Skip to content

feat(studio): X04b bundle, serve and embed the chat widget - #1121

Merged
LinuxDevil merged 3 commits into
mainfrom
fb-x04b-widget-serve-embed
Nov 14, 2026
Merged

LinuxDevil merged 3 commits into
mainfrom
fb-x04b-widget-serve-embed

Conversation

@LinuxDevil

Copy link
Copy Markdown
Owner

Summary

  • vite.widget.config.ts + src/widget/entry.ts → dist/widget/forge-chat.js (10.96 kB IIFE registering <forge-chat>); build:studio = SPA build → widget build → server build; .fallowrc.json entry updated.
  • GET /serve/:id/widget.js — public bundle route (enabled-gated; LOUSHO_WIDGET_MISSING/LOUSHO_NOT_SERVED; Cache-Control: public, max-age=300; no CORS headers, no token).
  • Widget key (fwk_…, stored beside the serve token in ServeFile): accepted only on POST /serve/:id/chat from an allowedOrigins origin — other routes 401 LOUSHO_WIDGET_KEY_SCOPE, missing/foreign origin 403 LOUSHO_WIDGET_ORIGIN, revoked → 401. POST/DELETE /agents/:id/serve/widget-key manage it; ServeStatus.widgetKeyMasked; runtimeClient.createWidgetKey/revokeWidgetKey.
  • ServeCard Embed on a page details (enabled only): Create widget key (disabled Add an allowed origin first with empty origins), placeholder snippet (token="YOUR_WIDGET_KEY"), Copy with key (raw key in memory only), Rotate/Revoke, scope note. Serve token never appears.

Note: this branch merges fb-x04a-forge-chat (#1120) — X04b needs both the widget element and the Serve card; the X04a files in the diff are #1120's.

Test plan

  • serveWidget.test.ts 3 tests — 200+headers, missing bundle, disabled/bad id
  • serveWidgetKey.test.ts 6 tests — create/rotate/revoke, chat+origin 200 SSE+CORS, scope 401s, origin 403s, serve token unaffected
  • entry.test.ts + ServeCard embed tests (5 new); widget suite 27 green
  • npm run build:studio writes dist/index.html + dist/widget/forge-chat.js + dist-server
  • typecheck (client+server), eslint (only pre-existing steerGate), fallow clean on touched files

Stacked on #1119 (contains #1120).

Generated with Devin

LinuxDevil and others added 2 commits November 13, 2026 04:52
- vite.widget.config.ts + src/widget/entry.ts build dist/widget/forge-chat.js
  (one IIFE registering <forge-chat>); build:studio runs it after the SPA
  build; fallow entry updated.
- GET /serve/:id/widget.js serves the bundle publicly (enabled-gated,
  404 LOUSHO_WIDGET_MISSING/LOUSHO_NOT_SERVED, 5-min cache).
- Per-agent widget key (fwk_…, stored beside the serve token): accepted
  only on POST /serve/:id/chat from an allowed Origin - other routes 401
  LOUSHO_WIDGET_KEY_SCOPE, missing/foreign Origin 403 LOUSHO_WIDGET_ORIGIN;
  POST/DELETE /agents/:id/serve/widget-key manage it; ServeStatus gains
  widgetKeyMasked; runtimeClient createWidgetKey/revokeWidgetKey.
- ServeCard "Embed on a page" details: create/rotate/revoke, placeholder
  snippet, Copy with key (raw key in memory only), scope note.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@LinuxDevil
LinuxDevil changed the base branch from fb-x03-serve-mcp to main November 14, 2026 13:59
@LinuxDevil
LinuxDevil merged commit 04da723 into main Nov 14, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant