AGENTS.md@packages/web git:20261009.95ca1efA

Immutable. This exact content never changes and is served at /api/v1/blob/14de1bde329d4b37.

# @shadowclone/web

Serves the local browser wizard: the skill map, build naming, voice capture, skill drafts, and cloud bot setup pages. The CLI and the MCP server start it.

<!-- package-facts:start -->

(generated by `bun run guides`; do not edit by hand)

- Package name: `@shadowclone/web`
- Workspace dependencies: `@shadowclone/agents`, `@shadowclone/builds`, `@shadowclone/cloud`, `@shadowclone/core`, `@shadowclone/environment`, `@shadowclone/learning`, `@shadowclone/redact`, `@shadowclone/sessions`, `@shadowclone/skills`
- External dependencies: `zod`
- Export subpaths: `.`

<!-- package-facts:end -->

## Owns

- `src/server.ts`: `serveBuildWizard`, which binds `127.0.0.1` and prints the page URL.
- `src/handler.ts` and `security.ts`: the API routes and the request checks.
- `src/client/`: the browser code and styles. The CLI build bundles them.
- `src/voice/`: GitHub writing capture and the voice file.
- `src/bot/`: the cloud bot setup pages. `src/skillDrafts.ts`, `buildNames.ts`: the model-backed actions.

## Rules

- The server listens on loopback only. Every request needs the ephemeral token and a matching origin (`authorizeBrowserRequest`).
- JSON responses send `Cache-Control: no-store` and a strict Content Security Policy.
- Opening the wizard makes no model request and grants no capture consent.
- Model actions use the learning execution contract: no tools and one call. Build naming uses the fast tier.
- Voice capture reads through `gh` only when `github-writing` is on and the managed policy allows it.
- `writeVoiceFile` creates `~/.agents/voice.md` only when no file or link exists there.

## Tests

Run `bun test` in this folder, or `bun test packages/web` from the root. The tests call the handler with synthetic requests and a mock runner. They open no browser.

Update this file in the same commit when you change the package purpose, public exports, dependencies, or a rule above.