@promptbook/cli 0.112.0-121 → 0.112.0-124

package/README.md

@@ -541,7 +541,7 @@ Prompts marked with `[-]` are not ready yet, prompts containing `@@@` are treate
 #### Features
 
 -   **Multi-runner execution:** `openai-codex`, `github-copilot`, `cline`, `claude-code`, `opencode`, `gemini`
--   **Context injection:** `--context AGENTS.md` or inline extra instructions
+-   **Context injection:** `--agent agents/coding/developer.book --context AGENTS.md` or inline extra instructions
 -   **Reasoning control:** `--thinking-level low|medium|high|xhigh` for supported runners
 -   **Interactive or unattended runs:** default wait mode, or `--no-wait` for batch execution
 -   **Git safety:** clean working tree check by default, optional `--ignore-git-changes`
@@ -561,11 +561,11 @@ npx ts-node ./src/cli/test/ptbk.ts coder generate-boilerplates --template prompt
 
 npx ts-node ./src/cli/test/ptbk.ts coder generate-boilerplates --template prompts/templates/agents-server.md
 
-npx ts-node ./src/cli/test/ptbk.ts coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md
+npx ts-node ./src/cli/test/ptbk.ts coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md
 
-npx ts-node ./src/cli/test/ptbk.ts coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md --auto-push
+npx ts-node ./src/cli/test/ptbk.ts coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md --auto-push
 
-npx ts-node ./src/cli/test/ptbk.ts coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md --ignore-git-changes --no-wait
+npx ts-node ./src/cli/test/ptbk.ts coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md --ignore-git-changes --no-wait
 
 npx ts-node ./src/cli/test/ptbk.ts coder find-refactor-candidates
 
@@ -587,11 +587,11 @@ ptbk coder generate-boilerplates
 
 ptbk coder generate-boilerplates --template prompts/templates/common.md
 
-ptbk coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md --test npm run test
+ptbk coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md --test npm run test
 
-ptbk coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md --auto-push
+ptbk coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md --auto-push
 
-ptbk coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md --test npm run test --ignore-git-changes --no-wait
+ptbk coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md --test npm run test --ignore-git-changes --no-wait
 
 ptbk coder find-refactor-candidates
 
@@ -604,13 +604,13 @@ ptbk coder verify
 
 #### What each command does
 
-| Command                               | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- | ------ | ---- | ----- | ------------------------------------------------------------------------ |
+| Command                               | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- | ------ | ---- | ----- | ------------------------------------------------------------------------ |
 | `ptbk coder init`                     | Creates `prompts/`, `prompts/done/`, the project-generic template files materialized in `prompts/templates/` (currently `common.md`), and a starter `AGENTS.md`; ensures `.env` contains `CODING_AGENT_GIT_NAME`, `CODING_AGENT_GIT_EMAIL`, and `CODING_AGENT_GIT_SIGNING_KEY`; adds helper coder scripts to `package.json`; ensures `.gitignore` contains `/.promptbook`; and configures `.vscode/settings.json` to save pasted prompt images into `prompts/screenshots/`. |
-| `ptbk coder generate-boilerplates`    | Creates new prompt markdown files with fresh emoji tags so you can quickly fill in coding tasks; `--template` accepts either a built-in alias or a markdown file path relative to the project root.                                                                                                                                                                                                                                                                  |
-| `ptbk coder run`                      | Picks the next ready prompt, appends optional context, runs it through the selected coding agent, can optionally verify each attempt with a shell test command and feed failing output back for retries, then marks success or failure, commits the result, and pushes only when `--auto-push` is enabled.                                                                                                                                                           |
-| `ptbk coder find-refactor-candidates` | Scans the repository for oversized or overpacked files and writes prompt files for likely refactors; `--level <xlow                                                                                                                                                                                                                                                                                                                                                  | low | medium | high | xhigh | extreme>` ranges from a very benevolent scan to a very aggressive sweep. |
-| `ptbk coder verify`                   | Walks through completed prompts, archives truly finished work, and adds follow-up repair prompts for unfinished results.                                                                                                                                                                                                                                                                                                                                             |
+| `ptbk coder generate-boilerplates`    | Creates new prompt markdown files with fresh emoji tags so you can quickly fill in coding tasks; `--template` accepts either a built-in alias or a markdown file path relative to the project root.                                                                                                                                                                                                                                                                         |
+| `ptbk coder run`                      | Picks the next ready prompt, appends optional context, runs it through the selected coding agent, can optionally verify each attempt with a shell test command and feed failing output back for retries, then marks success or failure, commits the result, and pushes only when `--auto-push` is enabled.                                                                                                                                                                  |
+| `ptbk coder find-refactor-candidates` | Scans the repository for oversized or overpacked files and writes prompt files for likely refactors; `--level <xlow                                                                                                                                                                                                                                                                                                                                                         | low | medium | high | xhigh | extreme>` ranges from a very benevolent scan to a very aggressive sweep. |
+| `ptbk coder verify`                   | Walks through completed prompts, archives truly finished work, and adds follow-up repair prompts for unfinished results.                                                                                                                                                                                                                                                                                                                                                    |
 
 #### Most useful `ptbk coder run` flags
 
@@ -633,7 +633,7 @@ ptbk coder verify
 
 1. Initialize once with `ptbk coder init`.
 2. Customize `prompts/templates/*.md` if needed, then create or write prompt files in `prompts/`.
-3. Customize the starter `AGENTS.md` with repository-specific instructions, then pass `--context AGENTS.md`.
+3. Customize the starter `AGENTS.md` with repository-specific instructions, then pass `--agent agents/coding/developer.book --context AGENTS.md`.
 4. Run one prompt at a time interactively, or use `--no-wait` for unattended batches.
 5. Finish with `ptbk coder verify` so resolved prompts are archived and broken ones get explicit repair follow-ups.
 

package/agents/default/developer.book

@@ -0,0 +1,23 @@
+Promptbook Developer
+
+RULE
+Keep in mind the DRY _(don't repeat yourself)_ principle.
+
+RULE
+Keep in mind the SOLID principles.
+
+RULE
+Do a proper analysis of the current functionality before you start implementing.
+
+RULE
+Keep small responsibilities of functions and classes, avoid creating big functions or classes that do many things.
+
+RULE
+Constants should always be `UPPER_SNAKE_CASE`.
+
+RULE
+Boolean variables should always be prefixed with `is`, for example `isUserChatJobLeaseExpired` or `IS_DEBUG_MODE`.
+
+RULE
+Do not use abbreviations, for example use `isExpired` instead of `isExp`, `translateMessage` instead of `t`, etc.
+It is fine to use well-known abbreviations, for example `id`, `url`, `html`, etc.

package/apps/agents-server/src/app/agents/[agentName]/api/user-chats/[chatId]/messages/route.ts

@@ -12,7 +12,6 @@ import {
     getUserChatJobByClientMessageId,
     isFrozenUserChatSource,
     resolveUserChatReplyReference,
-    runImmediateUserChatAnswer,
     triggerUserChatJobWorker,
 } from '@/src/utils/userChat';
 import { UserChatReplyValidationError } from '@/src/utils/userChat/UserChatReplyValidationError';
@@ -171,16 +170,10 @@ export async function POST(
 
         after(() => {
             const origin = new URL(request.url).origin;
-            return Promise.all([
-                triggerUserChatJobWorker({
-                    origin,
-                    preferredJobId: enqueuedTurn.job.id,
-                }).catch((error) => console.error('[user-chat] Failed to trigger durable worker', error)),
-                runImmediateUserChatAnswer(enqueuedTurn.job, {
-                    agentSource: resolvedAgentContext.resolvedAgentSource,
-                    resolvedAgentName: resolvedAgentContext.resolvedAgentName,
-                }).catch((error) => console.error('[user-chat] Failed to start immediate chat answer', error)),
-            ]).then(() => undefined);
+            return triggerUserChatJobWorker({
+                origin,
+                preferredJobId: enqueuedTurn.job.id,
+            }).catch((error) => console.error('[user-chat] Failed to trigger durable worker', error));
         });
 
         return NextResponse.json(

package/apps/agents-server/src/app/api/scrape/route.ts

@@ -2,6 +2,8 @@ import { serializeError } from '@promptbook-local/utils';
 import { NextRequest, NextResponse } from 'next/server';
 import { fetchUrlContent } from '../../../../../../src/commitments/USE_BROWSER/fetchUrlContent';
 import { assertsError } from '../../../../../../src/errors/assertsError';
+import { getCurrentUser } from '../../../utils/getCurrentUser';
+import { assertSafeUrl } from '../../../utils/assertSafeUrl';
 
 /**
  * API endpoint for scraping URL content
@@ -9,9 +11,17 @@ import { assertsError } from '../../../../../../src/errors/assertsError';
  * This endpoint proxies the server-side scraping functionality to be accessible from the browser.
  * It uses the fetchUrlContent utility to fetch and convert web content to markdown.
  *
+ * Requires authentication to prevent unauthenticated SSRF abuse.
+ * The destination URL is validated against private/internal IP ranges before fetching.
+ *
  * @route GET /api/scrape?url=<url>
  */
 export async function GET(request: NextRequest) {
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
     try {
         // Get the URL parameter from the query string
         const searchParams = request.nextUrl.searchParams;
@@ -22,6 +32,14 @@ export async function GET(request: NextRequest) {
             return NextResponse.json({ error: 'URL parameter is required' }, { status: 400 });
         }
 
+        // Guard against SSRF: reject private/internal IPs and non-HTTP(S) schemes
+        try {
+            assertSafeUrl(url);
+        } catch (error) {
+            assertsError(error);
+            return NextResponse.json({ error: error.message, success: false }, { status: 400 });
+        }
+
         // Use the server-side fetchUrlContent utility
         const content = await fetchUrlContent(url);
 

package/apps/agents-server/src/tools/createAgentProgressTools.ts

@@ -22,11 +22,13 @@ export function createAgentProgressTools(
         {
             name: AGENT_PROGRESS_TOOL_NAME,
             description: spaceTrim(`
-                Update to user while you work on a response.
+                Publish real-time progress to the user while you work on a response.
 
-                - Use this to communicate only concise progress updates visible to the user.
-                - Include what you are doing now, and what you will do next.
-                - Be informative and make update before any chunk of work that might take more than a few seconds.
+                - Use this for concrete progress, not placeholder reassurance.
+                - Call it before any chunk of work that may take more than a few seconds.
+                - Update it when you start a step, call or finish a tool, learn a result, or decide the next step.
+                - Include what you are doing now, visible actions/results, and what you will do next.
+                - Keep updates concise and user-facing; do not expose hidden chain-of-thought.
             `),
             parameters: {
                 type: 'object',

package/apps/agents-server/src/utils/assertSafeUrl.ts

@@ -0,0 +1,136 @@
+import { isIPv4, isIPv6 } from 'net';
+import { spaceTrim } from 'spacetrim';
+
+/**
+ * Private IPv4 CIDR ranges that must never be reached via the scrape proxy.
+ * Covers loopback, RFC 1918 private ranges, link-local (APIPA / cloud metadata),
+ * and the shared address space (RFC 6598).
+ */
+const PRIVATE_IPV4_RANGES: ReadonlyArray<{ readonly network: string; readonly prefixBits: number }> = [
+    { network: '127.0.0.0', prefixBits: 8 }, // loopback
+    { network: '10.0.0.0', prefixBits: 8 }, // RFC 1918
+    { network: '172.16.0.0', prefixBits: 12 }, // RFC 1918
+    { network: '192.168.0.0', prefixBits: 16 }, // RFC 1918
+    { network: '169.254.0.0', prefixBits: 16 }, // link-local / AWS metadata (169.254.169.254)
+    { network: '0.0.0.0', prefixBits: 8 }, // "this" network
+    { network: '100.64.0.0', prefixBits: 10 }, // shared address space (RFC 6598)
+];
+
+/**
+ * Converts an IPv4 address string to an unsigned 32-bit integer.
+ */
+function ipv4ToUint32(ip: string): number {
+    return ip.split('.').reduce((accumulator, octet) => (accumulator << 8) + parseInt(octet, 10), 0) >>> 0;
+}
+
+/**
+ * Returns true when the given IPv4 address falls within any private/reserved range.
+ */
+function isPrivateIPv4(ip: string): boolean {
+    const ipAsNumber = ipv4ToUint32(ip);
+    for (const { network, prefixBits } of PRIVATE_IPV4_RANGES) {
+        const networkMask = prefixBits === 0 ? 0 : (~((1 << (32 - prefixBits)) - 1)) >>> 0;
+        if ((ipAsNumber & networkMask) === (ipv4ToUint32(network) & networkMask)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+/**
+ * Returns true when the given IPv6 address falls within any private/reserved range.
+ * Covers loopback (::1), unspecified (::), IPv4-mapped addresses (::ffff:A.B.C.D),
+ * ULA (fc00::/7), and link-local (fe80::/10).
+ */
+function isPrivateIPv6(ip: string): boolean {
+    const normalized = ip.toLowerCase();
+
+    if (normalized === '::1' || normalized === '::') {
+        return true;
+    }
+
+    // IPv4-mapped: ::ffff:A.B.C.D — delegate to the IPv4 check
+    if (normalized.startsWith('::ffff:')) {
+        const ipv4Part = normalized.slice('::ffff:'.length);
+        if (isIPv4(ipv4Part)) {
+            return isPrivateIPv4(ipv4Part);
+        }
+    }
+
+    const firstGroup = parseInt((normalized.split(':')[0] ?? '0') || '0', 16);
+
+    // ULA: fc00::/7 — first 7 bits are 1111110
+    if ((firstGroup & 0xfe00) === 0xfc00) {
+        return true;
+    }
+
+    // Link-local: fe80::/10 — first 10 bits are 1111111010
+    if ((firstGroup & 0xffc0) === 0xfe80) {
+        return true;
+    }
+
+    return false;
+}
+
+/**
+ * Asserts that a URL is safe to use as a scrape target, blocking SSRF attacks.
+ *
+ * Throws an error when:
+ * - The URL scheme is not `http:` or `https:`
+ * - The hostname is `localhost`
+ * - The hostname is a private/reserved IPv4 address (RFC 1918, loopback, link-local, …)
+ * - The hostname is a private/reserved IPv6 address (ULA, link-local, loopback, …)
+ *
+ * @throws {Error} when the URL would allow reaching an internal/private resource
+ */
+export function assertSafeUrl(url: string): void {
+    let parsedUrl: URL;
+    try {
+        parsedUrl = new URL(url);
+    } catch {
+        throw new Error(`Invalid URL: \`${url}\``);
+    }
+
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+        throw new Error(spaceTrim(`
+            URL scheme \`${parsedUrl.protocol}\` is not allowed.
+
+            Only \`http:\` and \`https:\` schemes are permitted.
+        `));
+    }
+
+    const hostname = parsedUrl.hostname.toLowerCase();
+
+    if (hostname === 'localhost') {
+        throw new Error(
+            spaceTrim(`
+                Requests to \`localhost\` are not allowed.
+
+                Only public, externally reachable URLs may be scraped.
+            `),
+        );
+    }
+
+    if (isIPv4(hostname) && isPrivateIPv4(hostname)) {
+        throw new Error(
+            spaceTrim(`
+                Requests to private IPv4 address \`${hostname}\` are not allowed.
+
+                Only public, externally reachable URLs may be scraped.
+            `),
+        );
+    }
+
+    // IPv6 addresses appear inside square brackets in URLs: http://[::1]/path
+    const ipv6Candidate = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+
+    if (isIPv6(ipv6Candidate) && isPrivateIPv6(ipv6Candidate)) {
+        throw new Error(
+            spaceTrim(`
+                Requests to private IPv6 address \`${ipv6Candidate}\` are not allowed.
+
+                Only public, externally reachable URLs may be scraped.
+            `),
+        );
+    }
+}

package/apps/agents-server/src/utils/authenticateUser.ts

@@ -2,6 +2,7 @@ import { $getTableName } from '../database/$getTableName';
 import { $provideSupabaseForServer } from '../database/$provideSupabaseForServer';
 import { AgentsServerDatabase } from '../database/schema';
 import { verifyPassword } from './auth';
+import { isAdminPasswordEqual } from './isAdminPasswordEqual';
 
 /**
  * Type describing authenticated user.
@@ -17,7 +18,7 @@ export type AuthenticatedUser = {
  */
 export async function authenticateUser(username: string, password: string): Promise<AuthenticatedUser | null> {
     // 1. Check if it's the environment admin
-    if (username === 'admin' && process.env.ADMIN_PASSWORD && password === process.env.ADMIN_PASSWORD) {
+    if (username === 'admin' && isAdminPasswordEqual(password)) {
         return { username: 'admin', isAdmin: true, isGlobalAdmin: true };
     }
 

package/apps/agents-server/src/utils/getCurrentUser.ts

@@ -3,6 +3,7 @@ import { cache } from 'react';
 import { $getTableName } from '../database/$getTableName';
 import { $provideSupabaseForServer } from '../database/$provideSupabaseForServer';
 import type { AgentsServerDatabase } from '../database/schema';
+import { isAdminPasswordEqual } from './isAdminPasswordEqual';
 import { getSession } from './session';
 
 /**
@@ -75,7 +76,7 @@ const getCachedCurrentUser = cache(async (): Promise<UserInfo | null> => {
     if (process.env.ADMIN_PASSWORD) {
         const cookieStore = await cookies();
         const adminToken = cookieStore.get('adminToken');
-        if (adminToken?.value === process.env.ADMIN_PASSWORD) {
+        if (adminToken?.value !== undefined && isAdminPasswordEqual(adminToken.value)) {
             return {
                 username: 'admin',
                 isAdmin: true,

package/apps/agents-server/src/utils/isAdminPasswordEqual.ts

@@ -0,0 +1,28 @@
+import { timingSafeEqual } from 'crypto';
+
+/**
+ * Compares a candidate string against the `ADMIN_PASSWORD` environment variable
+ * using a constant-time algorithm to prevent timing attacks.
+ *
+ * Returning `false` early when the byte lengths differ does not expose character
+ * content — only length — which is an acceptable trade-off, since `timingSafeEqual`
+ * requires equal-length buffers and length is typically not secret.
+ *
+ * @param candidate The value to compare against the configured admin password.
+ * @returns `true` when `candidate` matches `ADMIN_PASSWORD`, `false` otherwise.
+ */
+export function isAdminPasswordEqual(candidate: string): boolean {
+    const adminPassword = process.env.ADMIN_PASSWORD;
+    if (!adminPassword) {
+        return false;
+    }
+
+    const candidateBuffer = Buffer.from(candidate);
+    const adminPasswordBuffer = Buffer.from(adminPassword);
+
+    if (candidateBuffer.length !== adminPasswordBuffer.length) {
+        return false;
+    }
+
+    return timingSafeEqual(candidateBuffer, adminPasswordBuffer);
+}

package/apps/agents-server/src/utils/isUserGlobalAdmin.ts

@@ -1,5 +1,6 @@
 import { cookies } from 'next/headers';
 import { cache } from 'react';
+import { isAdminPasswordEqual } from './isAdminPasswordEqual';
 import { getSession } from './session';
 
 /**
@@ -18,7 +19,8 @@ const getCachedIsUserGlobalAdmin = cache(async (): Promise<boolean> => {
     }
 
     const cookieStore = await cookies();
-    return cookieStore.get('adminToken')?.value === process.env.ADMIN_PASSWORD;
+    const adminToken = cookieStore.get('adminToken')?.value;
+    return adminToken !== undefined && isAdminPasswordEqual(adminToken);
 });
 
 /**

package/apps/agents-server/src/utils/userChat/createRunUserChatJobPersistenceController.ts

@@ -4,6 +4,7 @@ import type { ChatPromptResult } from '../../../../../src/execution/PromptResult
 import { mergeToolCalls } from '../../../../../src/utils/toolCalls/mergeToolCalls';
 import { persistUserChatJobTerminalState } from './persistUserChatJobTerminalState';
 import { updateUserChatAssistantMessage } from './updateUserChatAssistantMessage';
+import { createRunningUserChatProgressCard } from './userChatProgressCard';
 import { USER_CHAT_JOB_ASSISTANT_MESSAGE_PERSIST_INTERVAL_MS } from './userChatJobRuntimeConstants';
 import type { UserChatJobRecord } from './UserChatJobRecord';
 
@@ -44,6 +45,14 @@ export function createRunUserChatJobPersistenceController(options: {
     let hasPendingAssistantMessageUpdate = false;
     let assistantMessageUpdateTimeout: ReturnType<typeof setTimeout> | null = null;
 
+    /**
+     * Creates a typed ISO timestamp for progress-card updates.
+     *
+     * @private function of `createRunUserChatJobPersistenceController`
+     */
+    const createProgressUpdatedAt = (): NonNullable<ChatMessage['progressCard']>['updatedAt'] =>
+        new Date().toISOString() as NonNullable<ChatMessage['progressCard']>['updatedAt'];
+
     /**
      * Queues one assistant-message mutation behind any earlier persistence work.
      *
@@ -132,6 +141,12 @@ export function createRunUserChatJobPersistenceController(options: {
                 lifecycleState: 'running',
                 lifecycleError: undefined,
                 isComplete: false,
+                progressCard: createRunningUserChatProgressCard({
+                    currentProgressCard: message.progressCard,
+                    content: latestContent,
+                    toolCalls: latestToolCalls,
+                    updatedAt: createProgressUpdatedAt(),
+                }),
                 prompt: options.createPromptSnapshot({
                     toolCalls: latestToolCalls,
                 }),
@@ -186,6 +201,12 @@ export function createRunUserChatJobPersistenceController(options: {
                     lifecycleState: 'running',
                     lifecycleError: undefined,
                     isComplete: false,
+                    progressCard: createRunningUserChatProgressCard({
+                        currentProgressCard: message.progressCard,
+                        content: latestContent,
+                        toolCalls: latestToolCalls,
+                        updatedAt: createProgressUpdatedAt(),
+                    }),
                     availableTools: options.availableTools,
                     prompt: options.createPromptSnapshot(),
                 }),

package/apps/agents-server/src/utils/userChat/retryUserChatJob.ts

@@ -1,11 +1,13 @@
 import type { UserChatJobRecord } from './UserChatJobRecord';
 import type { UserChatJobRow } from './UserChatJobRow';
 import type { Json } from '@/src/database/schema';
+import type { ChatMessage } from '@promptbook-local/types';
 import { withoutLocalUserChatJobMetadata } from '../localChatRunner/LocalUserChatJobMetadata';
 import { getUserChatJobById } from './getUserChatJobById';
 import { mapUserChatJobRow } from './mapUserChatJobRow';
 import { provideUserChatJobTable } from './provideUserChatJobTable';
 import { updateUserChatAssistantMessage } from './updateUserChatAssistantMessage';
+import { createQueuedUserChatProgressCard } from './userChatProgressCard';
 
 /**
  * Requeues one failed durable chat job and resets its assistant placeholder.
@@ -23,6 +25,7 @@ export async function retryUserChatJob(jobId: string): Promise<UserChatJobRecord
     }
 
     const nowIso = new Date().toISOString();
+    const progressUpdatedAt = nowIso as NonNullable<ChatMessage['progressCard']>['updatedAt'];
     const userChatJobTable = await provideUserChatJobTable();
     const { data, error } = await userChatJobTable
         .update({
@@ -67,6 +70,7 @@ export async function retryUserChatJob(jobId: string): Promise<UserChatJobRecord
             completedToolCalls: undefined,
             prompt: undefined,
             generationDurationMs: undefined,
+            progressCard: createQueuedUserChatProgressCard(progressUpdatedAt),
         }),
     });
 

package/apps/agents-server/src/utils/userChat/userChatMessageLifecycle.ts

@@ -1,4 +1,5 @@
 import type { ChatMessage } from '../../../../../src/_packages/types.index';
+import { createQueuedUserChatProgressCard } from './userChatProgressCard';
 
 /**
  * Lifecycle states rendered on canonical server-owned chat messages.
@@ -45,6 +46,7 @@ export function createQueuedUserChatAssistantMessage(options: {
         isComplete: false,
         lifecycleState: 'queued',
         jobId: options.jobId,
+        progressCard: createQueuedUserChatProgressCard(options.createdAt),
     };
 }