@promptbook/cli 0.112.0-134 → 0.112.0-136

package/apps/agents-server/src/utils/userChat/runUserChatJob.ts

@@ -22,7 +22,7 @@ import { heartbeatUserChatJob } from './heartbeatUserChatJob';
 import { persistUserChatJobTerminalState } from './persistUserChatJobTerminalState';
 import { persistUserChatJobProgressCard } from './persistUserChatJobProgressCard';
 import type { UserChatJobRecord } from './UserChatJobRecord';
-import type { UserChatProgressPhase } from './userChatProgressCard';
+import type { UserChatProgressContext, UserChatProgressPhase } from './userChatProgressCard';
 import { createReplyAwareUserChatPromptContent, createReplyAwareUserChatPromptMessage } from './userChatReplies';
 import { resolvePromptThreadBeforeUserMessage } from './userChatMessageLifecycle';
 import { isUserChatNotFoundScopeError } from './UserChatScopeError';
@@ -132,14 +132,15 @@ export async function runUserChatJob(job: UserChatJobRecord): Promise<RunUserCha
  */
 function createRunUserChatJobProgressReporter(
     job: Pick<UserChatJobRecord, 'userId' | 'agentPermanentId' | 'chatId' | 'assistantMessageId' | 'id'>,
-): (phase: UserChatProgressPhase) => Promise<void> {
-    return async (phase) => {
+): (phase: UserChatProgressPhase, context?: UserChatProgressContext) => Promise<void> {
+    return async (phase, context) => {
         await persistUserChatJobProgressCard({
             userId: job.userId,
             agentPermanentId: job.agentPermanentId,
             chatId: job.chatId,
             assistantMessageId: job.assistantMessageId,
             phase,
+            context,
         }).catch((error) => {
             console.warn('[user-chat-job] progress_update_failed', {
                 chatId: job.chatId,

package/apps/agents-server/src/utils/userChat/userChatProgressCard.ts

@@ -1,4 +1,5 @@
 import type { ChatMessage } from '@promptbook-local/types';
+import { spaceTrim } from '../../../../../src/_packages/utils.index';
 
 /**
  * User-facing phases shown while one durable chat answer is being prepared.
@@ -10,6 +11,70 @@ export type UserChatProgressPhase =
     | 'checking_capabilities'
     | 'starting_response';
 
+/**
+ * Real runtime details surfaced into the user-facing progress card text.
+ *
+ * Only signals that are already known at the corresponding phase are filled in,
+ * so the produced markdown reflects what the worker is actually doing right now
+ * instead of a generic scripted summary.
+ */
+export type UserChatProgressContext = {
+    /**
+     * Resolved human-readable agent name, when already loaded for this turn.
+     */
+    readonly agentName?: string;
+
+    /**
+     * Stable agent identifier shown when the human-readable name is not yet known.
+     */
+    readonly agentPermanentId?: string;
+
+    /**
+     * Resolved LLM provider title (e.g. `OpenAI`, `Anthropic`), when already known.
+     */
+    readonly provider?: string;
+
+    /**
+     * Number of attachments the user submitted with the current turn.
+     */
+    readonly attachmentCount?: number;
+
+    /**
+     * Number of agent-defined tools available to the model for this turn.
+     */
+    readonly toolCount?: number;
+
+    /**
+     * Concise user-facing tool labels (e.g. `web browser`, `calendar`) for the progress text.
+     */
+    readonly toolHighlights?: ReadonlyArray<string>;
+
+    /**
+     * Number of knowledge sources the agent will reference during the turn.
+     */
+    readonly knowledgeSourceCount?: number;
+
+    /**
+     * Whether the calendar integration is wired up for this turn.
+     */
+    readonly hasCalendarAccess?: boolean;
+
+    /**
+     * Whether the email-sending integration is wired up for this turn.
+     */
+    readonly hasEmailAccess?: boolean;
+
+    /**
+     * Whether one or more project repositories are linked to this turn.
+     */
+    readonly hasProjectAccess?: boolean;
+
+    /**
+     * Whether the AgentKit runtime for this agent came from the in-process cache.
+     */
+    readonly isAgentKitCached?: boolean;
+};
+
 /**
  * Default title used by durable chat progress cards.
  */
@@ -26,39 +91,25 @@ const USER_CHAT_PROGRESS_ITEM_IDS = {
 } as const;
 
 /**
- * Static progress copy for one durable chat phase.
+ * Static checklist mapping for one durable chat phase.
  */
-type UserChatProgressPhasePresentation = {
-    readonly now: string;
-    readonly next: string;
+type UserChatProgressPhaseChecklist = {
     readonly completedItemIds: ReadonlySet<string>;
 };
 
 /**
- * User-facing progress copy for durable chat phases.
+ * Static checklist progression shared across all durable chat phases.
  */
-const USER_CHAT_PROGRESS_PHASE_PRESENTATIONS: Record<UserChatProgressPhase, UserChatProgressPhasePresentation> = {
-    queued: {
-        now: 'Your message is queued and the agent will pick it up shortly.',
-        next: 'The agent will read the conversation and prepare the answer.',
-        completedItemIds: new Set([]),
-    },
-    reading_context: {
-        now: 'Reading your message and the relevant conversation context.',
-        next: 'Prepare the agent instructions and working context.',
-        completedItemIds: new Set([USER_CHAT_PROGRESS_ITEM_IDS.RECEIVE_MESSAGE]),
-    },
+const USER_CHAT_PROGRESS_PHASE_CHECKLISTS: Record<UserChatProgressPhase, UserChatProgressPhaseChecklist> = {
+    queued: { completedItemIds: new Set([]) },
+    reading_context: { completedItemIds: new Set([USER_CHAT_PROGRESS_ITEM_IDS.RECEIVE_MESSAGE]) },
     preparing_agent: {
-        now: 'Preparing the agent instructions and context needed for this request.',
-        next: 'Check which tools and inputs are available.',
         completedItemIds: new Set([
             USER_CHAT_PROGRESS_ITEM_IDS.RECEIVE_MESSAGE,
             USER_CHAT_PROGRESS_ITEM_IDS.PREPARE_AGENT,
         ]),
     },
     checking_capabilities: {
-        now: 'Checking available tools, attachments, and context before answering.',
-        next: 'Start working through the response.',
         completedItemIds: new Set([
             USER_CHAT_PROGRESS_ITEM_IDS.RECEIVE_MESSAGE,
             USER_CHAT_PROGRESS_ITEM_IDS.PREPARE_AGENT,
@@ -66,8 +117,6 @@ const USER_CHAT_PROGRESS_PHASE_PRESENTATIONS: Record<UserChatProgressPhase, User
         ]),
     },
     starting_response: {
-        now: 'Working through the response. Progress updates will stay focused on visible actions and results.',
-        next: 'Stream the final answer as soon as it is ready.',
         completedItemIds: new Set([
             USER_CHAT_PROGRESS_ITEM_IDS.RECEIVE_MESSAGE,
             USER_CHAT_PROGRESS_ITEM_IDS.PREPARE_AGENT,
@@ -103,19 +152,215 @@ const USER_CHAT_PROGRESS_ITEMS: ReadonlyArray<{
 
 /**
  * Creates one user-facing durable chat progress card for the current job phase.
+ *
+ * The optional `context` carries already-resolved runtime details (agent name, provider,
+ * tool count, attachment count, integrations) so the rendered `now`/`next` text reflects
+ * what the worker is actually doing on this turn instead of a generic scripted summary.
  */
-export function createUserChatProgressCard(phase: UserChatProgressPhase): NonNullable<ChatMessage['progressCard']> {
-    const presentation = USER_CHAT_PROGRESS_PHASE_PRESENTATIONS[phase];
+export function createUserChatProgressCard(
+    phase: UserChatProgressPhase,
+    context?: UserChatProgressContext,
+): NonNullable<ChatMessage['progressCard']> {
+    const checklist = USER_CHAT_PROGRESS_PHASE_CHECKLISTS[phase];
+    const { now, next } = composeUserChatProgressPhaseText(phase, context);
 
     return {
         title: USER_CHAT_PROGRESS_TITLE,
-        now: presentation.now,
-        next: presentation.next,
+        now,
+        next,
         items: USER_CHAT_PROGRESS_ITEMS.map((item) => ({
             ...item,
-            status: presentation.completedItemIds.has(item.id) ? 'completed' : 'pending',
+            status: checklist.completedItemIds.has(item.id) ? 'completed' : 'pending',
         })),
         updatedAt: new Date().toISOString() as NonNullable<ChatMessage['progressCard']>['updatedAt'],
         isVisible: true,
     };
 }
+
+/**
+ * Composes the dynamic `now`/`next` markdown shown for one durable chat phase.
+ *
+ * @private internal helper of `createUserChatProgressCard`
+ */
+function composeUserChatProgressPhaseText(
+    phase: UserChatProgressPhase,
+    context: UserChatProgressContext | undefined,
+): { now: string; next: string } {
+    const agentLabel = describeAgent(context);
+
+    switch (phase) {
+        case 'queued':
+            return {
+                now: spaceTrim(`
+                    Your message is waiting in the queue for the next available worker to pick it up.
+                `),
+                next: spaceTrim(`
+                    Read the conversation and load ${agentLabel}.
+                `),
+            };
+        case 'reading_context': {
+            const attachmentHint = describeAttachmentHint(context);
+            return {
+                now: spaceTrim(`
+                    Reading your latest message${attachmentHint} together with the earlier conversation thread.
+                `),
+                next: spaceTrim(`
+                    Resolve ${agentLabel} and load its instructions, persona, and rules.
+                `),
+            };
+        }
+        case 'preparing_agent': {
+            const knowledgeHint = describeKnowledgeHint(context);
+            return {
+                now: spaceTrim(`
+                    Loading the instructions and configured commitments for ${agentLabel}${knowledgeHint}.
+                `),
+                next: spaceTrim(`
+                    Check which tools, integrations, and attachments are usable for this turn.
+                `),
+            };
+        }
+        case 'checking_capabilities': {
+            const capabilitiesText = describeCapabilities(context);
+            return {
+                now: spaceTrim(`
+                    Verifying that ${agentLabel} can use ${capabilitiesText} for this answer.
+                `),
+                next: spaceTrim(`
+                    Connect to the language model and start streaming the response.
+                `),
+            };
+        }
+        case 'starting_response': {
+            const providerHint = describeProviderHint(context);
+            const cacheHint = context?.isAgentKitCached === false
+                ? ' Fresh runtime is being prepared because no cached agent was available.'
+                : '';
+            return {
+                now: spaceTrim(`
+                    Calling the language model${providerHint} and waiting for the first tokens.${cacheHint}
+                `),
+                next: spaceTrim(`
+                    Stream the response and update this panel with each user-relevant decision, action, or result.
+                `),
+            };
+        }
+    }
+}
+
+/**
+ * Returns the user-facing label for the active agent based on available context.
+ *
+ * @private internal helper of `composeUserChatProgressPhaseText`
+ */
+function describeAgent(context: UserChatProgressContext | undefined): string {
+    if (context?.agentName) {
+        return `agent **${context.agentName}**`;
+    }
+
+    if (context?.agentPermanentId) {
+        return `agent \`${context.agentPermanentId}\``;
+    }
+
+    return 'the agent';
+}
+
+/**
+ * Returns a fragment describing attachment count when one or more attachments are present.
+ *
+ * @private internal helper of `composeUserChatProgressPhaseText`
+ */
+function describeAttachmentHint(context: UserChatProgressContext | undefined): string {
+    const count = context?.attachmentCount ?? 0;
+    if (count <= 0) {
+        return '';
+    }
+
+    return count === 1 ? ' and 1 attachment' : ` and ${count} attachments`;
+}
+
+/**
+ * Returns a fragment describing knowledge sources when one or more are configured.
+ *
+ * @private internal helper of `composeUserChatProgressPhaseText`
+ */
+function describeKnowledgeHint(context: UserChatProgressContext | undefined): string {
+    const count = context?.knowledgeSourceCount ?? 0;
+    if (count <= 0) {
+        return '';
+    }
+
+    return count === 1 ? ' (1 knowledge source)' : ` (${count} knowledge sources)`;
+}
+
+/**
+ * Returns a fragment describing the LLM provider when already known.
+ *
+ * @private internal helper of `composeUserChatProgressPhaseText`
+ */
+function describeProviderHint(context: UserChatProgressContext | undefined): string {
+    if (!context?.provider) {
+        return '';
+    }
+
+    return ` via ${context.provider}`;
+}
+
+/**
+ * Builds the markdown fragment describing tools, knowledge, attachments, and integrations.
+ *
+ * @private internal helper of `composeUserChatProgressPhaseText`
+ */
+function describeCapabilities(context: UserChatProgressContext | undefined): string {
+    if (!context) {
+        return 'its configured tools and inputs';
+    }
+
+    const fragments: Array<string> = [];
+
+    const toolCount = context.toolCount ?? 0;
+    if (toolCount > 0) {
+        const highlights = (context.toolHighlights ?? []).filter((entry) => entry.trim().length > 0);
+        if (highlights.length > 0) {
+            fragments.push(`${toolCount === 1 ? '1 tool' : `${toolCount} tools`} (${highlights.join(', ')})`);
+        } else {
+            fragments.push(toolCount === 1 ? '1 tool' : `${toolCount} tools`);
+        }
+    }
+
+    const knowledgeCount = context.knowledgeSourceCount ?? 0;
+    if (knowledgeCount > 0) {
+        fragments.push(knowledgeCount === 1 ? '1 knowledge source' : `${knowledgeCount} knowledge sources`);
+    }
+
+    const attachmentCount = context.attachmentCount ?? 0;
+    if (attachmentCount > 0) {
+        fragments.push(attachmentCount === 1 ? '1 attachment' : `${attachmentCount} attachments`);
+    }
+
+    const integrations: Array<string> = [];
+    if (context.hasCalendarAccess) {
+        integrations.push('calendar');
+    }
+    if (context.hasEmailAccess) {
+        integrations.push('email');
+    }
+    if (context.hasProjectAccess) {
+        integrations.push('project repository');
+    }
+    if (integrations.length > 0) {
+        fragments.push(`${integrations.join(' / ')} access`);
+    }
+
+    if (fragments.length === 0) {
+        return 'its configured instructions and inputs';
+    }
+
+    if (fragments.length === 1) {
+        return fragments[0]!;
+    }
+
+    const head = fragments.slice(0, -1).join(', ');
+    const tail = fragments[fragments.length - 1]!;
+    return `${head}, and ${tail}`;
+}

package/apps/agents-server/src/utils/validateApiKey.ts

@@ -1,6 +1,7 @@
 import { NextRequest } from 'next/server';
 import { $getTableName } from '../database/$getTableName';
 import { $provideSupabaseForServer } from '../database/$provideSupabaseForServer';
+import { parseSessionToken, SESSION_COOKIE_NAME } from './session';
 
 /**
  * Result of Api key validation.
@@ -21,10 +22,13 @@ export type ApiKeyValidationResult = {
 export async function validateApiKey(request: NextRequest): Promise<ApiKeyValidationResult> {
     const authHeader = request.headers.get('authorization');
 
-    // If no auth header, check if user has a session cookie (logged in via web)
+    // If no auth header, check if user has a valid signed session cookie (logged in via web).
+    // The cookie value must pass HMAC-signature verification — merely sending a `sessionToken`
+    // cookie with arbitrary content must NOT authenticate the request.
     if (!authHeader) {
-        const hasSession = request.cookies.has('sessionToken');
-        if (hasSession) {
+        const sessionToken = request.cookies.get(SESSION_COOKIE_NAME)?.value;
+        const session = parseSessionToken(sessionToken);
+        if (session !== null) {
             return { isValid: true };
         }
         return {

package/apps/agents-server/src/utils/vpsSelfUpdate.ts

@@ -207,6 +207,10 @@ export type VpsSelfUpdateOverview = {
      * Number of commits the deployed checkout is behind the latest remote commit, or `null` when unknown.
      */
     readonly commitsBehindCount: number | null;
+    /**
+     * Commits that the deployed checkout is behind the latest remote commit (newest first).
+     */
+    readonly pendingCommits: ReadonlyArray<VpsSelfUpdatePendingCommit>;
     /**
      * Whether the remote branch contains a newer commit than the deployed checkout.
      */
@@ -465,6 +469,10 @@ export async function readVpsSelfUpdateOverview(): Promise<VpsSelfUpdateOverview
         currentCommitSha && latestRemoteCommitSha
             ? await countCommitsBetween(repositoryDirectory, currentCommitSha, latestRemoteCommitSha)
             : null;
+    const pendingCommits =
+        currentCommitSha && latestRemoteCommitSha
+            ? await listCommitsBetween(repositoryDirectory, currentCommitSha, latestRemoteCommitSha)
+            : [];
     const resolvedJob = resolveVpsSelfUpdateJobForOverview(job, {
         currentEnvironment,
         currentCommitSha,
@@ -484,6 +492,7 @@ export async function readVpsSelfUpdateOverview(): Promise<VpsSelfUpdateOverview
         latestRemoteCommitShortSha: abbreviateCommitSha(latestRemoteCommitSha),
         latestRemoteCommitDate,
         commitsBehindCount,
+        pendingCommits,
         isUpdateAvailable: Boolean(
             currentCommitSha && latestRemoteCommitSha && currentCommitSha !== latestRemoteCommitSha,
         ),
@@ -494,6 +503,33 @@ export async function readVpsSelfUpdateOverview(): Promise<VpsSelfUpdateOverview
     };
 }
 
+/**
+ * Browser-safe summary of one commit that the deployed checkout is behind the latest remote commit.
+ */
+export type VpsSelfUpdatePendingCommit = {
+    /**
+     * Full commit hash.
+     */
+    readonly commitSha: string;
+    /**
+     * Short commit hash (first 7 chars).
+     */
+    readonly shortCommitSha: string;
+    /**
+     * Single-line commit subject.
+     */
+    readonly subject: string;
+    /**
+     * Author timestamp in ISO format or `null` when unknown.
+     */
+    readonly authoredAt: string | null;
+};
+
+/**
+ * Hard ceiling for the pending-commits listing returned in the overview to avoid huge payloads on a long-stale server.
+ */
+const VPS_SELF_UPDATE_MAX_PENDING_COMMITS = 100;
+
 /**
  * Browser-safe summary of one commit that the super admin can pick from the custom-target picker.
  */
@@ -790,6 +826,7 @@ function createUnavailableOverview(context: {
         latestRemoteCommitShortSha: null,
         latestRemoteCommitDate: null,
         commitsBehindCount: null,
+        pendingCommits: [],
         isUpdateAvailable: false,
         originRepositoryUrl: context.originRepositoryUrl,
         isOriginRepositoryDefault: context.originRepositoryUrl === VPS_SELF_UPDATE_DEFAULT_ORIGIN_REPOSITORY_URL,
@@ -1205,6 +1242,79 @@ async function countCommitsBetween(
     return Number.isFinite(parsedCount) ? parsedCount : null;
 }
 
+/**
+ * Lists commits that separate two commits in the local repository so the admin UI can show subject/hash/date for each one.
+ *
+ * Returns an empty list when either commit cannot be resolved (typical for a shallow clone that has not been deepened yet)
+ * or when both commits are identical.
+ *
+ * @param repositoryDirectory - Repository checkout path.
+ * @param fromCommitSha - Older commit hash (deployed commit).
+ * @param toCommitSha - Newer commit hash (latest remote commit).
+ * @returns Browser-safe pending-commit list (newest first).
+ */
+async function listCommitsBetween(
+    repositoryDirectory: string,
+    fromCommitSha: string,
+    toCommitSha: string,
+): Promise<ReadonlyArray<VpsSelfUpdatePendingCommit>> {
+    if (fromCommitSha === toCommitSha) {
+        return [];
+    }
+
+    const output = await runGitInRepository(repositoryDirectory, [
+        'log',
+        `--max-count=${VPS_SELF_UPDATE_MAX_PENDING_COMMITS}`,
+        `--format=%H${GIT_LOG_FIELD_SEPARATOR}%aI${GIT_LOG_FIELD_SEPARATOR}%s`,
+        `${fromCommitSha}..${toCommitSha}`,
+    ]);
+    if (!output) {
+        return [];
+    }
+
+    const pendingCommits: Array<VpsSelfUpdatePendingCommit> = [];
+    for (const line of output.split('\n')) {
+        if (!line) {
+            continue;
+        }
+
+        const fields = line.split(GIT_LOG_FIELD_SEPARATOR);
+        const commitSha = fields[0] ?? '';
+        if (!commitSha) {
+            continue;
+        }
+
+        const authoredAt = fields[1] || null;
+        const subject = fields.slice(2).join(GIT_LOG_FIELD_SEPARATOR);
+
+        pendingCommits.push({
+            commitSha,
+            shortCommitSha: commitSha.slice(0, 7),
+            subject,
+            authoredAt,
+        });
+    }
+
+    return pendingCommits;
+}
+
+/**
+ * Reads the full persisted standalone VPS self-update log so the super admin can copy/download it for debugging.
+ *
+ * @returns Log file content or `null` when the file does not exist yet.
+ */
+export async function readVpsSelfUpdateLogFileContent(): Promise<string | null> {
+    const logFilePath = resolveVpsSelfUpdateLogFilePath();
+    try {
+        return await readFile(logFilePath, 'utf-8');
+    } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+            return null;
+        }
+        throw error;
+    }
+}
+
 /**
  * Checks whether a detached update process is still alive.
  *