@promptbook/cli 0.112.0-134 → 0.112.0-136

package/apps/agents-server/src/app/api/page-preview/check/route.ts

@@ -1,6 +1,8 @@
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
 import { assertsError } from '../../../../../../../src/errors/assertsError';
+import { assertSafeUrl } from '../../../../utils/assertSafeUrl';
+import { getCurrentUser } from '../../../../utils/getCurrentUser';
 import { checkIfUrlCanBeEmbedded } from '../../../../utils/iframe/checkIfUrlCanBeEmbedded';
 
 /**
@@ -11,14 +13,30 @@ import { checkIfUrlCanBeEmbedded } from '../../../../utils/iframe/checkIfUrlCanB
  * - `url` — the fully-qualified HTTP(S) URL to check
  *
  * Returns `{ canEmbed: boolean }`.
+ *
+ * Requires authentication to prevent unauthenticated SSRF abuse.
+ * The destination URL is validated against private/internal IP ranges before fetching.
  */
 export async function GET(request: NextRequest): Promise<NextResponse> {
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
     const url = request.nextUrl.searchParams.get('url');
 
     if (!url) {
         return NextResponse.json({ error: 'Missing required query parameter: url' }, { status: 400 });
     }
 
+    // Guard against SSRF: reject private/internal IPs and non-HTTP(S) schemes
+    try {
+        assertSafeUrl(url);
+    } catch (error) {
+        assertsError(error);
+        return NextResponse.json({ error: error.message }, { status: 400 });
+    }
+
     try {
         const canEmbed = await checkIfUrlCanBeEmbedded(url);
         return NextResponse.json({ canEmbed });

package/apps/agents-server/src/app/api/page-preview/screenshot/route.ts

@@ -3,6 +3,8 @@ import { serializeError } from '@promptbook-local/utils';
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
 import { assertsError } from '../../../../../../../src/errors/assertsError';
+import { assertSafeUrl } from '../../../../utils/assertSafeUrl';
+import { getCurrentUser } from '../../../../utils/getCurrentUser';
 
 /**
  * Takes a screenshot of the given URL using a headless browser.
@@ -11,23 +13,28 @@ import { assertsError } from '../../../../../../../src/errors/assertsError';
  * - `url` — the fully-qualified HTTP(S) URL to screenshot
  *
  * Returns a PNG image.
+ *
+ * Requires authentication to prevent unauthenticated SSRF abuse.
+ * The destination URL is validated against private/internal IP ranges before fetching.
  */
 export async function GET(request: NextRequest): Promise<NextResponse> {
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
     const url = request.nextUrl.searchParams.get('url');
 
     if (!url) {
         return NextResponse.json({ error: 'Missing required query parameter: url' }, { status: 400 });
     }
 
-    let parsedUrl: URL;
+    // Guard against SSRF: reject private/internal IPs and non-HTTP(S) schemes
     try {
-        parsedUrl = new URL(url);
-    } catch {
-        return NextResponse.json({ error: 'Invalid URL' }, { status: 400 });
-    }
-
-    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
-        return NextResponse.json({ error: 'Only http and https URLs are supported' }, { status: 400 });
+        assertSafeUrl(url);
+    } catch (error) {
+        assertsError(error);
+        return NextResponse.json({ error: error.message }, { status: 400 });
     }
 
     try {

package/apps/agents-server/src/app/api/team-agent-profile/route.ts

@@ -8,7 +8,10 @@ import {
     resolvePlaceholderImageUrl,
     resolveProfileImageUrl,
 } from '../../../../../../src/book-components/Chat/utils/loadAgentProfile';
+import { assertsError } from '../../../../../../src/errors/assertsError';
 import { isValidAgentUrl } from '../../../../../../src/utils/validators/url/isValidAgentUrl';
+import { assertSafeUrl } from '../../../utils/assertSafeUrl';
+import { getCurrentUser } from '../../../utils/getCurrentUser';
 
 /**
  * Response for team agent profile.
@@ -88,8 +91,17 @@ async function fetchAgentProfile(agentUrl: string, localServerUrl: string): Prom
  *
  * The client uses this to render tool call chips without relying on direct cross-origin requests
  * to the teammate agent.
+ *
+ * Requires authentication to prevent unauthenticated SSRF abuse and exfiltration of the
+ * internal team access token. The destination URL is validated against private/internal
+ * IP ranges before any outbound request is made.
  */
 export async function GET(request: Request) {
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
     const requestUrl = new URL(request.url);
     const agentUrl = requestUrl.searchParams.get('url');
 
@@ -97,6 +109,14 @@ export async function GET(request: Request) {
         return NextResponse.json({ error: 'Invalid agent URL' }, { status: 400 });
     }
 
+    // Guard against SSRF: reject private/internal IPs and non-HTTP(S) schemes
+    try {
+        assertSafeUrl(agentUrl);
+    } catch (error) {
+        assertsError(error);
+        return NextResponse.json({ error: error.message }, { status: 400 });
+    }
+
     const normalizedUrl = agentUrl.replace(/\/$/, '');
     const profile = await fetchAgentProfile(normalizedUrl, requestUrl.origin);
 

package/apps/agents-server/src/app/layout.tsx

@@ -149,7 +149,7 @@ async function getLayoutFederatedServers(options: {
     }
 
     try {
-        const federatedServerUrls = await getFederatedServers({ excludeHiddenCoreServer: true });
+        const federatedServerUrls = await getFederatedServers();
         return Promise.all(
             federatedServerUrls.map(async (url) => ({
                 title: `Federated: ${new URL(url).hostname}`,

package/apps/agents-server/src/components/AgentContextMenu/useAgentContextMenuItems.ts

@@ -300,6 +300,7 @@ function createManagementMenuItems(
  * @param formatText - Agent-aware text formatter.
  * @param handleRequestVisibilityUpdate - Visibility dialog action.
  * @param integrationLink - Generated integration link metadata.
+ * @param isAdmin - Whether the current user is an administrator (gates admin-only links).
  * @param isAuthenticated - Whether the current user is logged in.
  * @param shouldShowVisibilityAction - Whether visibility editing is available.
  * @param usageAnalyticsHref - Usage analytics URL for the current agent.
@@ -311,6 +312,7 @@ function createAdminMenuItems(
     formatText: FormatAgentContextMenuText,
     handleRequestVisibilityUpdate: () => Promise<void>,
     integrationLink: AgentContextMenuNavigationLink,
+    isAdmin: boolean,
     isAuthenticated: boolean,
     shouldShowVisibilityAction: boolean,
     usageAnalyticsHref: string,
@@ -333,26 +335,31 @@ function createAdminMenuItems(
         );
     }
 
+    if (isAdmin) {
+        menuItems.push(
+            {
+                type: 'link',
+                href: `/admin/chat-history?agentName=${encodeURIComponent(agentName)}`,
+                icon: MessageSquareIcon,
+                label: formatText('Chat History'),
+            },
+            {
+                type: 'link',
+                href: usageAnalyticsHref,
+                icon: BarChart3Icon,
+                label: formatText('Usage Analytics'),
+            },
+            {
+                type: 'link',
+                href: `/admin/chat-feedback?agentName=${encodeURIComponent(agentName)}`,
+                icon: MessageCircleQuestionIcon,
+                label: formatText('Chat Feedback'),
+            },
+            createDividerItem(),
+        );
+    }
+
     menuItems.push(
-        {
-            type: 'link',
-            href: `/admin/chat-history?agentName=${encodeURIComponent(agentName)}`,
-            icon: MessageSquareIcon,
-            label: formatText('Chat History'),
-        },
-        {
-            type: 'link',
-            href: usageAnalyticsHref,
-            icon: BarChart3Icon,
-            label: formatText('Usage Analytics'),
-        },
-        {
-            type: 'link',
-            href: `/admin/chat-feedback?agentName=${encodeURIComponent(agentName)}`,
-            icon: MessageCircleQuestionIcon,
-            label: formatText('Chat Feedback'),
-        },
-        createDividerItem(),
         {
             type: 'link',
             href: integrationLink.href,
@@ -437,6 +444,7 @@ export function useAgentContextMenuItems(props: AgentContextMenuBaseProps): Cont
         formatText,
         handleRequestVisibilityUpdate,
         integrationLink,
+        isAdmin,
         isAuthenticated,
         shouldShowVisibilityAction,
         usageAnalyticsHref,

package/apps/agents-server/src/components/Homepage/AgentsList.tsx

@@ -6,6 +6,7 @@ import type { AgentOrganizationAgent, AgentOrganizationFolder } from '../../util
 import { AgentsListDialogs } from './AgentsListDialogs';
 import { AgentsListHeader } from './AgentsListHeader';
 import { AgentsListViewContent } from './AgentsListViewContent';
+import { AGENTS_IMPORT_FILE_INPUT_ACCEPT } from './useAgentsListImportExportState';
 import type { AgentWithVisibility } from './useFederatedAgents';
 import { useAgentsListState } from './useAgentsListState';
 
@@ -72,14 +73,43 @@ export function AgentsList(props: AgentsListProps) {
         isAdmin && contextMenuFolder ? () => state.handleRequestFolderVisibilityUpdate(contextMenuFolder.id) : undefined;
 
     return (
-        <section className="mt-16 first:mt-4 mb-4">
+        <section
+            className={`relative mt-16 first:mt-4 mb-4 ${
+                state.isAgentsImportDragActive ? 'rounded-xl ring-2 ring-blue-400 ring-offset-4' : ''
+            }`}
+            onDragEnter={isAdmin ? state.handleAgentsFileDragEnter : undefined}
+            onDragLeave={isAdmin ? state.handleAgentsFileDragLeave : undefined}
+            onDragOver={isAdmin ? state.handleAgentsFileDragOver : undefined}
+            onDrop={isAdmin ? state.handleAgentsFileDrop : undefined}
+        >
+            {isAdmin && (
+                <input
+                    ref={state.importFileInputRef}
+                    type="file"
+                    multiple
+                    accept={AGENTS_IMPORT_FILE_INPUT_ACCEPT}
+                    className="hidden"
+                    onChange={(event) => void state.handleAgentsImportFileChange(event)}
+                    disabled={state.isAgentsImporting}
+                />
+            )}
+            {isAdmin && state.isAgentsImportDragActive && (
+                <div className="pointer-events-none absolute inset-0 z-20 flex items-center justify-center rounded-xl border-2 border-dashed border-blue-400 bg-blue-50/85 text-sm font-medium text-blue-800 shadow-sm">
+                    Drop books or ZIP archives to import agents
+                </div>
+            )}
             <AgentsListHeader
                 agentCount={state.agentCount}
                 allAgentsLabel={state.allAgentsLabel}
                 breadcrumbFolders={state.breadcrumbFolders}
                 canOrganize={canOrganize}
                 headingTitle={state.headingTitle}
+                isAdmin={isAdmin}
+                isAgentsExporting={state.isAgentsExporting}
+                isAgentsImporting={state.isAgentsImporting}
                 onCreateFolder={state.handleCreateFolder}
+                onExportAgents={() => void state.handleAgentsExport()}
+                onImportAgents={state.handleAgentsImportClick}
                 onNavigateToFolder={state.navigateToFolder}
                 onSetViewMode={state.setViewMode}
                 viewMode={state.viewMode}

package/apps/agents-server/src/components/Homepage/AgentsListHeader.tsx

@@ -1,6 +1,16 @@
 'use client';
 
-import { Building2, FolderPlusIcon, Gamepad2, Grid, Map, Network, type LucideIcon } from 'lucide-react';
+import {
+    Building2,
+    DownloadIcon,
+    FolderPlusIcon,
+    Gamepad2,
+    Grid,
+    Map,
+    Network,
+    UploadIcon,
+    type LucideIcon,
+} from 'lucide-react';
 import type { AgentOrganizationFolder } from '../../utils/agentOrganization/types';
 import type { HomeViewMode } from './homeViewMode';
 import { BreadcrumbDropTarget } from './BreadcrumbDropTarget';
@@ -55,6 +65,18 @@ type AgentsListHeaderProps = {
      * Current heading title.
      */
     readonly headingTitle: string;
+    /**
+     * Whether agents import/export controls are available.
+     */
+    readonly isAdmin: boolean;
+    /**
+     * Downloads an agents export.
+     */
+    readonly onExportAgents: () => void;
+    /**
+     * Opens the agents import file picker.
+     */
+    readonly onImportAgents: () => void;
     /**
      * Opens the create-folder dialog.
      */
@@ -71,6 +93,14 @@ type AgentsListHeaderProps = {
      * Currently active homepage view mode.
      */
     readonly viewMode: HomeViewMode;
+    /**
+     * Whether agents export is currently running.
+     */
+    readonly isAgentsExporting: boolean;
+    /**
+     * Whether agents import is currently running.
+     */
+    readonly isAgentsImporting: boolean;
 };
 
 /**
@@ -100,7 +130,12 @@ export function AgentsListHeader({
     breadcrumbFolders,
     canOrganize,
     headingTitle,
+    isAdmin,
+    isAgentsExporting,
+    isAgentsImporting,
     onCreateFolder,
+    onExportAgents,
+    onImportAgents,
     onNavigateToFolder,
     onSetViewMode,
     viewMode,
@@ -138,6 +173,30 @@ export function AgentsListHeader({
                     )}
                 </div>
                 <div className="flex items-center gap-2">
+                    {isListView && isAdmin && (
+                        <>
+                            <button
+                                type="button"
+                                onClick={onExportAgents}
+                                disabled={isAgentsExporting || isAgentsImporting}
+                                className="flex items-center gap-2 px-3 py-2 rounded-lg border border-gray-200 bg-white text-gray-700 hover:bg-gray-50 transition-colors text-sm disabled:cursor-not-allowed disabled:opacity-60"
+                                title="Export agents"
+                            >
+                                <DownloadIcon className="w-4 h-4" />
+                                {isAgentsExporting ? 'Exporting...' : 'Export'}
+                            </button>
+                            <button
+                                type="button"
+                                onClick={onImportAgents}
+                                disabled={isAgentsExporting || isAgentsImporting}
+                                className="flex items-center gap-2 px-3 py-2 rounded-lg border border-gray-200 bg-white text-gray-700 hover:bg-gray-50 transition-colors text-sm disabled:cursor-not-allowed disabled:opacity-60"
+                                title="Import agents"
+                            >
+                                <UploadIcon className="w-4 h-4" />
+                                {isAgentsImporting ? 'Importing...' : 'Import'}
+                            </button>
+                        </>
+                    )}
                     {isListView && canOrganize && (
                         <button
                             type="button"