@promptbook/cli 0.112.0-131 → 0.112.0-133

package/apps/agents-server/src/app/dashboard/page.tsx

@@ -4,7 +4,6 @@
 export const dynamic = 'force-dynamic';
 
 import { getSingleLlmExecutionTools } from '@promptbook-local/core';
-import moment from 'moment';
 import { headers } from 'next/headers';
 import { AboutPromptbookInformation } from '../../../../../src/utils/misc/xAboutPromptbookInformation';
 import { HomepagePrimarySections } from '../../components/Homepage/HomepagePrimarySections';
@@ -17,21 +16,10 @@ import { getLongRunningTask } from '../../deamons/longRunningTask';
 import { $provideExecutionToolsForServer } from '../../tools/$provideExecutionToolsForServer';
 import { $provideServer } from '../../tools/$provideServer';
 import { isUserAdmin } from '../../utils/isUserAdmin';
+import { formatServerLanguageHumanReadableDate } from '../../utils/localization/formatServerLanguageHumanReadableDate';
+import { getRequestServerLanguage } from '../../utils/localization/getRequestServerLanguage';
 import { getHomePageAgents } from '../_data/getHomePageAgents';
 
-// Add calendar formats that include seconds
-/**
- * Map of calendar with seconds.
- */
-const calendarWithSeconds = {
-    sameDay: '[Today at] LTS',
-    nextDay: '[Tomorrow at] LTS',
-    nextWeek: 'dddd [at] LTS',
-    lastDay: '[Yesterday at] LTS',
-    lastWeek: '[Last] dddd [at] LTS',
-    sameElse: 'L [at] LTS',
-};
-
 /**
  * Renders the legacy dashboard with system and admin details.
  */
@@ -40,6 +28,7 @@ export default async function DashboardPage() {
     const { publicUrl } = server;
     const isAdmin = await isUserAdmin(); /* <- TODO: [??] Here should be user permissions */
     const { agents, folders, homepageMessage, currentUser } = await getHomePageAgents();
+    const language = await getRequestServerLanguage();
 
     const longRunningTask = getLongRunningTask();
 
@@ -92,10 +81,16 @@ export default async function DashboardPage() {
                         <TechInfoCard title={`Long running task ${longRunningTask.taskId}`}>
                             <p className="text-gray-600">Tick: {longRunningTask.tick}</p>
                             <p className="text-gray-600">
-                                Created At: {moment(longRunningTask.createdAt).calendar(undefined, calendarWithSeconds)}
+                                Created At:{' '}
+                                {formatServerLanguageHumanReadableDate(longRunningTask.createdAt, language, {
+                                    isExactDateIncluded: true,
+                                })}
                             </p>
                             <p className="text-gray-600">
-                                Updated At: {moment(longRunningTask.updatedAt).calendar(undefined, calendarWithSeconds)}
+                                Updated At:{' '}
+                                {formatServerLanguageHumanReadableDate(longRunningTask.updatedAt, language, {
+                                    isExactDateIncluded: true,
+                                })}
                             </p>
                         </TechInfoCard>
 

package/apps/agents-server/src/app/layout.tsx

@@ -3,7 +3,8 @@ import { LayoutWrapper } from '@/src/components/LayoutWrapper/LayoutWrapper';
 import { createThemeModeBootstrapScript } from '@/src/components/ThemeMode/createThemeModeBootstrapScript';
 import { APPLICATION_FONT_VARIABLE_CLASS_NAME } from '@/src/utils/applicationFonts';
 import type { Metadata } from 'next';
-import { cookies } from 'next/headers';
+import { cookies, headers } from 'next/headers';
+import { CONTENT_SECURITY_POLICY_NONCE_REQUEST_HEADER } from '../middleware/contentSecurityPolicy';
 import { getCustomJavascriptWithIntegrations } from '../database/customJavascript';
 import { getAggregatedCustomStylesheetCss } from '../database/customStylesheet';
 import { getMetadataMap } from '../database/getMetadata';
@@ -293,6 +294,7 @@ export default async function RootLayout({
         getCustomJavascriptWithIntegrations,
     );
     const cookieStorePromise = cookies();
+    const requestHeadersPromise = headers();
     const defaultThemeModePromise = Promise.all([currentUserPromise, cookieStorePromise, layoutMetadataPromise]).then(
         async ([currentUser, cookieStore, layoutMetadata]) => {
             const cookieThemeMode = cookieStore.get(THEME_MODE_COOKIE_NAME)?.value || null;
@@ -346,6 +348,7 @@ export default async function RootLayout({
         customStylesheetCss,
         customJavascript,
         cookieStore,
+        requestHeaders,
         defaultThemeMode,
         federatedServers,
         footerLinks,
@@ -363,6 +366,7 @@ export default async function RootLayout({
         customStylesheetCssPromise,
         customJavascriptPromise,
         cookieStorePromise,
+        requestHeadersPromise,
         defaultThemeModePromise,
         federatedServersPromise,
         footerLinksPromise,
@@ -379,7 +383,10 @@ export default async function RootLayout({
     const feedbackMode = parseChatFeedbackMode(layoutMetadata.CHAT_FEEDBACK_MODE, layoutMetadata.IS_FEEDBACK_ENABLED);
     const isExperimentalPwaAppEnabled = (layoutMetadata.IS_EXPERIMENTAL_PWA_APP_ENABLED ?? 'true') === 'true';
     const isPublicServer = isPublicServerVisibility(serverVisibility);
-    const safeCustomJavascript = customJavascript.replace(/<\/script>/gi, '<\\/script>');
+    // Note: The custom JavaScript is executed only when the browser sees the matching
+    //       `script-src 'nonce-...'` directive that the middleware sets per request, so a
+    //       fragile string-level sanitization is intentionally not applied here.
+    const contentSecurityPolicyNonce = requestHeaders.get(CONTENT_SECURITY_POLICY_NONCE_REQUEST_HEADER) ?? undefined;
     const webPushPublicKey = process.env.NEXT_PUBLIC_WEB_PUSH_PUBLIC_KEY?.trim() || null;
     const chatVisualModeCookie = cookieStore.get(CHAT_VISUAL_MODE_COOKIE_NAME)?.value || null;
     const cookieLanguage = cookieStore.get(SERVER_LANGUAGE_COOKIE_NAME)?.value || null;
@@ -412,6 +419,7 @@ export default async function RootLayout({
             <body className={`${APPLICATION_FONT_VARIABLE_CLASS_NAME} bg-background text-foreground antialiased`}>
                 <script
                     id="agents-server-theme-mode"
+                    nonce={contentSecurityPolicyNonce}
                     dangerouslySetInnerHTML={{ __html: themeModeBootstrapScript }}
                 />
                 {customStylesheetCss && <style id="agents-server-custom-css">{customStylesheetCss}</style>}
@@ -448,7 +456,8 @@ export default async function RootLayout({
                 {customJavascript && (
                     <script
                         id="agents-server-custom-js"
-                        dangerouslySetInnerHTML={{ __html: safeCustomJavascript }}
+                        nonce={contentSecurityPolicyNonce}
+                        dangerouslySetInnerHTML={{ __html: customJavascript }}
                     />
                 )}
                 {/* Global portal root for modals/popups */}

package/apps/agents-server/src/app/swagger/SwaggerApiKeysPanel.tsx

@@ -3,9 +3,11 @@
 import Link from 'next/link';
 import { Plus } from 'lucide-react';
 import { useEffect, useState } from 'react';
+import { useServerLanguage } from '@/src/components/ServerLanguage/ServerLanguageProvider';
 import { SecretInput } from '@/src/components/SecretInput/SecretInput';
 import type { ApiTokenEntry } from '@/src/utils/apiTokensClient';
 import { createApiToken, fetchApiTokens } from '@/src/utils/apiTokensClient';
+import { formatServerLanguageHumanReadableDate } from '@/src/utils/localization/formatServerLanguageHumanReadableDate';
 
 /**
  * Props for the compact Swagger API-key panel.
@@ -21,6 +23,7 @@ type SwaggerApiKeysPanelProps = {
  * Compact API-key panel shown above Swagger UI.
  */
 export function SwaggerApiKeysPanel({ isAdmin }: SwaggerApiKeysPanelProps) {
+    const { language } = useServerLanguage();
     const [tokens, setTokens] = useState<ApiTokenEntry[]>([]);
     const [isLoading, setIsLoading] = useState(isAdmin);
     const [isCreating, setIsCreating] = useState(false);
@@ -110,7 +113,7 @@ export function SwaggerApiKeysPanel({ isAdmin }: SwaggerApiKeysPanelProps) {
                                                 {token.note || `API key #${token.id}`}
                                             </span>
                                             <span className="text-xs text-slate-400">
-                                                {new Date(token.createdAt).toLocaleString()}
+                                                {formatServerLanguageHumanReadableDate(token.createdAt, language)}
                                             </span>
                                         </div>
                                         <SecretInput value={token.token} readOnly aria-label={`API key ${token.id}`} />

package/apps/agents-server/src/app/system/user-memory/UserMemoryClient.tsx

@@ -1,6 +1,8 @@
 'use client';
 
 import { showConfirm } from '@/src/components/AsyncDialogs/asyncDialogs';
+import { useServerLanguage } from '@/src/components/ServerLanguage/ServerLanguageProvider';
+import { formatServerLanguageHumanReadableDate } from '@/src/utils/localization/formatServerLanguageHumanReadableDate';
 import { useEffect, useMemo, useState } from 'react';
 
 /**
@@ -42,6 +44,7 @@ type UserMemoryClientProps = {
  */
 export function UserMemoryClient(props: UserMemoryClientProps) {
     const { agents } = props;
+    const { language } = useServerLanguage();
     const [memories, setMemories] = useState<UserMemoryEntry[]>([]);
     const [loading, setLoading] = useState<boolean>(true);
     const [saving, setSaving] = useState<boolean>(false);
@@ -445,7 +448,7 @@ export function UserMemoryClient(props: UserMemoryClientProps) {
                                             )}
                                         </td>
                                         <td className="px-4 py-3 text-xs text-gray-500">
-                                            {new Date(memory.updatedAt).toLocaleString()}
+                                            {formatServerLanguageHumanReadableDate(memory.updatedAt, language)}
                                         </td>
                                         <td className="px-4 py-3 text-right text-sm">
                                             {isEditing ? (
@@ -491,4 +494,3 @@ export function UserMemoryClient(props: UserMemoryClientProps) {
         </div>
     );
 }
-

package/apps/agents-server/src/app/system/user-wallet/UserWalletClient.tsx

@@ -1,6 +1,7 @@
 'use client';
 
 import { WalletRecordDialog } from '@/src/components/WalletRecordDialog/WalletRecordDialog';
+import { useServerLanguage } from '@/src/components/ServerLanguage/ServerLanguageProvider';
 import type { GithubAppStatusResponse } from '@/src/utils/githubAppClient';
 import { UserWalletCreateCard } from './UserWalletCreateCard';
 import type { UserWalletAgentOption } from './UserWalletAgentOption';
@@ -34,6 +35,7 @@ function resolveGithubAppStatusDescription(status: GithubAppStatusResponse | nul
  */
 export function UserWalletClient(props: UserWalletClientProps) {
     const { agents } = props;
+    const { language } = useServerLanguage();
     const state = useUserWalletClientState({ agents });
 
     return (
@@ -118,6 +120,7 @@ export function UserWalletClient(props: UserWalletClientProps) {
 
             <UserWalletRecordsTable
                 agents={agents}
+                language={language}
                 editingDraft={state.editingDraft}
                 isEditingSmtpRecord={state.isEditingSmtpRecord}
                 isLoading={state.loading}

package/apps/agents-server/src/app/system/user-wallet/UserWalletRecordsTable.tsx

@@ -1,6 +1,8 @@
 'use client';
 
 import type { UserWalletRecord } from '@/src/utils/userWallet';
+import type { ServerLanguageCode } from '@/src/languages/ServerLanguageRegistry';
+import { formatServerLanguageHumanReadableDate } from '@/src/utils/localization/formatServerLanguageHumanReadableDate';
 import type { UserWalletAgentOption } from './UserWalletAgentOption';
 import { formatWalletJsonSchemaForTextarea, type EditingUserWalletDraft, type UpdateUserWalletDraft } from './UserWalletDraft';
 import { UserWalletRecordFormFields } from './UserWalletRecordFormFields';
@@ -11,6 +13,7 @@ import { UserWalletRecordValue } from './UserWalletRecordValue';
  */
 type UserWalletRecordsTableProps = {
     agents: ReadonlyArray<UserWalletAgentOption>;
+    language: ServerLanguageCode;
     editingDraft: EditingUserWalletDraft | null;
     isEditingSmtpRecord: boolean;
     isLoading: boolean;
@@ -31,6 +34,7 @@ type UserWalletRecordsTableProps = {
  */
 export function UserWalletRecordsTable({
     agents,
+    language,
     editingDraft,
     isEditingSmtpRecord,
     isLoading,
@@ -118,7 +122,7 @@ export function UserWalletRecordsTable({
                                         )}
                                     </td>
                                     <td className="px-4 py-3 text-xs text-gray-500">
-                                        {new Date(record.updatedAt).toLocaleString()}
+                                        {formatServerLanguageHumanReadableDate(record.updatedAt, language)}
                                     </td>
                                     <td className="px-4 py-3 text-right text-sm">
                                         {isEditing ? (

package/apps/agents-server/src/app/system/utilities/mocked-chats/MockedChatsEditorClient.tsx

@@ -1,6 +1,7 @@
 'use client';
 
 import { useEffect, useMemo, useState } from 'react';
+import { useServerLanguage } from '@/src/components/ServerLanguage/ServerLanguageProvider';
 import type { MockedChatPreset } from '@/src/utils/mockedChatsSchema';
 import { MockedChatsEditorForm } from './MockedChatsEditorForm';
 import { MockedChatsEditorSidebar } from './MockedChatsEditorSidebar';
@@ -17,6 +18,7 @@ type MockedChatsEditorClientProps = {
  * Mocked chat editor under `System -> Utilities`.
  */
 export function MockedChatsEditorClient({ initialMockedChats }: MockedChatsEditorClientProps) {
+    const { language } = useServerLanguage();
     const mockedChatsEditorState = useMockedChatsEditorState({ initialMockedChats });
     const viewerHref = useMemo(
         () => buildMockedChatViewerHref(mockedChatsEditorState.draftChat.id),
@@ -47,6 +49,7 @@ export function MockedChatsEditorClient({ initialMockedChats }: MockedChatsEdito
 
                 <div className="grid gap-6 lg:grid-cols-[340px_minmax(0,1fr)]">
                     <MockedChatsEditorSidebar
+                        language={language}
                         savedChats={mockedChatsEditorState.savedChats}
                         selectedChatId={mockedChatsEditorState.selectedChatId}
                         createNewDraft={mockedChatsEditorState.createNewDraft}

package/apps/agents-server/src/app/system/utilities/mocked-chats/MockedChatsEditorSidebar.tsx

@@ -1,4 +1,6 @@
 import Link from 'next/link';
+import type { ServerLanguageCode } from '@/src/languages/ServerLanguageRegistry';
+import { formatServerLanguageHumanReadableDate } from '@/src/utils/localization/formatServerLanguageHumanReadableDate';
 import type { UseMockedChatsEditorState } from './useMockedChatsEditorState';
 
 /**
@@ -8,6 +10,7 @@ type MockedChatsEditorSidebarProps = Pick<
     UseMockedChatsEditorState,
     'savedChats' | 'selectedChatId' | 'createNewDraft' | 'selectSavedChat'
 > & {
+    language: ServerLanguageCode;
     buildViewerHref: (mockedChatId: string) => string;
 };
 
@@ -16,13 +19,8 @@ type MockedChatsEditorSidebarProps = Pick<
  *
  * @private function of <MockedChatsEditorClient/>
  */
-function formatMockedChatUpdatedAt(updatedAt: string): string {
-    const date = new Date(updatedAt);
-    if (Number.isNaN(date.getTime())) {
-        return 'just now';
-    }
-
-    return date.toLocaleString();
+function formatMockedChatUpdatedAt(updatedAt: string, language: ServerLanguageCode): string {
+    return formatServerLanguageHumanReadableDate(updatedAt, language, { fallbackLabel: 'just now' });
 }
 
 /**
@@ -31,6 +29,7 @@ function formatMockedChatUpdatedAt(updatedAt: string): string {
  * @private function of <MockedChatsEditorClient/>
  */
 export function MockedChatsEditorSidebar({
+    language,
     savedChats,
     selectedChatId,
     createNewDraft,
@@ -74,7 +73,7 @@ export function MockedChatsEditorSidebar({
                                         <div className="min-w-0">
                                             <p className="truncate text-sm font-semibold text-slate-900">{chat.name}</p>
                                             <p className="mt-1 text-xs text-slate-500">
-                                                Updated {formatMockedChatUpdatedAt(chat.updatedAt)}
+                                                Updated {formatMockedChatUpdatedAt(chat.updatedAt, language)}
                                             </p>
                                         </div>
                                         <Link

package/apps/agents-server/src/components/Footer/Footer.tsx

@@ -1,9 +1,10 @@
 'use client';
 
-import { NEXT_PUBLIC_VERCEL_GIT_COMMIT_REF } from '@/config';
+import { NEXT_PUBLIC_VERCEL_GIT_COMMIT_REF, NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA } from '@/config';
 import { CLAIM, NAME, PROMPTBOOK_ENGINE_VERSION } from '@promptbook-local/core';
 import { useServerLanguage } from '../ServerLanguage/ServerLanguageProvider';
 import { HeadlessLink } from '../_utils/headlessParam';
+import { getCommitFooterEmoji } from './getCommitFooterEmoji';
 
 /**
  * Title/url pair used to extend the footer via metadata.
@@ -169,7 +170,7 @@ export function Footer(props: FooterProps) {
                         <br />
                         {t('footer.allRightsReserved')}
                         <br />
-                        {t('footer.madeInCzechRepublic')}
+                        {t('footer.madeInCzechRepublic', { emoji: getCommitFooterEmoji(NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA) })}
                         {/* <- TODO: !!!!!!!! Put here Prague outline */}
                     </p>
                     <p className="mt-2 text-xs text-gray-400">

package/apps/agents-server/src/components/Footer/getCommitFooterEmoji.ts

@@ -0,0 +1,112 @@
+/**
+ * Curated list of positive or neutral emojis displayed in the footer's "Made with {emoji} in Europe" line.
+ *
+ * The order of this list is part of the deterministic mapping from commit SHA to emoji, so existing
+ * entries should not be reordered. New emojis can be appended at the end without affecting the
+ * indexes of existing ones, but each commit SHA will then map to a different emoji.
+ *
+ * Hearts, cute animals, plants, fruits, sweets, and celebratory symbols are intentionally chosen so
+ * that the footer never shows anything aggressive, scary, or negative.
+ */
+const POSITIVE_FOOTER_EMOJIS = [
+    '❤️',
+    '🧡',
+    '💛',
+    '💚',
+    '💙',
+    '💜',
+    '🤍',
+    '💖',
+    '💝',
+    '🐙',
+    '🦄',
+    '🐶',
+    '🐱',
+    '🐰',
+    '🦊',
+    '🐻',
+    '🐼',
+    '🐨',
+    '🐯',
+    '🦁',
+    '🐸',
+    '🐵',
+    '🐧',
+    '🦉',
+    '🐢',
+    '🦋',
+    '🐝',
+    '🐞',
+    '🐳',
+    '🐬',
+    '🦒',
+    '🐘',
+    '🌸',
+    '🌻',
+    '🌷',
+    '🌹',
+    '🌈',
+    '🌟',
+    '✨',
+    '☀️',
+    '🌙',
+    '🍀',
+    '🌳',
+    '🍎',
+    '🍓',
+    '🍑',
+    '🍒',
+    '🍋',
+    '🍊',
+    '🍇',
+    '🍉',
+    '🍰',
+    '🍪',
+    '🍩',
+    '🍕',
+    '🍔',
+    '🍦',
+    '🍫',
+    '🎉',
+    '🎈',
+    '🎁',
+    '🎨',
+    '🚀',
+    '⭐',
+    '💎',
+    '🪐',
+    '🎵',
+] as const;
+
+/**
+ * Default emoji used in the footer when no commit SHA is available (for example during local
+ * development outside Vercel). Kept as the historic `❤️` so the footer text does not look
+ * unusual when the deployment metadata is missing.
+ */
+const DEFAULT_FOOTER_EMOJI: string = POSITIVE_FOOTER_EMOJIS[0]!;
+
+/**
+ * Derives a stable emoji from a commit SHA using a small djb2-style string hash.
+ *
+ * The same SHA always produces the same emoji, so users can spot a server update by noticing that
+ * the footer emoji changed. The result is taken modulo the curated list, so it is always one of
+ * the positive/neutral emojis in {@link POSITIVE_FOOTER_EMOJIS}.
+ *
+ * @param commitSha - Full or short commit SHA. May be `null` or `undefined` when running outside
+ *                    a Vercel deployment, in which case {@link DEFAULT_FOOTER_EMOJI} is returned.
+ * @returns One emoji from {@link POSITIVE_FOOTER_EMOJIS}.
+ * @private Internal to `apps/agents-server`
+ */
+export function getCommitFooterEmoji(commitSha: string | null | undefined): string {
+    if (!commitSha) {
+        return DEFAULT_FOOTER_EMOJI;
+    }
+
+    let hash = 0;
+    for (let characterIndex = 0; characterIndex < commitSha.length; characterIndex++) {
+        hash = (hash * 31 + commitSha.charCodeAt(characterIndex)) | 0;
+    }
+
+    const emojiIndex = Math.abs(hash) % POSITIVE_FOOTER_EMOJIS.length;
+    return POSITIVE_FOOTER_EMOJIS[emojiIndex]!;
+}

package/apps/agents-server/src/components/PrintHeader/PrintHeader.tsx

@@ -1,5 +1,7 @@
 import { formatAgentNamingText } from '../../utils/agentNaming';
 import { getAgentNaming } from '../../utils/getAgentNaming';
+import { formatServerLanguageHumanReadableDate } from '../../utils/localization/formatServerLanguageHumanReadableDate';
+import { getRequestServerLanguage } from '../../utils/localization/getRequestServerLanguage';
 
 /**
  * Renders a print-only header with server branding.
@@ -8,7 +10,7 @@ import { getAgentNaming } from '../../utils/getAgentNaming';
  * @returns Print header markup.
  */
 export async function PrintHeader({ title }: { title?: string }) {
-    const agentNaming = await getAgentNaming();
+    const [agentNaming, language] = await Promise.all([getAgentNaming(), getRequestServerLanguage()]);
     return (
         <div className="hidden print:block mb-6 border-b-2 border-blue-600 pb-2">
             <div className="flex justify-between items-end">
@@ -23,7 +25,7 @@ export async function PrintHeader({ title }: { title?: string }) {
                 {title && <h2 className="text-lg font-semibold text-gray-700">{title}</h2>}
             </div>
             <div className="text-xs text-gray-400 mt-1 text-right">
-                {new Date().toLocaleDateString()}
+                {formatServerLanguageHumanReadableDate(new Date(), language, { isExactDateIncluded: true })}
             </div>
         </div>
     );

package/apps/agents-server/src/components/UsersList/UsersList.tsx

@@ -6,6 +6,7 @@ import { Card } from '../Homepage/Card';
 import { Section } from '../Homepage/Section';
 import { useServerLanguage } from '../ServerLanguage/ServerLanguageProvider';
 import { SecretInput } from '@/src/components/SecretInput/SecretInput';
+import { formatServerLanguageHumanReadableDate } from '@/src/utils/localization/formatServerLanguageHumanReadableDate';
 import { useUsersAdmin } from './useUsersAdmin';
 
 /**
@@ -26,7 +27,7 @@ type UsersListProps = {
  */
 export function UsersList({ allowCreate = true }: UsersListProps) {
     const { users, loading, error, createUser, deleteUser, toggleAdmin } = useUsersAdmin();
-    const { t } = useServerLanguage();
+    const { language, t } = useServerLanguage();
 
     const [newUsername, setNewUsername] = useState('');
     const [newPassword, setNewPassword] = useState('');
@@ -91,7 +92,8 @@ export function UsersList({ allowCreate = true }: UsersListProps) {
                                     </p>
                                 )}
                                 <p className="text-gray-500 text-sm mt-2">
-                                    {t('users.createdLabel')}: {new Date(user.createdAt).toLocaleDateString()}
+                                    {t('users.createdLabel')}:{' '}
+                                    {formatServerLanguageHumanReadableDate(user.createdAt, language)}
                                 </p>
                             </div>
                             <div className="space-x-2">

package/apps/agents-server/src/languages/translations/czech.yaml

@@ -380,7 +380,7 @@ footer.logosAndBranding: Loga a vizuální identita
 footer.connectSectionTitle: Spojte se s námi
 footer.linksSectionTitle: Odkazy
 footer.allRightsReserved: Všechna práva vyhrazena.
-footer.madeInCzechRepublic: Vytvořeno s ❤️ v České republice.
+footer.madeInCzechRepublic: Vytvořeno s {emoji} v České republice.
 footer.engineVersion: Verze jádra Promptbooku
 forbidden.title: 403 Zakázáno
 forbidden.message: Nemáte oprávnění k přístupu na tuto stránku.

package/apps/agents-server/src/languages/translations/english.yaml

@@ -384,7 +384,7 @@ footer.logosAndBranding: Logos & Branding
 footer.connectSectionTitle: Connect
 footer.linksSectionTitle: Links
 footer.allRightsReserved: All rights reserved.
-footer.madeInCzechRepublic: Made with ❤️ in Europe
+footer.madeInCzechRepublic: Made with {emoji} in Europe
 footer.engineVersion: Promptbook engine version
 forbidden.title: 403 Forbidden
 forbidden.message: You do not have permission to access this page.

package/apps/agents-server/src/middleware/applyEmbeddingHeader.ts

@@ -21,13 +21,15 @@ export function applyEmbeddingHeader(response: NextResponse, url: URL, isAllowed
         return;
     }
 
+    // Note: The base strict CSP (script-src with nonce) is preserved by appending a separate
+    //       Content-Security-Policy header that only carries the `frame-ancestors` directive.
     if (isAllowed) {
-        response.headers.set('Content-Security-Policy', 'frame-ancestors https: http:');
+        response.headers.append('Content-Security-Policy', 'frame-ancestors https: http:');
         response.headers.delete('X-Frame-Options');
         return;
     }
 
-    response.headers.set('Content-Security-Policy', "frame-ancestors 'none'");
+    response.headers.append('Content-Security-Policy', "frame-ancestors 'none'");
     response.headers.set('X-Frame-Options', 'DENY');
 }
 

package/apps/agents-server/src/middleware/contentSecurityPolicy.ts

@@ -0,0 +1,97 @@
+import type { NextResponse } from 'next/server';
+
+/**
+ * Name of the request header that carries the per-request CSP nonce to server components.
+ *
+ * Server components read it via `next/headers` and must pass it to every inline `<script>` tag so
+ * the browser executes only scripts explicitly rendered by the server.
+ *
+ * @private function of middleware
+ */
+export const CONTENT_SECURITY_POLICY_NONCE_REQUEST_HEADER = 'x-csp-nonce';
+
+/**
+ * Length (in bytes) of the random material used to derive each per-request CSP nonce.
+ *
+ * 16 bytes (128 bits) is the value recommended by the W3C CSP3 specification — large enough to
+ * make guessing infeasible while keeping the base64 representation short.
+ *
+ * @private function of middleware
+ */
+const CONTENT_SECURITY_POLICY_NONCE_BYTE_LENGTH = 16;
+
+/**
+ * Generates a fresh, single-use CSP nonce encoded as base64.
+ *
+ * @returns Cryptographically random nonce safe to inline into a CSP header.
+ *
+ * @private function of middleware
+ */
+export function generateContentSecurityPolicyNonce(): string {
+    const randomBytes = new Uint8Array(CONTENT_SECURITY_POLICY_NONCE_BYTE_LENGTH);
+    crypto.getRandomValues(randomBytes);
+
+    let binaryString = '';
+    for (const byte of randomBytes) {
+        binaryString += String.fromCharCode(byte);
+    }
+
+    // Note: `btoa` is available in the Next.js Edge runtime where this middleware executes.
+    return btoa(binaryString);
+}
+
+/**
+ * Builds the strict Content Security Policy header value for the given nonce.
+ *
+ * The policy locks down `script-src` to nonced inline scripts and scripts loaded by them
+ * (`'strict-dynamic'`). The legacy fallbacks (`'unsafe-inline'`, `http:`, `https:`) are ignored
+ * by modern browsers that honor the nonce, but keep the page functional in older browsers
+ * without weakening security in modern ones.
+ *
+ * @param nonce - Per-request CSP nonce.
+ * @returns Serialized CSP header value.
+ *
+ * @private function of middleware
+ */
+function buildContentSecurityPolicyHeaderValue(nonce: string): string {
+    const directives = [
+        `script-src 'nonce-${nonce}' 'strict-dynamic' 'unsafe-inline' 'unsafe-eval' https: http:`,
+        `object-src 'none'`,
+        `base-uri 'self'`,
+    ];
+
+    return directives.join('; ');
+}
+
+/**
+ * Adds the CSP nonce headers to the forwarded request so server components and the Next.js
+ * runtime can detect the nonce and apply it to their own inline scripts.
+ *
+ * @param requestHeaders - Mutable headers object that is forwarded to the route handler.
+ * @param nonce - Per-request CSP nonce.
+ *
+ * @private function of middleware
+ */
+export function applyContentSecurityPolicyToRequestHeaders(requestHeaders: Headers, nonce: string): void {
+    requestHeaders.set(CONTENT_SECURITY_POLICY_NONCE_REQUEST_HEADER, nonce);
+
+    // Note: Next.js detects the nonce automatically when the CSP is also present on the
+    //       forwarded request headers — see https://nextjs.org/docs/app/guides/content-security-policy
+    requestHeaders.set('Content-Security-Policy', buildContentSecurityPolicyHeaderValue(nonce));
+}
+
+/**
+ * Adds the strict CSP response header so the browser enforces the nonced script policy.
+ *
+ * Helpers that add narrower directives (e.g. `applyEmbeddingHeader` with `frame-ancestors`)
+ * must `append` a separate CSP header rather than `set` so the strict `script-src` policy is
+ * preserved.
+ *
+ * @param response - Outgoing response.
+ * @param nonce - Per-request CSP nonce.
+ *
+ * @private function of middleware
+ */
+export function applyContentSecurityPolicyHeader(response: NextResponse, nonce: string): void {
+    response.headers.set('Content-Security-Policy', buildContentSecurityPolicyHeaderValue(nonce));
+}