Teach agent builder packed frontends

agent_builder/skills/a2apack-agent-authoring/SKILL.md

@@ -154,6 +154,32 @@ runtime:
 If it calls external hosts, declare `egress` on the class. If it needs secrets,
 use `required_secrets` and `ctx.secret("NAME")`; do not hard-code credentials.
 
+## Packed Frontends
+
+If the user asks for a usable app, dashboard, workflow UI, or customer-facing
+demo surface, scaffold a packed frontend instead of a separate web app. Use
+`init_agent_template(name, description, frontend="react")` for the React/Vite
+starter or `frontend="static"` for a no-build HTML bundle.
+
+The deployment manifest should keep the browser app under the agent source:
+
+```yaml
+frontend:
+  path: frontend
+  build: npm run build
+  dist: dist
+  mount: /app
+  auth: inherit
+```
+
+At runtime the platform serves the app from `/app`, exposes generated config at
+`/app/config.json`, exposes a helper client at `/app/a2a-client.js`, and uses
+the agent's public `@skill` schemas for callable operations. Frontend code
+should load the generated config/client, call the public skills, and rely on
+inherited platform auth. Do not put control-plane tokens, provider keys,
+secrets, internal stack details, or private execution assumptions in frontend
+source.
+
 ## A2A Skill vs DeepAgents Skill
 
 Use A2A `@skill` for caller-visible operations and billing boundaries. Use

agent_builder/skills/agent-quality-review/SKILL.md

@@ -16,6 +16,7 @@ Every generated project needs:
 - `requirements.txt`
 - Optional `skills/<skill-name>/SKILL.md` bundles for nontrivial DeepAgents
   behavior
+- Optional `frontend/` source when the agent ships a packed app
 
 Run `list_agent_files` and read the files that matter. If the project was
 deployed before, use `sync_agent_workspace_from_repo` before editing when the
@@ -66,11 +67,34 @@ runtime:
 Use `runtime.apt_packages` only for Debian system binaries. Python packages
 belong in `requirements.txt`.
 
+If a packed frontend is declared, verify the manifest and files line up:
+
+```yaml
+frontend:
+  path: frontend
+  build: npm run build
+  dist: dist
+  mount: /app
+  auth: inherit
+```
+
+For React/Vite frontends, expect `frontend/package.json`,
+`frontend/vite.config.js`, `frontend/src/App.jsx`, and `frontend/src/a2a.js`.
+For static frontends, expect `frontend/dist/index.html`. The browser code must
+not contain platform secrets, provider keys, hard-coded deployment URLs, or
+private stack details. It should load `/app/config.json`, use
+`/app/a2a-client.js` or generated config endpoints, and call only the public
+`@skill` schemas.
+
 ## Sandbox And Live Card
 
 Always run `test_agent_in_sandbox(name)` before deploy. Treat nonzero exit as
 source failure, then read stderr, edit, and rerun.
 
+When a frontend is present, inspect the sandbox output's `a2a frontend info`.
+For React apps, make sure `frontend/package.json` defines a build script and
+the deployed build process can produce `frontend/dist/index.html`.
+
 After `cp_deploy_tarball`, compare `live_skills[].input_schema` with the
 actual public `@skill` signatures. If a live schema is missing an argument or
 shows an old shape, refresh or redeploy until the live Agent Card matches the