Skip to content

feat: full monorepo scaffold — widget + backend + CI/CD#6

Merged
OpenCodeEngineer merged 4 commits into
mainfrom
feat/full-scaffold
Apr 19, 2026
Merged

feat: full monorepo scaffold — widget + backend + CI/CD#6
OpenCodeEngineer merged 4 commits into
mainfrom
feat/full-scaffold

Conversation

@OpenCodeEngineer

Copy link
Copy Markdown
Collaborator

Summary

Full monorepo scaffold for @vibetechnologies/webagent — an embeddable GenAI-powered customer support chat widget.

Widget (packages/widget)

  • Entry point: WebAgent.init(config) — Shadow DOM mount, Preact render
  • Agent loop: Vercel AI SDK generateText({ maxSteps: 10 }) with 5 tools
  • Tools: web_fetch (CORS proxy), skill (preloaded API skills), todo (task tracker), send_email (backend relay), escalate_to_human (ticket + email)
  • Knowledge base: JSON chunk fetcher + TF-IDF search
  • Session store: IndexedDB primary, localStorage fallback, TTL cleanup
  • WebMCP: Provider (skills → navigator.modelContext.registerTool()), consumer (host tools → agent), declarative forms
  • UI: ChatFAB, ChatWindow, ChatMessage (XSS-safe), EscalationModal, TodoPanel
  • Build: esbuild → webagent.min.js (IIFE) + webagent.esm.js

Backend (packages/backend)

  • Hono on Cloudflare Workers — single app, all routes
  • LLM proxy: BYOK + managed keys, SSE streaming, usage metering
  • Fetch proxy: SSRF protection, 1MB cap
  • Email: Queue-based via Resend API
  • Escalation: Ticket ID gen, HTML email, D1 storage
  • Admin: Customer key CRUD, admin secret auth
  • KB: R2 storage with CDN caching
  • D1 schema: customers, usage_log, escalation_tickets

Infrastructure

  • Turborepo + pnpm workspaces
  • CI/CD: lint/test/build on PR, npm publish on release, wrangler deploy on push
  • 3 examples: basic, ecommerce, docs-site

Security fixes applied

  • XSS prevention: HTML escaped before markdown rendering, safe URL protocol check
  • Auth: Empty bearer tokens rejected
  • KB admin: ADMIN_SECRET value validated (not just presence)
  • Managed provider routing: Uses stored provider from KV, not just header
  • Todo state: Ref-based to prevent stale closures in multi-step agent runs

Verified

  • pnpm -r typecheck passes
  • pnpm --filter @vibetechnologies/webagent build produces bundles

Closes #4

engineer and others added 3 commits April 18, 2026 20:25
- ci.yml: typecheck, lint (optional), test, build on push/PR to main
- publish.yml: publish packages/widget to npm on GitHub release
- deploy.yml: deploy packages/backend to Cloudflare Workers on push to main (path-filtered)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Widget (@vibetechnologies/webagent):
- Preact + Shadow DOM entry point (WebAgent.init)
- Client-side agent loop via Vercel AI SDK generateText
- 5 tools: web_fetch, skill, todo, send_email, escalate_to_human
- Knowledge base loader with TF-IDF search
- IndexedDB + localStorage session persistence with TTL
- WebMCP integration (provider + consumer + declarative forms)
- XSS-safe markdown rendering in chat messages
- esbuild bundle producing webagent.min.js + webagent.esm.js

Backend (@vibetechnologies/webagent-backend):
- Hono app on Cloudflare Workers
- LLM proxy with BYOK + managed key auth
- SSE streaming passthrough
- Fetch proxy with SSRF protection
- Email via Cloudflare Queues + Resend
- Escalation with ticket tracking + HTML email
- Admin API for customer key CRUD
- Knowledge base storage via R2
- D1 schema for customers, usage, tickets

Infrastructure:
- Turborepo + pnpm workspaces
- GitHub Actions CI/CD (ci, publish, deploy)
- 3 example pages (basic, ecommerce, docs-site)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Widget agent loop, types, knowledge base (TF-IDF)
- All 5 tools (web_fetch, skill, todo, send_email, escalate)
- Session store with IndexedDB + localStorage adapters
- WebMCP integration (provider, consumer, declarative forms)
- UI components (ChatFAB, ChatWindow, EscalationModal, TodoPanel)
- CSS styles with theming and dark mode
- esbuild config, widget tsconfig
- CI/CD workflows
- pnpm lockfile
- Global window.WebAgent export for script tag usage

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… test/build steps

- pnpm/action-setup@v4 errors on dual version spec (version: 9 + packageManager: pnpm@9.15.0)
- Gracefully skip tests when none exist yet
- Backend build: use tsc --noEmit instead of wrangler deploy --dry-run (no CF bindings in CI)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@OpenCodeEngineer OpenCodeEngineer merged commit f2ee316 into main Apr 19, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Initial scaffold: monorepo, widget, backend, CI/CD

1 participant