fix: unbreak cold install and harden /api/config

.env.example

@@ -0,0 +1,43 @@
+# Firecrawl Web Agent — root env example
+#
+# ⚠️ This file is documentation only. No code at the repo root reads .env —
+#    each template loads its own. Copy the per-template example into the
+#    template you're running:
+#      agent-templates/next/.env.local.example      → .env.local
+#      agent-templates/express/.env.example         → .env
+#      agent-templates/library/.env.example         → .env
+
+# --- Required ---
+
+# Firecrawl API key — get one at https://www.firecrawl.dev/app/api-keys
+FIRECRAWL_API_KEY=
+
+# --- Model provider (pick one) ---
+
+# Shorthand: provider:model_id. Overrides MODEL_PROVIDER + MODEL_ID when set.
+# Default matches agent-templates/express/server.ts:defaultModel().
+# MODEL=google:gemini-3-flash-preview
+
+# Or split form — same default.
+# MODEL_PROVIDER=google
+# MODEL_ID=gemini-3-flash-preview
+
+# --- Provider keys — set at least one matching MODEL_PROVIDER ---
+
+ANTHROPIC_API_KEY=
+OPENAI_API_KEY=
+GOOGLE_GENERATIVE_AI_API_KEY=
+
+# --- Optional ---
+
+# AI_GATEWAY_API_KEY=
+# CUSTOM_OPENAI_API_KEY=
+# CUSTOM_OPENAI_BASE_URL=
+
+# --- Security (next template) ---
+#
+# Required in hosted environments (Vercel, Railway, Fly, Render) to allow
+# the /api/config endpoint to write API keys. Requests must supply a
+# matching "Authorization: Bearer <token>" header. Leave unset for local
+# development (the endpoint stays open only when not running hosted).
+# CONFIG_ADMIN_TOKEN=

.internal/scripts/sync-agent-core.mjs

@@ -34,6 +34,10 @@ const RSYNC_EXCLUDES = [
   ".turbo",
   "*.tsbuildinfo",
   ".DS_Store",
+  // Templates vendor agent-core as source; they don't install from the
+  // vendored package.json and its lockfile would just be dead weight
+  // polluting diffs. Keep agent-core's own pnpm-lock.yaml out of the sync.
+  "pnpm-lock.yaml",
 ];
 
 function parseArgs() {

agent-core/package.json

@@ -110,6 +110,7 @@
     "@langchain/google": "^0.1.10",
     "@langchain/google-genai": "^2.1.26",
     "@langchain/openai": "^1.4.4",
+    "@types/node": "^20.10.4",
     "tsup": "^8.0.0",
     "tsx": "^4.19.0",
     "typescript": "^5.3.3",

agent-templates/express/.env.example

@@ -15,7 +15,9 @@ OPENAI_API_KEY=
 # AI_GATEWAY_API_KEY=
 # CUSTOM_OPENAI_API_KEY=
 # CUSTOM_OPENAI_BASE_URL=
-# CORS_ORIGIN=*
+# CORS — opt-in. Unset = same-origin only (safe default). Set to a specific
+# origin (https://app.example.com) to allow that origin, or "*" to open fully.
+# CORS_ORIGIN=
 # PORT=3000
 # LOG=0  # disable request logging
 # BODY_LIMIT=1mb  # max request body size

agent-templates/express/agent-core/package.json

@@ -110,6 +110,7 @@
     "@langchain/google": "^0.1.10",
     "@langchain/google-genai": "^2.1.26",
     "@langchain/openai": "^1.4.4",
+    "@types/node": "^20.10.4",
     "tsup": "^8.0.0",
     "tsx": "^4.19.0",
     "typescript": "^5.3.3",