@meetopenbot/openbot 1.2.12 → 1.2.14

package/dist/build-tools.js

@@ -5,6 +5,7 @@ import { askAgentTools } from "./tools/ask-agent.js";
 import { installAgentTools } from "./tools/install-agent.js";
 import { threadStatusTools } from "./tools/thread-status.js";
 import { threadTitleTools } from "./tools/thread-title.js";
+import { previewTools } from "./tools/preview.js";
 import { wrapToolsWithApproval } from "./tools/approval.js";
 export const DEFAULT_APPROVAL_ACTIONS = ["update_channel_spec"];
 /**
@@ -20,6 +21,7 @@ export function buildOpenbotTools(args) {
         ...installAgentTools,
         ...threadStatusTools,
         ...threadTitleTools,
+        ...previewTools,
         ...args.context.tools,
     };
     const approvalConfig = args.context.config?.approval;

package/dist/index.js

@@ -10,6 +10,7 @@ import { askAgentTools } from './tools/ask-agent.js';
 import { installAgentTools } from './tools/install-agent.js';
 import { threadStatusTools } from './tools/thread-status.js';
 import { threadTitleTools } from './tools/thread-title.js';
+import { previewTools } from './tools/preview.js';
 import { buildOpenbotTools } from './build-tools.js';
 export const OPENBOT_PLUGIN_ID = '@meetopenbot/openbot';
 const modelField = await modelConfigField({
@@ -49,6 +50,7 @@ export const openbotPlugin = defineOpenbotPlugin({
         ...installAgentTools,
         ...threadStatusTools,
         ...threadTitleTools,
+        ...previewTools,
     },
     async *run(args) {
         const { context } = args;

package/dist/system-prompt.js

@@ -54,11 +54,13 @@ export const OPENBOT_SYSTEM_PROMPT = [
     "This runtime is a remote cloud computer. The human is in the browser at openbot.one and cannot open localhost, 127.0.0.1, or any port on this machine.",
     "- Never tell them to visit localhost. They need a public HTTPS URL.",
     "- When you ask a coding agent to run a dev server, preview, or any local process the human should open, tell them to expose it with `cloudflared tunnel --url http://127.0.0.1:<port>` and to add `cloudflared` as a **project devDependency** (not a global install — this image is ephemeral and only workspace files persist).",
-    "- Share the `https://*.trycloudflare.com` URL they print. Quick tunnels change on restart — pass the new one through. If they report a localhost URL, ask them to tunnel it.",
+    "- Share the `https://*.trycloudflare.com` URL they print, and call `open_preview` with it so it opens in the space browser. Quick tunnels change on restart — pass the new one through. If they report a localhost URL, ask them to tunnel it.",
+    "- For any other public page the human should see, call `open_preview` with that http(s) URL too. Never pass localhost, 127.0.0.1, or a port on this machine.",
     "",
     "# SPACE VARIABLES",
-    "- Secrets live in OpenBot variables, not in chat. Workspace-wide keys: Settings → Variables. Per-space keys: Space menu → Variables (override workspace keys with the same name).",
-    "- Coding agents inherit merged variables in their shell environment — including `pnpm dev` subprocesses. Do not ask the human to paste secrets. Only tell a coding agent to write a project `.env` when the scaffold requires it or the app errors about a missing `.env`; otherwise a restarted dev server should pick up keys from the shell (use exact names such as `VITE_*` for Vite).",
+    "- Secrets live in OpenBot variables, not in chat. Workspace-wide keys: Settings → Variables. Per-space keys: Space menu → Variables (override workspace keys with the same name for shell commands in that space).",
+    "- Provider keys for harness LLM calls (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, etc.) are workspace-only — space copies of those names are for app shells only and do not switch coding agents off OpenBot Credits.",
+    "- Coding agents inherit merged space variables in their shell environment — including `pnpm dev` subprocesses. Do not ask the human to paste secrets. Only tell a coding agent to write a project `.env` when the scaffold requires it or the app errors about a missing `.env`; otherwise a restarted dev server should pick up keys from the shell (use exact names such as `VITE_*` for Vite).",
     "",
     "# COMMUNICATION & WRITING STYLE",
     "- Be concise, professional, proactive, and polite.",

package/dist/tools/ask-agent.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { loadAgentModelCatalogs, validateAskModel } from "../agent-models.js";
+import { previewEventsForTunnelUrls } from "./preview.js";
 /**
  * `ask_agent` — OpenBot sends a message to another agent in its own harness.
  * Only the orchestrator may ask. Child events stream into this thread so the
@@ -103,6 +104,8 @@ async function runAskedAgent(ctx, args) {
             resolveNext = null;
         }
     });
+    const seenPreviewUrls = new Set();
+    const threadId = ctx.threadId ?? ctx.state.threadId;
     while (!isFinished || eventQueue.length > 0) {
         if (eventQueue.length === 0) {
             await new Promise((r) => {
@@ -110,7 +113,14 @@ async function runAskedAgent(ctx, args) {
             });
         }
         while (eventQueue.length > 0) {
-            await ctx.emit(eventQueue.shift());
+            const nextEvent = eventQueue.shift();
+            await ctx.emit(nextEvent);
+            for (const preview of previewEventsForTunnelUrls(nextEvent, seenPreviewUrls, {
+                agentId: ctx.agentId,
+                threadId,
+            })) {
+                await ctx.emit(preview);
+            }
         }
     }
     await runPromise;

package/dist/tools/preview.js

@@ -0,0 +1,129 @@
+import z from 'zod';
+const LOCAL_HOST = /^(?:localhost|.*\.localhost|0\.0\.0\.0|::1|127(?:\.\d{1,3}){3})$/i;
+function isLocalHostname(hostname) {
+    const name = hostname.toLowerCase().replace(/\.$/, '');
+    return LOCAL_HOST.test(name);
+}
+/** Public http(s) URL the human's browser can open, or null. */
+export function publicPreviewUrl(input) {
+    const trimmed = input.trim();
+    if (!trimmed)
+        return null;
+    const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+    let url;
+    try {
+        url = new URL(withScheme);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        return null;
+    if (url.username || url.password)
+        return null;
+    if (isLocalHostname(url.hostname))
+        return null;
+    return url.href;
+}
+const TUNNEL_URL = /https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*\.trycloudflare\.com(?::\d+)?(?:\/[^\s<>"'`)\\\]]*)?/gi;
+const MAX_SCAN_CHARS = 250000;
+function cleanMatch(raw) {
+    return raw.replace(/[.,;:!?)]+$/g, '');
+}
+/** Public Cloudflare quick-tunnel URLs mentioned in specialist output. */
+export function tunnelPreviewUrls(value) {
+    let text;
+    try {
+        text = typeof value === 'string' ? value : JSON.stringify(value) ?? '';
+    }
+    catch {
+        return [];
+    }
+    if (!text)
+        return [];
+    if (text.length > MAX_SCAN_CHARS)
+        text = text.slice(0, MAX_SCAN_CHARS);
+    const seen = new Set();
+    const urls = [];
+    for (const match of text.matchAll(TUNNEL_URL)) {
+        const url = publicPreviewUrl(cleanMatch(match[0]));
+        if (!url || seen.has(url))
+            continue;
+        seen.add(url);
+        urls.push(url);
+    }
+    return urls;
+}
+export function previewWidgetEvent(args) {
+    return {
+        type: 'client:ui:widget',
+        data: {
+            widgetId: `preview:${args.url}`,
+            kind: 'message',
+            title: 'Preview',
+            body: args.url,
+            display: 'expanded',
+            state: 'open',
+            actions: [
+                {
+                    id: 'open_preview',
+                    label: 'Open in browser',
+                    variant: 'primary',
+                    value: { previewUrl: args.url },
+                },
+            ],
+            metadata: { autoOpen: true },
+        },
+        meta: {
+            agentId: args.agentId,
+            ...(args.threadId ? { threadId: args.threadId } : {}),
+        },
+    };
+}
+/** Preview widgets for tunnel URLs in `value` that `seen` has not emitted yet. */
+export function previewEventsForTunnelUrls(value, seen, meta) {
+    const events = [];
+    for (const url of tunnelPreviewUrls(value)) {
+        if (seen.has(url))
+            continue;
+        seen.add(url);
+        events.push(previewWidgetEvent({ url, ...meta }));
+    }
+    return events;
+}
+async function openPreview(rawArgs, ctx) {
+    const channelId = ctx.channelId ?? ctx.state.channelId ?? '';
+    const threadId = ctx.threadId ?? ctx.state.threadId;
+    if (!channelId || !threadId) {
+        const message = 'Missing channelId or threadId for open_preview';
+        return { success: false, error: message, output: message };
+    }
+    const data = (rawArgs ?? {});
+    const rawUrl = typeof data.url === 'string' ? data.url : '';
+    const url = publicPreviewUrl(rawUrl);
+    if (!url) {
+        const message = 'Pass a public http(s) URL. Localhost is not reachable from the browser — tunnel it first.';
+        return { success: false, error: message, output: message };
+    }
+    await ctx.emit(previewWidgetEvent({
+        url,
+        agentId: ctx.agentId,
+        threadId,
+    }));
+    return { success: true, url, output: `Opened ${url} in the space browser.` };
+}
+export const toolDefinitions = {
+    open_preview: {
+        description: 'Open a public http(s) URL in the space browser beside the chat. Call this with a preview or tunnel URL the human should see, including https://*.trycloudflare.com. Never pass localhost, 127.0.0.1, or any address on this machine.',
+        inputSchema: z.object({
+            url: z.string().min(1).describe('Public http(s) URL to open in the space browser.'),
+        }),
+    },
+};
+export const tools = {
+    open_preview: {
+        ...toolDefinitions.open_preview,
+        execute: openPreview,
+    },
+};
+export const previewTools = tools;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meetopenbot/openbot",
-  "version": "1.2.12",
+  "version": "1.2.14",
   "description": "OpenBot coordinator runtime: ask specialists, route work into Spaces, and track todos.",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,7 +25,7 @@
     "@ai-sdk/openai": "^4.0.72",
     "ai": "^7.0.111",
     "zod": "^4.3.5",
-    "@meetopenbot/plugin-sdk": "^1.2.3"
+    "@meetopenbot/plugin-sdk": "^1.2.4"
   },
   "devDependencies": {
     "@types/node": "^20.10.1",