[zurfyx]

What

A landing page for Agentbox under site/. It's a single static Astro page, deployed on Vercel. The Vercel project agentbox is Git-linked to this repo with root directory site. PRs get preview deployments, and merging to main publishes to production (currently agentbox-swart.vercel.app).

The page covers:

• Hero: the brew trust + brew install commands with a copy button, and the real agentbox info output from a fresh install.
• Manifest: the current release's runtime digest, plus each agent's version, byte length, SHA-256 and download host.
• Release flow: download → verify → validate → activate, plus rollback.
• Access table: default vs --workspace-only, followed by a plain "it isn't a sandbox" section, as AGENTS.md and docs/security.md require.
• Command reference.

Every claim was checked against README.md and docs/. The info transcript keeps the exact format libexec/host.sh prints. I confirmed it by running the real v0.1.34 release in a throwaway Homebrew-shaped prefix.

Release data is never hardcoded

At build time, site/src/lib/release.ts reads three sources:

• the version the Homebrew tap serves,
• that release's provenance.json,
• release-inputs.json at the release's source commit.

None of these use the rate-limited GitHub API. Every field is validated. If any of it fails, the build uses site/src/data/release-snapshot.json and the page says it's a snapshot, rather than breaking the build or claiming to be current. npm run snapshot refreshes the snapshot.

Design

I followed impeccable.style's guidance and avoided the usual dev-tool look. The concept is a container with a declared manifest:

• Type: Archivo (variable width; wide, heavy cuts for display) and Martian Mono, used only for code and data. Both are self-hosted through Astro's Fonts API, with metric-matched fallbacks.
• Color: OKLCH slate neutrals and one safety-orange signal color. The light and dark themes were each designed rather than one inverting the other.
• Motion: one authored moment. The transcript reveals once, with a replay button. Content is visible without JS, and reduced motion shows it at once.
• Mobile: layouts built for phones: the manifest becomes a stacked list and the access table fits three columns.

Other changes

• ci.yml: new site lane (type-check and build) added to required. Actions are pinned by SHA, per the static test.
• .dockerignore: excludes site/ from the runtime image's build context.
• AGENTS.md: the website joins the "keep in sync" list.

The release archive is allowlist-based, and the shell lint and format checks don't match anything in site/, so neither is affected.

Verification

• astro check: 0 errors. The build passes locally, on Vercel, and offline with forced network failure (falls back to the snapshot).
• Playwright against the built site:
  • The copy button puts exactly the two commands on the clipboard, and announces it through a live region.
  • When clipboard access is denied, the fallback selects the commands instead.
  • Replay works. Reduced motion and no-JS both behave correctly.
  • No horizontal overflow at 390px or 1440px, in light or dark.
• axe (WCAG 2.2 AA + best practice): 0 violations in both themes.
• npx impeccable detect on the built page: no findings.
• Code review run before opening the PR; its 10 findings are fixed here.
• Root npm test: identical to main on my Mac (the 13 failures there need Bash 5); CI is authoritative.

Follow-ups (not in this PR)

• Freshness: the page updates when it's rebuilt. A Vercel deploy hook called at the end of release.yml would refresh it on every release. It needs a repo secret, so I left it out.
• Custom domain: e.g. agentbox.rovira.sh needs a CNAME in Cloudflare. After that, the Formula homepage and README could link to the site.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agentbox	Ready	Preview	Oct 27, 2026 4:56pm UTC