web-frontend

Enforces browser-surface conventions for Python-to-TypeScript web asset boundaries and wire contracts.

4|Updated Mar 17, 2026
One-click install
npx skills add https://github.com/yeaboi-ai/yeaboi.ai --skill web-frontend-yeaboi-ai
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: web-frontend
Source: https://github.com/yeaboi-ai/yeaboi.ai/tree/main/.claude/skills/web-frontend
Command: npx skills add https://github.com/yeaboi-ai/yeaboi.ai --skill web-frontend-yeaboi-ai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It prevents drift between a Python backend and a separately built TypeScript front end by codifying the asset boundary, CSP rules, payload conventions, and generated contract artifacts that keep both repos in sync. ## Core Features & Use Cases - Asset boundary rules: Defines how Python reaches Vite-built bundles only through web/assets.py, brand.py, and security.py, with no handler writing its own headers or markup. - Contract generation workflow: Documents contracts/web/ artifacts (enums.json, ui.json, fixtures) regenerated via make web-types and vendored by the front-end repo. - Wire guards: Explains the two-direction test guards (wire shapes and request keys) that catch dropped response fields and silent request-key failures. - Use Case: When editing an exporter or share/board surface, follow this Skill to keep payloads markup-free, CSP-compliant, and consistent with the front-end repo's type checks. ## Quick Start Ask the assistant to review changes to src/yeaboi/web/ or an exporter against the web-frontend conventions before committing.

Frequently Asked Questions about web-frontend

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I keep a Python backend and TypeScript front end in sync?

Generate shared contract artifacts such as enums.json and ui.json from the Python side, vendor them into the front-end repo by commit sha, and run wire-shape tests in both repos so a dropped field fails typecheck on either side.

How do I serve self-contained HTML bundles under a strict CSP?

Build classic IIFE bundles with no CDN links, no eval, and no dynamic imports, then serve them with a CSP like connect-src 'none' for inert exports. Centralize all headers in one security module so no request handler writes its own.

Can a static HTML export opened over file:// make network requests?

No, not when served with a CSP containing connect-src 'none', which physically blocks requests from written files. Editable exports use a separate policy allowing connect-src 'self' only when a server is behind them.

Why does a front-end request parameter silently fail against a Python API?

Silent failures happen when the server reads keys via payload.get with a default, so a renamed or misspelled request key just returns the default. Guard this by parsing request bodies in tests and requiring every key to match a handler-read name.

Should server payloads include presentation values like colors?

No, payloads should carry words or numbers such as status labels, never colors or markup, with components mapping them to styles. A narrow exception is per-column directional thresholds sent as a gated tone word.