",
+    force: true,
+  });
+  assert.equal(JSON.parse(String(calls[0].init?.body)).force, true);
+});
+
+test("a route and its schema publish together in one deploy", async () => {
+  const calls: Call[] = [];
+  const session = fakeSession(
+    { "/deploy/backend": { published: ["packages/be/api/todos.ts", "packages/be/database.ts"] } },
+    calls,
+  );
+  const result = await callTool(session, "publish_backend_files", {
+    files: [
+      { path: "packages/be/api/todos.ts", content: "a" },
+      { path: "packages/be/database.ts", content: "b" },
+    ],
+  });
+  assert.equal(calls.length, 1, "one deploy, so the schema and the route never disagree");
+  assert.match(textOf(result), /Published 2 files/);
+});
+
+test("frontend paths are refused with the command that does handle them", async () => {
+  const session = fakeSession({});
+  for (const path of ["apps/fe/src/App.tsx", "src/main.tsx", "index.html", "public/logo.png"]) {
+    const result = await callTool(session, "publish_backend_file", { path, content: "x" });
+    assert.equal(result.isError, true, `${path} must be refused`);
+    assert.match(textOf(result), /robodev deploy/);
+  }
+  assert.equal(backendPathError("packages/be/api/todos.ts"), null);
+  assert.equal(backendPathError("packages/be/database.ts"), null);
+  assert.equal(backendPathError("packages/be/package.json"), null);
+});
+
+test("bad tool arguments come back as a readable tool error, not a crash", async () => {
+  const session = fakeSession({});
+  assert.equal(typeof parsePublishFile({ path: "a.ts" }), "string");
+  assert.equal(typeof parsePublishFile({ content: "x" }), "string");
+  assert.equal(typeof parsePublishFiles([]), "string");
+  assert.equal(typeof parsePublishFiles("nope"), "string");
+  assert.equal(typeof parsePublishFiles(Array(51).fill({ path: "a.ts", content: "x" })), "string");
+  const missing = await callTool(session, "read_backend_file", {});
+  assert.equal(missing.isError, true);
+  const unknown = await callTool(session, "no_such_tool", {});
+  assert.equal(unknown.isError, true);
+});
+
+test("a Starbase rejection is surfaced to the agent as a tool error it can act on", async () => {
+  const session: McpSession = {
+    projectId: "prj-test",
+    auth: "user",
+    request: async () => {
+      const { ApiError } = await import("./api.js");
+      throw new ApiError("destructive change requires force", 400, {
+        message: "dropping column todos.done",
+      });
+    },
+  };
+  const response = await handleRequest(session, {
+    jsonrpc: "2.0",
+    id: 3,
+    method: "tools/call",
+    params: {
+      name: "publish_backend_file",
+      arguments: { path: "packages/be/database.ts", content: "x" },
+    },
+  });
+  // Reported in the result, not as a JSON-RPC error: the agent should read it and retry.
+  assert.equal(response?.error, undefined);
+  const result = response?.result as Record<string, unknown>;
+  assert.equal(result.isError, true);
+  assert.match(textOf(result), /400/);
+  assert.match(textOf(result), /dropping column todos\.done/);
+});
+
+test("listing and reading see the live backend tree and hide the frontend", async () => {
+  const session = fakeSession({
+    "/deployment/files": {
+      files: [
+        { path: "database.ts", content: "export const db = 1;" },
+        { path: "api/todos.ts", content: "route" },
+        { path: "src/main.tsx", content: "frontend" },
+        { path: "index.html", content: "<html></html>" },
+      ],
+    },
+  });
+  const listed = textOf(await callTool(session, "list_backend_files", {}));
+  assert.match(listed, /2 backend files live/);
+  assert.match(listed, /database\.ts \(20 bytes\)/);
+  assert.equal(listed.includes("src/main.tsx"), false);
+  assert.equal(listed.includes("index.html"), false);
+
+  // A Tiny workspace path and the deployed path name the same file.
+  assert.equal(deployPathFor("packages/be/api/todos.ts"), "api/todos.ts");
+  const read = await callTool(session, "read_backend_file", { path: "packages/be/api/todos.ts" });
+  assert.equal(textOf(read), "route");
+  const readDeployPath = await callTool(session, "read_backend_file", { path: "api/todos.ts" });
+  assert.equal(textOf(readDeployPath), "route");
+  const absent = await callTool(session, "read_backend_file", { path: "packages/be/api/none.ts" });
+  assert.equal(absent.isError, true);
+  assert.match(textOf(absent), /list_backend_files/);
+});
+
+test("an empty deployment tells you to deploy once first", () => {
+  assert.match(formatFileList([]), /robodev deploy/);
+  assert.match(formatPublishResult({ published: ["a.ts"] }), /Published 1 file/);
+  assert.equal(toolResult("x").isError, false);
+});
+
+test("project_info names the project and how the session authenticated", async () => {
+  const asKey = await callTool(fakeSession({}, [], "deploy-key"), "project_info", {});
+  assert.match(textOf(asKey), /prj-test/);
+  assert.match(textOf(asKey), /deploy key/);
+  const asUser = await callTool(fakeSession({}), "project_info", {});
+  assert.match(textOf(asUser), /signed-in user/);
+});
+
+test("an unlinked folder says how to link, before any request is made", async () => {
+  await assert.rejects(
+    () => openSession({ cwd: "/tmp/robodev-not-a-project", deployKey: "" }),
+    (error: unknown) => error instanceof Error && error.message === NO_PROJECT_ERROR,
+  );
+});
+
+test("a deploy key authenticates without robodev auth", async () => {
+  const session = await openSession({
+    projectId: "prj-headless",
+    deployKey: " rdk_test ",
+    cwd: "/tmp/robodev-not-a-project",
+  });
+  assert.equal(session.auth, "deploy-key");
+  assert.equal(session.projectId, "prj-headless");
+  assert.match(NO_AUTH_ERROR, /ROBODEV_DEPLOY_KEY/);
+});
+
+test("a deploy-key session can publish but is told plainly it cannot read", async () => {
+  // GET /deployment/files is member-only on purpose: a leaked CI credential should not be able to
+  // dump the project's backend source. Publishing never needed it — the server reads the live tree
+  // itself — so only the read tools lose out, and they have to say why.
+  const calls: Call[] = [];
+  const session = fakeSession(
+    { "/deploy/backend": { published: ["api/todos.ts"] } },
+    calls,
+    "deploy-key",
+  );
+
+  for (const tool of ["list_backend_files", "read_backend_file"]) {
+    const result = await callTool(session, tool, { path: "api/todos.ts" });
+    assert.equal(result.isError, true, `${tool} must refuse a deploy-key session`);
+    assert.equal(textOf(result), READ_NEEDS_USER_AUTH);
+    assert.match(textOf(result), /robodev auth/);
+  }
+  assert.equal(calls.length, 0, "it refuses locally rather than relaying a 403");
+
+  // Publishing still works with the same session.
+  const published = await callTool(session, "publish_backend_file", {
+    path: "api/todos.ts",
+    content: "x",
+  });
+  assert.equal(published.isError, false);
+  assert.equal(calls.length, 1);
+});
+
+test("a signed-in session reads normally", async () => {
+  const session = fakeSession({
+    "/deployment/files": { files: [{ path: "api/todos.ts", content: "route" }] },
+  });
+  const result = await callTool(session, "read_backend_file", { path: "api/todos.ts" });
+  assert.equal(result.isError, false);
+  assert.equal(textOf(result), "route");
+});

package/src/mcp.ts

@@ -0,0 +1,281 @@
+import { stdin, stdout } from "node:process";
+import { ApiError, authed, deployKeyRequest } from "./api.js";
+import { readCredentials, readLink, starbaseUrl } from "./config.js";
+import {
+  failure,
+  initializeResult,
+  INTERNAL_ERROR,
+  INVALID_PARAMS,
+  isNotification,
+  METHOD_NOT_FOUND,
+  parseMessage,
+  success,
+  takeCompleteLines,
+  toolResult,
+  type JsonRpcRequest,
+  type JsonRpcResponse,
+} from "./mcp-protocol.js";
+import {
+  backendPathError,
+  deployPathFor,
+  formatFileList,
+  formatPublishResult,
+  MCP_SERVER_INSTRUCTIONS,
+  MCP_TOOLS,
+  parsePublishFile,
+  parsePublishFiles,
+  type PublishFile,
+} from "./mcp-tools.js";
+
+export const SERVER_NAME = "robodev";
+
+type DeployResponse = {
+  published?: string[];
+  apiUrl?: string;
+  appUrl?: string;
+  docsUrl?: string;
+};
+
+export type McpSession = {
+  projectId: string;
+  /** How the session talks to Starbase: the signed-in user, or a project deploy key. */
+  auth: "user" | "deploy-key";
+  request: <T>(path: string, init?: RequestInit) => Promise<T>;
+};
+
+export const NO_PROJECT_ERROR =
+  "No project is linked here. Run `robodev link <projectId>` in the project folder, or pass --project <projectId>.";
+export const NO_AUTH_ERROR =
+  "Not authenticated. Run `robodev auth`, or set ROBODEV_DEPLOY_KEY to a project deploy key.";
+
+export function parseMcpArgs(argv: readonly string[]): { projectId?: string } {
+  const out: { projectId?: string } = {};
+  for (let index = 0; index < argv.length; index++) {
+    if (argv[index] !== "--project") continue;
+    const value = (argv[index + 1] ?? "").trim();
+    if (value) out.projectId = value;
+  }
+  return out;
+}
+
+/**
+ * A deploy key is the headless path — an agent runner has no browser to complete `robodev auth`
+ * with — and it wins when set, because it names the project it is scoped to.
+ */
+export async function openSession(input: {
+  projectId?: string;
+  deployKey?: string;
+  cwd?: string;
+}): Promise<McpSession> {
+  const link = await readLink(input.cwd ?? process.cwd());
+  const projectId = input.projectId ?? link?.projectId;
+  if (!projectId) throw new Error(NO_PROJECT_ERROR);
+
+  const deployKey = (input.deployKey ?? "").trim();
+  if (deployKey) {
+    return {
+      projectId,
+      auth: "deploy-key",
+      request: (path, init) => deployKeyRequest(path, deployKey, init),
+    };
+  }
+  if (!(await readCredentials())) throw new Error(NO_AUTH_ERROR);
+  return { projectId, auth: "user", request: (path, init) => authed(path, init) };
+}
+
+/**
+ * GET /deployment/files is member-only: a leaked CI credential should not be able to dump the
+ * project's backend source. Publishing never needed it — the server reads the live tree itself —
+ * so only the read tools lose out, and they refuse locally rather than relaying a 403.
+ */
+export const READ_NEEDS_USER_AUTH =
+  "Reading deployed files needs a signed-in user: run `robodev auth` and start this server without ROBODEV_DEPLOY_KEY. A deploy key can publish, but not read the project's source. Publishing does not require reading first.";
+
+function canRead(session: McpSession): boolean {
+  return session.auth === "user";
+}
+
+async function liveBackendFiles(session: McpSession): Promise<PublishFile[]> {
+  const body = await session.request<{ files?: PublishFile[] }>(
+    `/v1/projects/${session.projectId}/deployment/files`,
+  );
+  const files = body.files ?? [];
+  return files.filter((file) => backendPathError(file.path) === null);
+}
+
+async function publish(
+  session: McpSession,
+  files: readonly PublishFile[],
+  force: boolean,
+): Promise<Record<string, unknown>> {
+  for (const file of files) {
+    const error = backendPathError(file.path);
+    if (error) return toolResult(error, true);
+  }
+  const body = await session.request<DeployResponse>(
+    `/v1/projects/${session.projectId}/deploy/backend`,
+    { method: "POST", body: JSON.stringify({ files, force }) },
+  );
+  return toolResult(
+    formatPublishResult({
+      published: body.published ?? files.map((file) => file.path),
+      apiUrl: body.apiUrl,
+      docsUrl: body.docsUrl,
+    }),
+  );
+}
+
+function asBoolean(value: unknown): boolean {
+  return value === true;
+}
+
+export async function callTool(
+  session: McpSession,
+  name: string,
+  args: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+  if (name === "publish_backend_file") {
+    const file = parsePublishFile(args);
+    if (typeof file === "string") return toolResult(file, true);
+    return publish(session, [file], asBoolean(args.force));
+  }
+
+  if (name === "publish_backend_files") {
+    const files = parsePublishFiles(args.files);
+    if (typeof files === "string") return toolResult(files, true);
+    return publish(session, files, asBoolean(args.force));
+  }
+
+  if (name === "list_backend_files") {
+    if (!canRead(session)) return toolResult(READ_NEEDS_USER_AUTH, true);
+    return toolResult(formatFileList(await liveBackendFiles(session)));
+  }
+
+  if (name === "read_backend_file") {
+    if (!canRead(session)) return toolResult(READ_NEEDS_USER_AUTH, true);
+    const path = typeof args.path === "string" ? args.path.trim() : "";
+    if (!path) return toolResult("`path` is required.", true);
+    const pathError = backendPathError(path);
+    if (pathError) return toolResult(pathError, true);
+    const deployPath = deployPathFor(path);
+    const files = await liveBackendFiles(session);
+    const found = files.find((file) => file.path === deployPath);
+    if (!found) {
+      return toolResult(
+        `${path} is not deployed${deployPath === path ? "" : ` (as ${deployPath})`}. list_backend_files shows what is live.`,
+        true,
+      );
+    }
+    return toolResult(found.content);
+  }
+
+  if (name === "project_info") {
+    const projectApiUrl = `${starbaseUrl()}`;
+    return toolResult(
+      [
+        `Project: ${session.projectId}`,
+        `Starbase: ${projectApiUrl}`,
+        `Authenticated as: ${session.auth === "user" ? "signed-in user" : "project deploy key"}`,
+      ].join("\n"),
+    );
+  }
+
+  return toolResult(`Unknown tool: ${name}`, true);
+}
+
+function toolCallError(error: unknown): Record<string, unknown> {
+  if (error instanceof ApiError) {
+    const detail = typeof error.body.message === "string" ? error.body.message : error.message;
+    return toolResult(`Starbase rejected the publish (${error.status}): ${detail}`, true);
+  }
+  return toolResult(error instanceof Error ? error.message : "Publish failed.", true);
+}
+
+export async function handleRequest(
+  session: McpSession,
+  request: JsonRpcRequest,
+): Promise<JsonRpcResponse | null> {
+  if (isNotification(request)) return null;
+  const id = request.id as string | number;
+
+  if (request.method === "initialize") {
+    return success(
+      id,
+      initializeResult({
+        requestedProtocolVersion: request.params?.protocolVersion,
+        serverName: SERVER_NAME,
+        serverVersion: await serverVersion(),
+        instructions: MCP_SERVER_INSTRUCTIONS,
+      }),
+    );
+  }
+  if (request.method === "ping") return success(id, {});
+  if (request.method === "tools/list") return success(id, { tools: MCP_TOOLS });
+  if (request.method === "tools/call") {
+    const name = typeof request.params?.name === "string" ? request.params.name : "";
+    if (!name) return failure(id, INVALID_PARAMS, "tools/call requires a tool name");
+    const args =
+      request.params?.arguments && typeof request.params.arguments === "object"
+        ? (request.params.arguments as Record<string, unknown>)
+        : {};
+    try {
+      return success(id, await callTool(session, name, args));
+    } catch (error) {
+      // A failing tool is reported in the result, not as a protocol error: the agent should read
+      // the reason and try again rather than see the server as broken.
+      return success(id, toolCallError(error));
+    }
+  }
+  return failure(id, METHOD_NOT_FOUND, `Unknown method: ${request.method}`);
+}
+
+let cachedVersion: string | null = null;
+
+async function serverVersion(): Promise<string> {
+  if (cachedVersion) return cachedVersion;
+  try {
+    const { readFile } = await import("node:fs/promises");
+    const { fileURLToPath } = await import("node:url");
+    const { dirname, join } = await import("node:path");
+    const here = dirname(fileURLToPath(import.meta.url));
+    const raw = await readFile(join(here, "..", "package.json"), "utf8");
+    cachedVersion = String((JSON.parse(raw) as { version?: string }).version ?? "0.0.0");
+  } catch {
+    cachedVersion = "0.0.0";
+  }
+  return cachedVersion;
+}
+
+/**
+ * Serves MCP on stdio. stdout carries protocol frames only — anything this server wants to say to
+ * a human goes to stderr, or it corrupts the stream.
+ */
+export async function runMcp(argv: readonly string[]): Promise<void> {
+  const { projectId } = parseMcpArgs(argv);
+  const session = await openSession({
+    projectId,
+    deployKey: process.env.ROBODEV_DEPLOY_KEY,
+  });
+  console.error(`robodev mcp: project ${session.projectId} on ${starbaseUrl()} (${session.auth})`);
+
+  let buffer = "";
+  stdin.setEncoding("utf8");
+  for await (const chunk of stdin) {
+    const taken = takeCompleteLines(buffer, chunk as string);
+    buffer = taken.buffer;
+    for (const line of taken.lines) {
+      const request = parseMessage(line);
+      if (!request) continue;
+      const response = await handleRequest(session, request).catch((error: unknown) =>
+        request.id === undefined
+          ? null
+          : failure(
+              request.id,
+              INTERNAL_ERROR,
+              error instanceof Error ? error.message : "Internal error",
+            ),
+      );
+      if (response) stdout.write(`${JSON.stringify(response)}\n`);
+    }
+  }
+}

package/templates/auth-chat/.rulesync/skills/povio-ui-styling/SKILL.md

@@ -132,6 +132,9 @@ Do not create a CSS file for ordinary spacing, flex/grid layout, a simple hover,
 | Generated design tokens                                        | Figma-generated `theme.css` |
 | Handwritten global token or browser rule                       | `base.css` or `globals.css` |
 
+Retheming the app means overriding tokens in `globals.css`, in `@layer base`, after the
+`theme.css` import — nowhere else redeclares them, so the last declaration in that layer wins.
+
 ## Guardrails
 
 - Use `@povio/ui` before creating a custom primitive.

package/templates/auth-chat/apps/fe/src/styles/base.css

@@ -82,22 +82,3 @@ html {
 .flex-fill {
   flex: 1 0 0;
 }
-
-:root {
-  --elevation-fill-default-2-base: 248 249 249;
-  --elevation-outline-default-1-base: 218 220 221;
-  --elevation-outline-default-2-base: 198 200 201;
-  --interactive-contained-primary-idle-base: 0 90 154;
-  --interactive-contained-primary-hover-base: 46 142 210;
-  --interactive-contained-primary-pressed-base: 95 170 224;
-  --interactive-contained-primary-disabled-base: 155 194 221;
-  --interactive-contained-primary-focus-base: 95 170 224;
-  --interactive-outlined-primary-on-idle-base: 0 90 154;
-  --interactive-outlined-primary-outline-idle-base: 0 90 154;
-  --interactive-outlined-primary-outline-hover-base: 46 142 210;
-  --interactive-text-primary-idle-base: 0 90 154;
-  --interactive-text-primary-hover-base: 46 142 210;
-  --text-default-1-base: 25 26 27;
-  --text-default-2-base: 79 85 88;
-  --text-default-3-base: 111 114 116;
-}

package/templates/auth-chat/package.json

@@ -12,7 +12,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.45.1",
+    "robodev": "^0.47.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/package.json

@@ -11,7 +11,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.45.1",
+    "robodev": "^0.47.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/catalog.json

@@ -25,6 +25,11 @@
       "id": "empty",
       "title": "Empty",
       "description": "Blank database.ts and GET /api/health plus a hosted Welcome page. No sample schema."
+    },
+    {
+      "id": "shadcn",
+      "title": "Shadcn",
+      "description": "Blank database.ts and GET /api/health plus a hosted Welcome page with shadcn and an orval client. No sample schema."
     }
   ]
 }

package/templates/empty/package.json

@@ -16,7 +16,7 @@
     "react-dom": "^18.3.1"
   },
   "devDependencies": {
-    "robodev": "^0.45.1",
+    "robodev": "^0.47.0",
     "typescript": "^5.9.2",
     "vite": "^6.0.0"
   }