@promptbook/cli 0.112.0-135 → 0.112.0-137

package/apps/agents-server/src/utils/serverManagement/createManagedServer/seedServerCoreAgents.ts

@@ -0,0 +1,162 @@
+import type { Client } from 'pg';
+import { createAgentPersistenceRecords } from '../../../../../../src/collection/agent-collection/constructors/agent-collection-in-supabase/createAgentPersistenceRecords';
+import { DEFAULT_AGENT_VISIBILITY } from '../../agentVisibility';
+import { CORE_AGENT_DIRECTORY_NAME, loadCoreAgentBooks } from '../../defaultAgents/loadDefaultAgentBooks';
+import { createInsertStatement, quoteIdentifier, type SqlRecorder } from './createSqlRecorder';
+import type { NormalizedCreateServerInput } from './normalizeCreateServerInput';
+
+/**
+ * Loads bundled `.core` agent books from the repository and persists them into the newly created server.
+ *
+ * Each `*.book` file in `agents/default/.core` becomes one persisted agent in the `.core` folder with its initial
+ * history snapshot.
+ *
+ * @param client - Connected PostgreSQL client inside the bootstrap transaction.
+ * @param input - Normalized create-server payload.
+ * @param sqlRecorder - Mutable SQL dump recorder.
+ *
+ * @private function of createManagedServer
+ */
+export async function seedServerCoreAgents(
+    client: Client,
+    input: NormalizedCreateServerInput,
+    sqlRecorder: SqlRecorder,
+): Promise<void> {
+    const coreAgentBooks = await loadCoreAgentBooks();
+    if (coreAgentBooks.length === 0) {
+        return;
+    }
+
+    const coreFolderId = await insertCoreFolder(client, input, sqlRecorder);
+    const agentTableIdentifier = quoteIdentifier(`${input.tablePrefix}Agent`);
+    const agentHistoryTableIdentifier = quoteIdentifier(`${input.tablePrefix}AgentHistory`);
+
+    for (const [index, coreAgentBook] of coreAgentBooks.entries()) {
+        const createdAt = new Date().toISOString();
+        const { agentInsertRecord, agentHistoryInsertRecord } = createAgentPersistenceRecords(
+            coreAgentBook,
+            { folderId: coreFolderId, sortOrder: index, visibility: DEFAULT_AGENT_VISIBILITY },
+            createdAt,
+        );
+
+        await client.query(
+            `
+                INSERT INTO ${agentTableIdentifier} (
+                    "agentName",
+                    "createdAt",
+                    "updatedAt",
+                    "permanentId",
+                    "agentHash",
+                    "agentSource",
+                    "agentProfile",
+                    "promptbookEngineVersion",
+                    "usage",
+                    "folderId",
+                    "sortOrder",
+                    "visibility"
+                )
+                VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8, $9::jsonb, $10, $11, $12)
+            `,
+            [
+                agentInsertRecord.agentName,
+                agentInsertRecord.createdAt,
+                agentInsertRecord.updatedAt,
+                agentInsertRecord.permanentId,
+                agentInsertRecord.agentHash,
+                agentInsertRecord.agentSource,
+                JSON.stringify(agentInsertRecord.agentProfile),
+                agentInsertRecord.promptbookEngineVersion,
+                JSON.stringify(agentInsertRecord.usage),
+                coreFolderId,
+                agentInsertRecord.sortOrder ?? index,
+                agentInsertRecord.visibility ?? DEFAULT_AGENT_VISIBILITY,
+            ],
+        );
+        sqlRecorder.addStatement(
+            createInsertStatement(`${input.tablePrefix}Agent`, {
+                ...agentInsertRecord,
+                agentProfile: JSON.stringify(agentInsertRecord.agentProfile),
+                usage: JSON.stringify(agentInsertRecord.usage),
+                folderId: coreFolderId,
+                sortOrder: agentInsertRecord.sortOrder ?? index,
+                visibility: agentInsertRecord.visibility ?? DEFAULT_AGENT_VISIBILITY,
+            }),
+        );
+
+        await client.query(
+            `
+                INSERT INTO ${agentHistoryTableIdentifier} (
+                    "createdAt",
+                    "agentName",
+                    "permanentId",
+                    "agentHash",
+                    "previousAgentHash",
+                    "agentSource",
+                    "promptbookEngineVersion",
+                    "versionName"
+                )
+                VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+            `,
+            [
+                agentHistoryInsertRecord.createdAt,
+                agentHistoryInsertRecord.agentName,
+                agentHistoryInsertRecord.permanentId,
+                agentHistoryInsertRecord.agentHash,
+                agentHistoryInsertRecord.previousAgentHash,
+                agentHistoryInsertRecord.agentSource,
+                agentHistoryInsertRecord.promptbookEngineVersion,
+                agentHistoryInsertRecord.versionName,
+            ],
+        );
+        sqlRecorder.addStatement(createInsertStatement(`${input.tablePrefix}AgentHistory`, agentHistoryInsertRecord));
+    }
+}
+
+/**
+ * Inserts the `.core` folder row for the newly bootstrapped server.
+ *
+ * @param client - Connected PostgreSQL client inside the bootstrap transaction.
+ * @param input - Normalized create-server payload.
+ * @param sqlRecorder - Mutable SQL dump recorder.
+ * @returns Identifier of the inserted `.core` folder.
+ *
+ * @private function of createManagedServer
+ */
+async function insertCoreFolder(
+    client: Client,
+    input: NormalizedCreateServerInput,
+    sqlRecorder: SqlRecorder,
+): Promise<number> {
+    const agentFolderTableIdentifier = quoteIdentifier(`${input.tablePrefix}AgentFolder`);
+    const createdAt = new Date().toISOString();
+    const insertResult = await client.query<{ id: number }>(
+        `
+            INSERT INTO ${agentFolderTableIdentifier} (
+                "name",
+                "parentId",
+                "sortOrder",
+                "icon",
+                "color",
+                "createdAt",
+                "updatedAt"
+            )
+            VALUES ($1, NULL, $2, NULL, NULL, $3, NULL)
+            RETURNING "id"
+        `,
+        [CORE_AGENT_DIRECTORY_NAME, 0, createdAt],
+    );
+
+    sqlRecorder.addStatement(
+        createInsertStatement(`${input.tablePrefix}AgentFolder`, {
+            name: CORE_AGENT_DIRECTORY_NAME,
+            parentId: null,
+            sortOrder: 0,
+            icon: null,
+            color: null,
+            createdAt,
+            updatedAt: null,
+        }),
+    );
+
+    return insertResult.rows[0].id;
+}

package/apps/agents-server/src/utils/session.ts

@@ -3,6 +3,7 @@ import { cookies, headers } from 'next/headers';
 import { cache } from 'react';
 import { spaceTrim } from 'spacetrim';
 import { EnvironmentMismatchError } from '../../../../src/errors/EnvironmentMismatchError';
+import { isTimingSafeEqualString } from '../../../../src/utils/isTimingSafeEqualString';
 import { isStandaloneVpsRawIpBootstrapActive } from './standaloneVpsRawIpBootstrap';
 
 /**
@@ -153,7 +154,7 @@ export function parseSessionToken(token: string | null | undefined): SessionUser
     const payload = Buffer.from(payloadBase64, 'base64').toString('utf-8');
     const expectedSignature = createHmac('sha256', getSessionSigningKey()).update(payload).digest('hex');
 
-    if (signature !== expectedSignature) {
+    if (!isTimingSafeEqualString(signature, expectedSignature)) {
         return null;
     }
 

package/apps/agents-server/src/utils/vpsSelfUpdate.ts

@@ -207,6 +207,10 @@ export type VpsSelfUpdateOverview = {
      * Number of commits the deployed checkout is behind the latest remote commit, or `null` when unknown.
      */
     readonly commitsBehindCount: number | null;
+    /**
+     * Commits that the deployed checkout is behind the latest remote commit (newest first).
+     */
+    readonly pendingCommits: ReadonlyArray<VpsSelfUpdatePendingCommit>;
     /**
      * Whether the remote branch contains a newer commit than the deployed checkout.
      */
@@ -465,6 +469,10 @@ export async function readVpsSelfUpdateOverview(): Promise<VpsSelfUpdateOverview
         currentCommitSha && latestRemoteCommitSha
             ? await countCommitsBetween(repositoryDirectory, currentCommitSha, latestRemoteCommitSha)
             : null;
+    const pendingCommits =
+        currentCommitSha && latestRemoteCommitSha
+            ? await listCommitsBetween(repositoryDirectory, currentCommitSha, latestRemoteCommitSha)
+            : [];
     const resolvedJob = resolveVpsSelfUpdateJobForOverview(job, {
         currentEnvironment,
         currentCommitSha,
@@ -484,6 +492,7 @@ export async function readVpsSelfUpdateOverview(): Promise<VpsSelfUpdateOverview
         latestRemoteCommitShortSha: abbreviateCommitSha(latestRemoteCommitSha),
         latestRemoteCommitDate,
         commitsBehindCount,
+        pendingCommits,
         isUpdateAvailable: Boolean(
             currentCommitSha && latestRemoteCommitSha && currentCommitSha !== latestRemoteCommitSha,
         ),
@@ -494,6 +503,33 @@ export async function readVpsSelfUpdateOverview(): Promise<VpsSelfUpdateOverview
     };
 }
 
+/**
+ * Browser-safe summary of one commit that the deployed checkout is behind the latest remote commit.
+ */
+export type VpsSelfUpdatePendingCommit = {
+    /**
+     * Full commit hash.
+     */
+    readonly commitSha: string;
+    /**
+     * Short commit hash (first 7 chars).
+     */
+    readonly shortCommitSha: string;
+    /**
+     * Single-line commit subject.
+     */
+    readonly subject: string;
+    /**
+     * Author timestamp in ISO format or `null` when unknown.
+     */
+    readonly authoredAt: string | null;
+};
+
+/**
+ * Hard ceiling for the pending-commits listing returned in the overview to avoid huge payloads on a long-stale server.
+ */
+const VPS_SELF_UPDATE_MAX_PENDING_COMMITS = 100;
+
 /**
  * Browser-safe summary of one commit that the super admin can pick from the custom-target picker.
  */
@@ -790,6 +826,7 @@ function createUnavailableOverview(context: {
         latestRemoteCommitShortSha: null,
         latestRemoteCommitDate: null,
         commitsBehindCount: null,
+        pendingCommits: [],
         isUpdateAvailable: false,
         originRepositoryUrl: context.originRepositoryUrl,
         isOriginRepositoryDefault: context.originRepositoryUrl === VPS_SELF_UPDATE_DEFAULT_ORIGIN_REPOSITORY_URL,
@@ -1205,6 +1242,79 @@ async function countCommitsBetween(
     return Number.isFinite(parsedCount) ? parsedCount : null;
 }
 
+/**
+ * Lists commits that separate two commits in the local repository so the admin UI can show subject/hash/date for each one.
+ *
+ * Returns an empty list when either commit cannot be resolved (typical for a shallow clone that has not been deepened yet)
+ * or when both commits are identical.
+ *
+ * @param repositoryDirectory - Repository checkout path.
+ * @param fromCommitSha - Older commit hash (deployed commit).
+ * @param toCommitSha - Newer commit hash (latest remote commit).
+ * @returns Browser-safe pending-commit list (newest first).
+ */
+async function listCommitsBetween(
+    repositoryDirectory: string,
+    fromCommitSha: string,
+    toCommitSha: string,
+): Promise<ReadonlyArray<VpsSelfUpdatePendingCommit>> {
+    if (fromCommitSha === toCommitSha) {
+        return [];
+    }
+
+    const output = await runGitInRepository(repositoryDirectory, [
+        'log',
+        `--max-count=${VPS_SELF_UPDATE_MAX_PENDING_COMMITS}`,
+        `--format=%H${GIT_LOG_FIELD_SEPARATOR}%aI${GIT_LOG_FIELD_SEPARATOR}%s`,
+        `${fromCommitSha}..${toCommitSha}`,
+    ]);
+    if (!output) {
+        return [];
+    }
+
+    const pendingCommits: Array<VpsSelfUpdatePendingCommit> = [];
+    for (const line of output.split('\n')) {
+        if (!line) {
+            continue;
+        }
+
+        const fields = line.split(GIT_LOG_FIELD_SEPARATOR);
+        const commitSha = fields[0] ?? '';
+        if (!commitSha) {
+            continue;
+        }
+
+        const authoredAt = fields[1] || null;
+        const subject = fields.slice(2).join(GIT_LOG_FIELD_SEPARATOR);
+
+        pendingCommits.push({
+            commitSha,
+            shortCommitSha: commitSha.slice(0, 7),
+            subject,
+            authoredAt,
+        });
+    }
+
+    return pendingCommits;
+}
+
+/**
+ * Reads the full persisted standalone VPS self-update log so the super admin can copy/download it for debugging.
+ *
+ * @returns Log file content or `null` when the file does not exist yet.
+ */
+export async function readVpsSelfUpdateLogFileContent(): Promise<string | null> {
+    const logFilePath = resolveVpsSelfUpdateLogFilePath();
+    try {
+        return await readFile(logFilePath, 'utf-8');
+    } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+            return null;
+        }
+        throw error;
+    }
+}
+
 /**
  * Checks whether a detached update process is still alive.
  *

package/esm/index.es.js

@@ -59,7 +59,7 @@ const BOOK_LANGUAGE_VERSION = '2.0.0';
  * @generated
  * @see https://github.com/webgptorg/promptbook
  */
-const PROMPTBOOK_ENGINE_VERSION = '0.112.0-135';
+const PROMPTBOOK_ENGINE_VERSION = '0.112.0-137';
 /**
  * TODO: string_promptbook_version should be constrained to the all versions of Promptbook engine
  * Note: [💞] Ignore a discrepancy between file name and entity name