<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Introduces URL-based theme generation alongside image uploads,
enabling prompts derived from live websites.
> 
> - New `Website URL` input source in `AIGeneratorTab` with toggle,
validation, crawl status indicators, and adjusted generate button/empty
states
> - Adds `useGenerateThemeFromUrl` hook and integrates it with existing
generation flow and loading state
> - Extends IPC types with `ThemeInputSource`, `CrawlStatus`, and
`GenerateThemeFromUrlParams`; updates `templateContracts` with
`generate-theme-from-url`
> - Implements `generate-theme-from-url` handler: validates inputs,
calls Dyad Engine `/tools/web-crawl`, selects web-crawl-specific system
prompts (inspired/high-fidelity), streams model output, and returns
prompt with robust error handling
> - Preserves and refines image-based generation; resets state on dialog
close and adds small UI polish (icons, counters, disabled states)
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
b5b1aebb277ce421953a06b148bd342fded2a64f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Add URL-based theme generation with web crawling to the custom theme
generator, alongside image uploads. Users can paste a website URL to
extract a design system and generate a prompt with clear generation
status, with added security and reliability improvements.

- **New Features**
- Source toggle: switch between “Upload Images” and “Website URL,” with
state reset on dialog close.
- URL input flow: validate URL and update button states/text; show
generating state during processing.
- New hook and types: useGenerateThemeFromUrl, ThemeInputSource,
CrawlStatus.
- IPC + contract: generate-theme-from-url with
GenerateThemeFromUrlParams and result typing.
- Backend handler: validates Dyad Pro + API key, URL, keywords; crawls
via Dyad Engine (/tools/web-crawl); uses screenshot + markdown with
truncation; distinct meta prompts for inspired vs high-fidelity; model
mapping (Gemini 3 Pro, Claude Opus 4.5, GPT-5.2); streams prompt;
returns clear errors; test mode stub output.

- **Bug Fixes**
- Security: restrict to HTTP/HTTPS URLs; block internal/private hosts
(SSRF); sanitize crawled markdown and user keywords; Zod-validate crawl
response.
- Reliability: 120s crawl timeout with AbortController; clearer errors;
UUID request IDs.
- UI: add “generating” state; fix effect deps to avoid races; correct
button disabled states.
  - Code health: shared model map at module scope (DRY).

<sup>Written for commit b8aef2d51b1c5b7de5266f5afdfeb3174a64285b.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2347">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Will Chen <willchen90@gmail.com>