AGENTS.md@packages/web ยท diff
git:20261009.95ca1ef to git:20261012.83db886
3 added, 3 removed. Audit A to A.
# @shadowclone/web
- Serves the local browser wizard: the skill map, build naming, voice capture, skill drafts, and cloud bot setup pages. The CLI and the MCP server start it.
+ Serves the local browser wizard: the skill map, build naming, voice capture, and skill drafts. The CLI starts it.
<!-- package-facts:start -->
(generated by `bun run guides`; do not edit by hand)
- Package name: `@shadowclone/web`
- - Workspace dependencies: `@shadowclone/agents`, `@shadowclone/builds`, `@shadowclone/cloud`, `@shadowclone/core`, `@shadowclone/environment`, `@shadowclone/learning`, `@shadowclone/redact`, `@shadowclone/sessions`, `@shadowclone/skills`
+ - Workspace dependencies: `@shadowclone/agents`, `@shadowclone/builds`, `@shadowclone/core`, `@shadowclone/environment`, `@shadowclone/learning`, `@shadowclone/redact`, `@shadowclone/skills`
- External dependencies: `zod`
- Export subpaths: `.`
<!-- package-facts:end -->
## Owns
- `src/server.ts`: `serveBuildWizard`, which binds `127.0.0.1` and prints the page URL.
- `src/handler.ts` and `security.ts`: the API routes and the request checks.
- `src/client/`: the browser code and styles. The CLI build bundles them.
- `src/voice/`: GitHub writing capture and the voice file.
- - `src/bot/`: the cloud bot setup pages. `src/skillDrafts.ts`, `buildNames.ts`: the model-backed actions.
+ - `src/skillDrafts.ts`, `buildNames.ts`: the model-backed actions.
## Rules
- The server listens on loopback only. Every request needs the ephemeral token and a matching origin (`authorizeBrowserRequest`).
- JSON responses send `Cache-Control: no-store` and a strict Content Security Policy.
- Opening the wizard makes no model request and grants no capture consent.
- Model actions use the learning execution contract: no tools and one call. Build naming uses the fast tier.
- Voice capture reads through `gh` only when `github-writing` is on and the managed policy allows it.
- `writeVoiceFile` creates `~/.agents/voice.md` only when no file or link exists there.
## Tests
Run `bun test` in this folder, or `bun test packages/web` from the root. The tests call the handler with synthetic requests and a mock runner. They open no browser.
Update this file in the same commit when you change the package purpose, public exports, dependencies, or a rule above.