feat(cloud): GET /cloud/deps/allowlist for the requirements picker - #70
Merged
Conversation
Serves the curated allowlist as name -> sorted versions for Lovable's requirements picker. Hashes are a build-time integrity detail and are NEVER sent to the client — the payload is only package names + installable versions (all the picker needs). - Reuses services.agent_deps.load_lockfile(); transform extracted to _allowlist_payload() so the no-hashes guarantee is unit-tested on the exact code the endpoint serves. - Authenticated cloud_agents tier, like the rest of /cloud/*. Not flag-gated (read-only reference) — testable now. - 3 unit tests incl. the load-bearing 'no sha256 reaches the client'. Suite 626 passed. - Updates the editor contract doc (#69): §2 + the flag-table now mark the endpoint live. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The tiny endpoint the editor contract (#69) depends on — gives Lovable a live data source for the requirements picker. Quick review.
What it does
GET /cloud/deps/allowlist→{"packages": {name: [versions]}, "max_direct_deps": 20}, derived from the curated lockfile. Authenticatedcloud_agentstier (same as the rest of/cloud/*), not flag-gated (read-only reference — testable now).Hashes never reach the client — confirmed
You asked to confirm the hashes stay server-side. They do: the transform takes only
versions.keys(), dropping the[sha256:…]values. Verified on the actual payload:The transform is extracted to
_allowlist_payload()so theno sha256 reaches the clientunit test covers the exact code the endpoint serves (not a re-implementation). 3 tests, full suite 626.Doc sync
Updates
docs/agent-editor-frontend-contract.md(§2 + the flag-gating table) to mark the endpoint live rather than "to add".With this merged, #69 + this endpoint go to Lovable together — the picker has its source, and the only remaining backend gate before the editor goes live is Step 4b (mirror + real build + the flag flip).
🤖 Generated with Claude Code