@promptbook/cli 0.112.0-135 → 0.112.0-137

package/esm/src/_packages/core.index.d.ts

@@ -221,7 +221,6 @@ import { normalizeChatAttachments } from '../utils/chat/chatAttachments/normaliz
 import { resolveChatAttachmentContents } from '../utils/chat/chatAttachments/resolveChatAttachmentContents';
 import { aboutPromptbookInformation } from '../utils/misc/aboutPromptbookInformation';
 import { $generateBookBoilerplate } from '../utils/random/$generateBookBoilerplate';
-import { CORE_AGENTS_SERVER } from '../../servers';
 import { CORE_AGENTS_SERVER_WELL_KNOWN_AGENT_NAMES } from '../../servers';
 import { PUBLIC_AGENTS_SERVERS } from '../../servers';
 export { BOOK_LANGUAGE_VERSION, PROMPTBOOK_ENGINE_VERSION };
@@ -447,6 +446,5 @@ export { normalizeChatAttachments };
 export { resolveChatAttachmentContents };
 export { aboutPromptbookInformation };
 export { $generateBookBoilerplate };
-export { CORE_AGENTS_SERVER };
 export { CORE_AGENTS_SERVER_WELL_KNOWN_AGENT_NAMES };
 export { PUBLIC_AGENTS_SERVERS };

package/esm/src/utils/isTimingSafeEqualString.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Compares two strings in constant time to prevent timing attacks.
+ *
+ * Plain JavaScript `===` / `!==` string comparisons short-circuit on the first
+ * byte that differs, which lets a remote attacker who can measure response
+ * timing recover the expected value one byte at a time. This helper performs
+ * the comparison through Node's `timingSafeEqual`, which always inspects every
+ * byte of the equal-length buffers.
+ *
+ * Returning `false` early when the byte lengths differ does not expose
+ * character content — only length — which is an acceptable trade-off, since
+ * `timingSafeEqual` requires equal-length buffers and length is typically not
+ * secret.
+ *
+ * `null` and `undefined` inputs are treated as non-matching so callers can
+ * forward raw request values (for example `request.headers.get(name)`) without
+ * an extra guard.
+ *
+ * @param candidate - Value supplied by the caller (for example a request header or cookie).
+ * @param expected - Value to compare against (for example a configured secret).
+ * @returns `true` when both values are strings of equal length with identical bytes.
+ *
+ * @private internal helper function
+ */
+export declare function isTimingSafeEqualString(candidate: string | null | undefined, expected: string | null | undefined): boolean;

package/esm/src/version.d.ts

@@ -15,7 +15,7 @@ export declare const BOOK_LANGUAGE_VERSION: string_semantic_version;
 export declare const PROMPTBOOK_ENGINE_VERSION: string_promptbook_version;
 /**
  * Represents the version string of the Promptbook engine.
- * It follows semantic versioning (e.g., `0.112.0-133`).
+ * It follows semantic versioning (e.g., `0.112.0-136`).
  *
  * @generated
  */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@promptbook/cli",
-    "version": "0.112.0-135",
+    "version": "0.112.0-137",
     "description": "Promptbook: Create persistent AI agents that turn your company's scattered knowledge into action",
     "private": false,
     "sideEffects": false,

package/servers.ts

@@ -32,21 +32,7 @@ type ServerConfiguration = {
 };
 
 /**
- * Core Promptbook server configuration
- *
- * Used for "Adam" agent which is built in as default ancestor for new agents and other well known agents
- *
- * @public exported from `@promptbook/core`
- */
-export const CORE_AGENTS_SERVER: ServerConfiguration = {
-    title: 'Promptbook Core',
-    description: `Core Promptbook server used for Adam agent which is built in as default ancestor for new agents and other well known agents.`,
-    owner: PROMPTBOOK_LEGAL_ENTITY,
-    url: 'https://core.ptbk.io/',
-};
-
-/**
- * Names of well known agents hosted on Core Promptbook server
+ * Names of well known agents bundled in the local `.core` folder of every Agents Server
  *
  * - `Adam`: The default ancestor agent for new agents
  * - `Teacher`: Agent that knows book syntax and can help with self-learning
@@ -74,7 +60,6 @@ export const CORE_AGENTS_SERVER_WELL_KNOWN_AGENT_NAMES = {
  * @public exported from `@promptbook/core`
  */
 export const PUBLIC_AGENTS_SERVERS: Array<ServerConfiguration> = [
-    CORE_AGENTS_SERVER,
     {
         title: 'Promptbook Gallery',
         description: `Gallery of ideas, AI professions,... like AI Agenta photobank.`,

package/src/_packages/core.index.ts

@@ -224,7 +224,6 @@ import { normalizeChatAttachments } from '../utils/chat/chatAttachments/normaliz
 import { resolveChatAttachmentContents } from '../utils/chat/chatAttachments/resolveChatAttachmentContents';
 import { aboutPromptbookInformation } from '../utils/misc/aboutPromptbookInformation';
 import { $generateBookBoilerplate } from '../utils/random/$generateBookBoilerplate';
-import { CORE_AGENTS_SERVER } from '../../servers';
 import { CORE_AGENTS_SERVER_WELL_KNOWN_AGENT_NAMES } from '../../servers';
 import { PUBLIC_AGENTS_SERVERS } from '../../servers';
 
@@ -456,6 +455,5 @@ export { normalizeChatAttachments };
 export { resolveChatAttachmentContents };
 export { aboutPromptbookInformation };
 export { $generateBookBoilerplate };
-export { CORE_AGENTS_SERVER };
 export { CORE_AGENTS_SERVER_WELL_KNOWN_AGENT_NAMES };
 export { PUBLIC_AGENTS_SERVERS };

package/src/commitments/_common/teamInternalAgentAccess.ts

@@ -1,4 +1,5 @@
 import CryptoJS from 'crypto-js';
+import { isTimingSafeEqualString } from '../../utils/isTimingSafeEqualString';
 
 /**
  * Header used for same-server TEAM calls that may access private teammate agents.
@@ -79,7 +80,7 @@ export function isTeamInternalAgentAccessToken(value: string | null | undefined)
     const expectedToken = resolveTeamInternalAgentAccessToken();
     const providedToken = normalizeSecret(value);
 
-    return Boolean(expectedToken && providedToken && providedToken === expectedToken);
+    return Boolean(expectedToken && providedToken && isTimingSafeEqualString(providedToken, expectedToken));
 }
 
 /**