feat(create-agent-app): --chat variant — the one-day multimodal chat app, CI-enforced (#188 wave 3)

[drewstone]

What

create-agent-app --chat scaffolds the examples/chat-app.md assembly as a runnable Cloudflare Workers product — the finish line of #188: scaffold → deployed multimodal chat app in one day, and CI proves the claim stays true.

The generated app (create-agent-app/template-chat/)

Piece	File	What it composes
DATA surface	agent.config.ts + prompts/system.md (Text module)	name, system prompt, model default + effort, harness, renderable ask kinds
Composer	src/chat.ts	createAppAuth (drizzle/D1, memoryAdapter comment) + createChatStore + createChatTurnRoutes (turn/replay/interactions) + createUploadRoute + thread CRUD handlers
Sandbox lane	src/sandbox.ts	config-driven SandboxRuntimeConfig → ensureWorkspaceSandbox + streamSandboxPrompt + createSandboxChatProducer; upload sink (box.fs); sidecar connection for asks. No mock fallback — missing creds fail loud
Schema	src/db/schema.ts + migrations/0001_init.sql	better-auth tables + createChatTables() + the /stream turn-buffer DDL; wrangler.toml carries the D1 binding + migrations_dir (R2 commented off)
HTTP	src/worker.ts + public/index.html	routing only + an honest dependency-free dev chat page (auth, threads, attach → parts, NDJSON streaming); CUSTOMIZE ⑤ points the real UI at /web-react
Breadcrumbs	AGENTS.md / CLAUDE.md / CUSTOMIZE.md / README.md	the base template's checklist voice, chat-variant contract

The CI enforcement (two layers)

1. The generated app ships its own e2e test (template-chat/tests/chat-turn.e2e.test.ts): executes the REAL migrations/0001_init.sql into better-sqlite3, signs up through the real better-auth drizzle adapter, uploads a file (inline data: part), POSTs a turn whose only fake is the sandbox event feed (canonical sidecar events through the real createSandboxChatProducer bridge), consumes the NDJSON stream (text deltas, reasoning, tool_call/tool_result, usage), asserts user+assistant rows persisted with typed parts + the usage receipt, then replays the buffered turn. Plus: fail-closed 401 before any row, and a turn-buffer-DDL-matches-TURN_EVENTS_MIGRATION_SQL drift gate.
2. The repo gate (tests/create-agent-app-chat.test.ts) scaffolds --chat into tmp, installs agent-app as a copy of the published payload (the fix(create-agent-app): repair template deps/types, harden scaffold CI, scope npm name (#188) #195 hardening — undeclared deps cannot leak through the repo's node_modules), links only what the generated package.json declares, typechecks the generated app, checks engine pins against agent-app's peer floors, and runs the generated app's own vitest suite. If any shell factory drifts, CI reds here first.

Repo-side changes

• create-agent-app/index.mjs: --chat flag + help text (default template unchanged; base suite still green).
• create-agent-app/package.json: template-chat added to files, description covers both variants.
• @cloudflare/workers-types devDep (offline typecheck of the generated worker), knip/vitest excludes for the new template tree.

Verification

• pnpm typecheck clean, pnpm test 2484/2484 green (includes both scaffold gates), heap-bumped pnpm build green.
• Generated app on a clean scaffold: tsc --noEmit clean, own suite 4/4 green in ~1s.

🤖 Generated with Claude Code

[tangletools]

✅ Auto-approved drewstone PR — 80c3cb1f

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-15T20:02:55Z}