docs(editor): frontend contract for Lovable (Steps 6-7) - #69
Merged
Conversation
Exact API contract for the code editor + version UI, so Lovable builds against the real shapes (companion to docs/agent-params-frontend-contract.md). Docs only. Specifies: (1) POST /deploy (multi-file), POST /rollback, GET /versions — exact request/response; (2) the requirements-picker allowlist source — answers 'static lockfile, no GET' and specifies GET /cloud/deps/allowlist to ADD (flagged NOT YET IMPLEMENTED, trivial); (3) the version object shape (version_no/status/created_at/ active flag); (4) error shapes by stage/code for inline rendering; (5) template picker via the existing GET /templates registry. Marks which endpoints are flag-gated (deploy/rollback) vs live now (versions/templates). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
WayforthOfficial
added a commit
that referenced
this pull request
Jun 27, 2026
Serves the curated allowlist as name -> sorted versions for Lovable's requirements picker. Hashes are a build-time integrity detail and are NEVER sent to the client — the payload is only package names + installable versions (all the picker needs). - Reuses services.agent_deps.load_lockfile(); transform extracted to _allowlist_payload() so the no-hashes guarantee is unit-tested on the exact code the endpoint serves. - Authenticated cloud_agents tier, like the rest of /cloud/*. Not flag-gated (read-only reference) — testable now. - 3 unit tests incl. the load-bearing 'no sha256 reaches the client'. Suite 626 passed. - Updates the editor contract doc (#69): §2 + the flag-table now mark the endpoint live. Co-authored-by: MytelligentPRV <assulindor@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The editor frontend-contract doc — same as the params contract (#58) — so Lovable builds against the exact API, not an approximation. Docs only, for review; then you hand it to Lovable.
docs/agent-editor-frontend-contract.mdspecifies, precisely:POST /cloud/agents/{id}/deploy(multi-file{files, requirements}),POST /cloud/agents/{id}/rollback,GET /cloud/agents/{id}/versions— exact request/response bodies + status codes.GET /cloud/deps/allowlist(name → installable versions, hashes omitted) and flags it NOT YET IMPLEMENTED — a trivial read-only endpoint to add (called out prominently so it isn't discovered mid-build). The picker can't render without it.id, version_no, status (building|active|superseded|failed), image_ref, created_at, + active flag (id === active_version_id). Notes the optionaldep_flaggedbadge for revoked-package surfacing.redeploy_files|params|requirements|build) and per-field codes (not_allowed, version_not_allowed, unpinned, revoked, …) so the editor renders failures inline (PARAMS errors on the entrypoint, requirement errors on the offending line).GET /templates/GET /templates/{id}registry (no new endpoints).Plus a flag-gating table up top:
GET /versions+GET /templatesare testable now;POST /deploy+POST /rollbackreturn409 versioning_disableduntil the Step-4b flip — so Lovable knows what to build live vs. against spec.One thing needing your call
The contract depends on
GET /cloud/deps/allowlist, which doesn't exist yet (the allowlist is the staticagent_deps_lock.json). It's a one-liner (serve the lockfile minus hashes). Flagged in §2 — greenlight it and I'll add it as a tiny PR before/alongside the frontend.🤖 Generated with Claude Code