@promptbook/cli 0.112.0-133 → 0.112.0-135

package/apps/agents-server/src/utils/userChat/userChatProgressCard.ts

@@ -1,4 +1,5 @@
 import type { ChatMessage } from '@promptbook-local/types';
+import { spaceTrim } from '../../../../../src/_packages/utils.index';
 
 /**
  * User-facing phases shown while one durable chat answer is being prepared.
@@ -10,6 +11,70 @@ export type UserChatProgressPhase =
     | 'checking_capabilities'
     | 'starting_response';
 
+/**
+ * Real runtime details surfaced into the user-facing progress card text.
+ *
+ * Only signals that are already known at the corresponding phase are filled in,
+ * so the produced markdown reflects what the worker is actually doing right now
+ * instead of a generic scripted summary.
+ */
+export type UserChatProgressContext = {
+    /**
+     * Resolved human-readable agent name, when already loaded for this turn.
+     */
+    readonly agentName?: string;
+
+    /**
+     * Stable agent identifier shown when the human-readable name is not yet known.
+     */
+    readonly agentPermanentId?: string;
+
+    /**
+     * Resolved LLM provider title (e.g. `OpenAI`, `Anthropic`), when already known.
+     */
+    readonly provider?: string;
+
+    /**
+     * Number of attachments the user submitted with the current turn.
+     */
+    readonly attachmentCount?: number;
+
+    /**
+     * Number of agent-defined tools available to the model for this turn.
+     */
+    readonly toolCount?: number;
+
+    /**
+     * Concise user-facing tool labels (e.g. `web browser`, `calendar`) for the progress text.
+     */
+    readonly toolHighlights?: ReadonlyArray<string>;
+
+    /**
+     * Number of knowledge sources the agent will reference during the turn.
+     */
+    readonly knowledgeSourceCount?: number;
+
+    /**
+     * Whether the calendar integration is wired up for this turn.
+     */
+    readonly hasCalendarAccess?: boolean;
+
+    /**
+     * Whether the email-sending integration is wired up for this turn.
+     */
+    readonly hasEmailAccess?: boolean;
+
+    /**
+     * Whether one or more project repositories are linked to this turn.
+     */
+    readonly hasProjectAccess?: boolean;
+
+    /**
+     * Whether the AgentKit runtime for this agent came from the in-process cache.
+     */
+    readonly isAgentKitCached?: boolean;
+};
+
 /**
  * Default title used by durable chat progress cards.
  */
@@ -26,39 +91,25 @@ const USER_CHAT_PROGRESS_ITEM_IDS = {
 } as const;
 
 /**
- * Static progress copy for one durable chat phase.
+ * Static checklist mapping for one durable chat phase.
  */
-type UserChatProgressPhasePresentation = {
-    readonly now: string;
-    readonly next: string;
+type UserChatProgressPhaseChecklist = {
     readonly completedItemIds: ReadonlySet<string>;
 };
 
 /**
- * User-facing progress copy for durable chat phases.
+ * Static checklist progression shared across all durable chat phases.
  */
-const USER_CHAT_PROGRESS_PHASE_PRESENTATIONS: Record<UserChatProgressPhase, UserChatProgressPhasePresentation> = {
-    queued: {
-        now: 'Your message is queued and the agent will pick it up shortly.',
-        next: 'The agent will read the conversation and prepare the answer.',
-        completedItemIds: new Set([]),
-    },
-    reading_context: {
-        now: 'Reading your message and the relevant conversation context.',
-        next: 'Prepare the agent instructions and working context.',
-        completedItemIds: new Set([USER_CHAT_PROGRESS_ITEM_IDS.RECEIVE_MESSAGE]),
-    },
+const USER_CHAT_PROGRESS_PHASE_CHECKLISTS: Record<UserChatProgressPhase, UserChatProgressPhaseChecklist> = {
+    queued: { completedItemIds: new Set([]) },
+    reading_context: { completedItemIds: new Set([USER_CHAT_PROGRESS_ITEM_IDS.RECEIVE_MESSAGE]) },
     preparing_agent: {
-        now: 'Preparing the agent instructions and context needed for this request.',
-        next: 'Check which tools and inputs are available.',
         completedItemIds: new Set([
             USER_CHAT_PROGRESS_ITEM_IDS.RECEIVE_MESSAGE,
             USER_CHAT_PROGRESS_ITEM_IDS.PREPARE_AGENT,
         ]),
     },
     checking_capabilities: {
-        now: 'Checking available tools, attachments, and context before answering.',
-        next: 'Start working through the response.',
         completedItemIds: new Set([
             USER_CHAT_PROGRESS_ITEM_IDS.RECEIVE_MESSAGE,
             USER_CHAT_PROGRESS_ITEM_IDS.PREPARE_AGENT,
@@ -66,8 +117,6 @@ const USER_CHAT_PROGRESS_PHASE_PRESENTATIONS: Record<UserChatProgressPhase, User
         ]),
     },
     starting_response: {
-        now: 'Working through the response. Progress updates will stay focused on visible actions and results.',
-        next: 'Stream the final answer as soon as it is ready.',
         completedItemIds: new Set([
             USER_CHAT_PROGRESS_ITEM_IDS.RECEIVE_MESSAGE,
             USER_CHAT_PROGRESS_ITEM_IDS.PREPARE_AGENT,
@@ -103,19 +152,215 @@ const USER_CHAT_PROGRESS_ITEMS: ReadonlyArray<{
 
 /**
  * Creates one user-facing durable chat progress card for the current job phase.
+ *
+ * The optional `context` carries already-resolved runtime details (agent name, provider,
+ * tool count, attachment count, integrations) so the rendered `now`/`next` text reflects
+ * what the worker is actually doing on this turn instead of a generic scripted summary.
  */
-export function createUserChatProgressCard(phase: UserChatProgressPhase): NonNullable<ChatMessage['progressCard']> {
-    const presentation = USER_CHAT_PROGRESS_PHASE_PRESENTATIONS[phase];
+export function createUserChatProgressCard(
+    phase: UserChatProgressPhase,
+    context?: UserChatProgressContext,
+): NonNullable<ChatMessage['progressCard']> {
+    const checklist = USER_CHAT_PROGRESS_PHASE_CHECKLISTS[phase];
+    const { now, next } = composeUserChatProgressPhaseText(phase, context);
 
     return {
         title: USER_CHAT_PROGRESS_TITLE,
-        now: presentation.now,
-        next: presentation.next,
+        now,
+        next,
         items: USER_CHAT_PROGRESS_ITEMS.map((item) => ({
             ...item,
-            status: presentation.completedItemIds.has(item.id) ? 'completed' : 'pending',
+            status: checklist.completedItemIds.has(item.id) ? 'completed' : 'pending',
         })),
         updatedAt: new Date().toISOString() as NonNullable<ChatMessage['progressCard']>['updatedAt'],
         isVisible: true,
     };
 }
+
+/**
+ * Composes the dynamic `now`/`next` markdown shown for one durable chat phase.
+ *
+ * @private internal helper of `createUserChatProgressCard`
+ */
+function composeUserChatProgressPhaseText(
+    phase: UserChatProgressPhase,
+    context: UserChatProgressContext | undefined,
+): { now: string; next: string } {
+    const agentLabel = describeAgent(context);
+
+    switch (phase) {
+        case 'queued':
+            return {
+                now: spaceTrim(`
+                    Your message is waiting in the queue for the next available worker to pick it up.
+                `),
+                next: spaceTrim(`
+                    Read the conversation and load ${agentLabel}.
+                `),
+            };
+        case 'reading_context': {
+            const attachmentHint = describeAttachmentHint(context);
+            return {
+                now: spaceTrim(`
+                    Reading your latest message${attachmentHint} together with the earlier conversation thread.
+                `),
+                next: spaceTrim(`
+                    Resolve ${agentLabel} and load its instructions, persona, and rules.
+                `),
+            };
+        }
+        case 'preparing_agent': {
+            const knowledgeHint = describeKnowledgeHint(context);
+            return {
+                now: spaceTrim(`
+                    Loading the instructions and configured commitments for ${agentLabel}${knowledgeHint}.
+                `),
+                next: spaceTrim(`
+                    Check which tools, integrations, and attachments are usable for this turn.
+                `),
+            };
+        }
+        case 'checking_capabilities': {
+            const capabilitiesText = describeCapabilities(context);
+            return {
+                now: spaceTrim(`
+                    Verifying that ${agentLabel} can use ${capabilitiesText} for this answer.
+                `),
+                next: spaceTrim(`
+                    Connect to the language model and start streaming the response.
+                `),
+            };
+        }
+        case 'starting_response': {
+            const providerHint = describeProviderHint(context);
+            const cacheHint = context?.isAgentKitCached === false
+                ? ' Fresh runtime is being prepared because no cached agent was available.'
+                : '';
+            return {
+                now: spaceTrim(`
+                    Calling the language model${providerHint} and waiting for the first tokens.${cacheHint}
+                `),
+                next: spaceTrim(`
+                    Stream the response and update this panel with each user-relevant decision, action, or result.
+                `),
+            };
+        }
+    }
+}
+
+/**
+ * Returns the user-facing label for the active agent based on available context.
+ *
+ * @private internal helper of `composeUserChatProgressPhaseText`
+ */
+function describeAgent(context: UserChatProgressContext | undefined): string {
+    if (context?.agentName) {
+        return `agent **${context.agentName}**`;
+    }
+
+    if (context?.agentPermanentId) {
+        return `agent \`${context.agentPermanentId}\``;
+    }
+
+    return 'the agent';
+}
+
+/**
+ * Returns a fragment describing attachment count when one or more attachments are present.
+ *
+ * @private internal helper of `composeUserChatProgressPhaseText`
+ */
+function describeAttachmentHint(context: UserChatProgressContext | undefined): string {
+    const count = context?.attachmentCount ?? 0;
+    if (count <= 0) {
+        return '';
+    }
+
+    return count === 1 ? ' and 1 attachment' : ` and ${count} attachments`;
+}
+
+/**
+ * Returns a fragment describing knowledge sources when one or more are configured.
+ *
+ * @private internal helper of `composeUserChatProgressPhaseText`
+ */
+function describeKnowledgeHint(context: UserChatProgressContext | undefined): string {
+    const count = context?.knowledgeSourceCount ?? 0;
+    if (count <= 0) {
+        return '';
+    }
+
+    return count === 1 ? ' (1 knowledge source)' : ` (${count} knowledge sources)`;
+}
+
+/**
+ * Returns a fragment describing the LLM provider when already known.
+ *
+ * @private internal helper of `composeUserChatProgressPhaseText`
+ */
+function describeProviderHint(context: UserChatProgressContext | undefined): string {
+    if (!context?.provider) {
+        return '';
+    }
+
+    return ` via ${context.provider}`;
+}
+
+/**
+ * Builds the markdown fragment describing tools, knowledge, attachments, and integrations.
+ *
+ * @private internal helper of `composeUserChatProgressPhaseText`
+ */
+function describeCapabilities(context: UserChatProgressContext | undefined): string {
+    if (!context) {
+        return 'its configured tools and inputs';
+    }
+
+    const fragments: Array<string> = [];
+
+    const toolCount = context.toolCount ?? 0;
+    if (toolCount > 0) {
+        const highlights = (context.toolHighlights ?? []).filter((entry) => entry.trim().length > 0);
+        if (highlights.length > 0) {
+            fragments.push(`${toolCount === 1 ? '1 tool' : `${toolCount} tools`} (${highlights.join(', ')})`);
+        } else {
+            fragments.push(toolCount === 1 ? '1 tool' : `${toolCount} tools`);
+        }
+    }
+
+    const knowledgeCount = context.knowledgeSourceCount ?? 0;
+    if (knowledgeCount > 0) {
+        fragments.push(knowledgeCount === 1 ? '1 knowledge source' : `${knowledgeCount} knowledge sources`);
+    }
+
+    const attachmentCount = context.attachmentCount ?? 0;
+    if (attachmentCount > 0) {
+        fragments.push(attachmentCount === 1 ? '1 attachment' : `${attachmentCount} attachments`);
+    }
+
+    const integrations: Array<string> = [];
+    if (context.hasCalendarAccess) {
+        integrations.push('calendar');
+    }
+    if (context.hasEmailAccess) {
+        integrations.push('email');
+    }
+    if (context.hasProjectAccess) {
+        integrations.push('project repository');
+    }
+    if (integrations.length > 0) {
+        fragments.push(`${integrations.join(' / ')} access`);
+    }
+
+    if (fragments.length === 0) {
+        return 'its configured instructions and inputs';
+    }
+
+    if (fragments.length === 1) {
+        return fragments[0]!;
+    }
+
+    const head = fragments.slice(0, -1).join(', ');
+    const tail = fragments[fragments.length - 1]!;
+    return `${head}, and ${tail}`;
+}

package/apps/agents-server/src/utils/validateApiKey.ts

@@ -1,6 +1,7 @@
 import { NextRequest } from 'next/server';
 import { $getTableName } from '../database/$getTableName';
 import { $provideSupabaseForServer } from '../database/$provideSupabaseForServer';
+import { parseSessionToken, SESSION_COOKIE_NAME } from './session';
 
 /**
  * Result of Api key validation.
@@ -21,10 +22,13 @@ export type ApiKeyValidationResult = {
 export async function validateApiKey(request: NextRequest): Promise<ApiKeyValidationResult> {
     const authHeader = request.headers.get('authorization');
 
-    // If no auth header, check if user has a session cookie (logged in via web)
+    // If no auth header, check if user has a valid signed session cookie (logged in via web).
+    // The cookie value must pass HMAC-signature verification — merely sending a `sessionToken`
+    // cookie with arbitrary content must NOT authenticate the request.
     if (!authHeader) {
-        const hasSession = request.cookies.has('sessionToken');
-        if (hasSession) {
+        const sessionToken = request.cookies.get(SESSION_COOKIE_NAME)?.value;
+        const session = parseSessionToken(sessionToken);
+        if (session !== null) {
             return { isValid: true };
         }
         return {