@promptbook/cli 0.112.0-138 → 0.112.0-140

package/apps/agents-server/src/app/api/auth/change-password/route.ts

@@ -1,14 +1,32 @@
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 import { $getTableName } from '../../../../database/$getTableName';
 import { $provideSupabaseForServer } from '../../../../database/$provideSupabaseForServer';
-import { AgentsServerDatabase } from '../../../../database/schema';
+import type { AgentsServerDatabase } from '../../../../database/schema';
 import { getPasswordValidationMessage, hashPassword, verifyPassword } from '../../../../utils/auth';
+import {
+    AUTHENTICATION_ATTEMPT_PURPOSES,
+    checkAuthenticationAttemptRateLimit,
+    createAuthenticationAttemptRateLimitResponse,
+    recordAuthenticationAttempt,
+    recordRateLimitedAuthenticationAttempt,
+    resolveAuthenticationAttemptRequestIp,
+} from '../../../../utils/authenticationAttemptRateLimit';
 import { getCurrentUser } from '../../../../utils/getCurrentUser';
 
+/**
+ * User row shape needed to verify and update a password change.
+ */
+type ChangePasswordUserRow = Pick<AgentsServerDatabase['public']['Tables']['User']['Row'], 'id' | 'passwordHash'>;
+
+/**
+ * Supabase projection for user fields needed by password changes.
+ */
+const CHANGE_PASSWORD_USER_SELECT_COLUMNS = 'id, passwordHash';
+
 /**
  * Handles post.
  */
-export async function POST(request: Request) {
+export async function POST(request: NextRequest) {
     try {
         const user = await getCurrentUser();
         if (!user) {
@@ -18,7 +36,12 @@ export async function POST(request: Request) {
         const body = await request.json();
         const { currentPassword, newPassword } = body;
 
-        if (!currentPassword || !newPassword) {
+        if (
+            typeof currentPassword !== 'string' ||
+            typeof newPassword !== 'string' ||
+            !currentPassword ||
+            !newPassword
+        ) {
             return NextResponse.json({ error: 'Missing password fields' }, { status: 400 });
         }
 
@@ -34,10 +57,27 @@ export async function POST(request: Request) {
             );
         }
 
+        const requestIp = resolveAuthenticationAttemptRequestIp(request);
+        const rateLimitDecision = checkAuthenticationAttemptRateLimit({
+            requestIp,
+            username: user.username,
+        });
+
+        if (!rateLimitDecision.isAllowed) {
+            recordRateLimitedAuthenticationAttempt({
+                requestIp,
+                username: user.username,
+                purpose: AUTHENTICATION_ATTEMPT_PURPOSES.CHANGE_PASSWORD,
+                rejection: rateLimitDecision,
+            });
+
+            return createAuthenticationAttemptRateLimitResponse(rateLimitDecision);
+        }
+
         const supabase = $provideSupabaseForServer();
         const { data: userData, error: fetchError } = await supabase
             .from(await $getTableName('User'))
-            .select('*')
+            .select(CHANGE_PASSWORD_USER_SELECT_COLUMNS)
             .eq('username', user.username)
             .single();
 
@@ -45,10 +85,17 @@ export async function POST(request: Request) {
             return NextResponse.json({ error: 'User not found' }, { status: 404 });
         }
 
-        const userRow = userData as AgentsServerDatabase['public']['Tables']['User']['Row'];
+        const userRow = userData as ChangePasswordUserRow;
 
         // Verify current password
         const isValid = await verifyPassword(currentPassword, userRow.passwordHash);
+        recordAuthenticationAttempt({
+            requestIp,
+            username: user.username,
+            purpose: AUTHENTICATION_ATTEMPT_PURPOSES.CHANGE_PASSWORD,
+            isSuccessful: isValid,
+        });
+
         if (!isValid) {
             return NextResponse.json({ error: 'Invalid current password' }, { status: 401 });
         }

package/apps/agents-server/src/app/api/auth/login/route.ts

@@ -1,28 +1,37 @@
-import { authenticateUser } from '../../../../utils/authenticateUser';
+import { authenticateUserWithRateLimit } from '../../../../utils/authenticateUser';
+import {
+    createAuthenticationAttemptRateLimitResponse,
+    resolveAuthenticationAttemptRequestIp,
+} from '../../../../utils/authenticationAttemptRateLimit';
 import { setSession } from '../../../../utils/session';
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 
 /**
  * Handles post.
  */
-export async function POST(request: Request) {
+export async function POST(request: NextRequest) {
     try {
         const body = await request.json();
         const { username, password } = body;
 
-        if (!username || !password) {
+        if (typeof username !== 'string' || typeof password !== 'string' || !username || !password) {
             return NextResponse.json({ error: 'Username and password are required' }, { status: 400 });
         }
 
-        const user = await authenticateUser(username, password);
+        const authenticationResult = await authenticateUserWithRateLimit(username, password, {
+            requestIp: resolveAuthenticationAttemptRequestIp(request),
+        });
 
-        if (user) {
-            await setSession(user);
+        if (authenticationResult.isRateLimited) {
+            return createAuthenticationAttemptRateLimitResponse(authenticationResult.rateLimitRejection);
+        }
+
+        if (authenticationResult.user) {
+            await setSession(authenticationResult.user);
             return NextResponse.json({ success: true });
         } else {
             return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 });
         }
-
     } catch (error) {
         console.error('Login error:', error);
         return NextResponse.json({ error: 'Internal server error' }, { status: 500 });

package/apps/agents-server/src/app/api/chat/export/pdf/route.ts

@@ -3,13 +3,37 @@ import type { ChatMessage } from '../../../../../../../../src/book-components/Ch
 import type { ChatParticipant } from '../../../../../../../../src/book-components/Chat/types/ChatParticipant';
 import { createChatExportFilename } from '../../../../../../../../src/book-components/Chat/save/_common/createChatExportFilename';
 import { NextRequest, NextResponse } from 'next/server';
+import { spaceTrim } from 'spacetrim';
+import { getCurrentUser, type UserInfo } from '@/src/utils/getCurrentUser';
 import { renderHtmlToPdfOnServer } from '@/src/utils/chatExport/renderHtmlToPdfOnServer';
+import { sanitizeChatPdfExportHtml } from '@/src/utils/chatExport/sanitizeChatPdfExportHtml';
 
 /**
  * PDF export requires the Node.js runtime because it depends on Playwright.
  */
 export const runtime = 'nodejs';
 
+/**
+ * Maximum chat PDF exports one signed-in user can request per rate-limit window.
+ *
+ * @private internal constant for POST /api/chat/export/pdf
+ */
+const CHAT_PDF_EXPORT_MAX_REQUESTS_PER_WINDOW = 5;
+
+/**
+ * Sliding-window length for chat PDF export rate limiting.
+ *
+ * @private internal constant for POST /api/chat/export/pdf
+ */
+const CHAT_PDF_EXPORT_RATE_LIMIT_WINDOW_MS = 60_000;
+
+/**
+ * In-memory PDF export request timestamps keyed by authenticated user.
+ *
+ * @private internal constant for POST /api/chat/export/pdf
+ */
+const CHAT_PDF_EXPORT_RATE_LIMIT_BUCKETS: Map<string, Array<number>> = new Map();
+
 /**
  * Minimal request payload accepted by the chat PDF export endpoint.
  *
@@ -21,10 +45,48 @@ type ChatPdfExportRequestBody = {
     readonly participants: ReadonlyArray<ChatParticipant>;
 };
 
+/**
+ * Result of the chat PDF export rate-limit check.
+ *
+ * @private internal type for POST /api/chat/export/pdf
+ */
+type ChatPdfExportRateLimitResult = {
+    readonly isAllowed: boolean;
+    readonly retryAfterSeconds: number;
+};
+
 /**
  * Builds a server-rendered PDF from the standalone HTML chat export.
  */
 export async function POST(request: NextRequest) {
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const rateLimitCheck = checkChatPdfExportRateLimit(currentUser);
+    if (!rateLimitCheck.isAllowed) {
+        return NextResponse.json(
+            {
+                error: spaceTrim(`
+                    Rate limit exceeded for \`PDF\` chat exports.
+
+                    **Limit:** ${CHAT_PDF_EXPORT_MAX_REQUESTS_PER_WINDOW} requests per ${Math.round(
+                    CHAT_PDF_EXPORT_RATE_LIMIT_WINDOW_MS / 1000,
+                )} seconds.
+
+                    Try again in **${rateLimitCheck.retryAfterSeconds}** seconds.
+                `),
+            },
+            {
+                status: 429,
+                headers: {
+                    'Retry-After': String(rateLimitCheck.retryAfterSeconds),
+                },
+            },
+        );
+    }
+
     let requestBody: ChatPdfExportRequestBody;
 
     try {
@@ -45,15 +107,16 @@ export async function POST(request: NextRequest) {
     }
 
     try {
-        const pdfBuffer = await renderHtmlToPdfOnServer(
+        const html = sanitizeChatPdfExportHtml(
             buildChatHtml(requestBody.title, requestBody.messages, requestBody.participants),
         );
+        const pdfBuffer = await renderHtmlToPdfOnServer(html);
         const filename = createChatExportFilename(requestBody.title, 'pdf');
 
         return new NextResponse(pdfBuffer, {
             headers: {
                 'Content-Type': 'application/pdf',
-                'Content-Disposition': `attachment; filename="${filename}"`,
+                'Content-Disposition': createChatPdfExportContentDisposition(filename),
             },
         });
     } catch (error) {
@@ -61,3 +124,105 @@ export async function POST(request: NextRequest) {
         return NextResponse.json({ error: 'Failed to export chat as PDF.' }, { status: 500 });
     }
 }
+
+/**
+ * Applies a per-user sliding-window rate limit to Playwright-backed PDF exports.
+ *
+ * @param currentUser - Authenticated caller resolved from the request.
+ * @returns Decision and retry timing for the current attempt.
+ *
+ * @private internal helper for POST /api/chat/export/pdf
+ */
+function checkChatPdfExportRateLimit(currentUser: UserInfo): ChatPdfExportRateLimitResult {
+    const bucketKey = resolveChatPdfExportRateLimitUserKey(currentUser);
+    const nowMs = Date.now();
+    const windowStartMs = nowMs - CHAT_PDF_EXPORT_RATE_LIMIT_WINDOW_MS;
+    const previousAttempts = CHAT_PDF_EXPORT_RATE_LIMIT_BUCKETS.get(bucketKey) || [];
+    const recentAttempts = previousAttempts.filter((attemptTimeMs) => attemptTimeMs > windowStartMs);
+
+    if (recentAttempts.length >= CHAT_PDF_EXPORT_MAX_REQUESTS_PER_WINDOW) {
+        const oldestRelevantAttemptMs = recentAttempts[0]!;
+        const retryAfterMs = Math.max(
+            1_000,
+            oldestRelevantAttemptMs + CHAT_PDF_EXPORT_RATE_LIMIT_WINDOW_MS - nowMs,
+        );
+
+        CHAT_PDF_EXPORT_RATE_LIMIT_BUCKETS.set(bucketKey, recentAttempts);
+
+        return {
+            isAllowed: false,
+            retryAfterSeconds: Math.ceil(retryAfterMs / 1_000),
+        };
+    }
+
+    recentAttempts.push(nowMs);
+    CHAT_PDF_EXPORT_RATE_LIMIT_BUCKETS.set(bucketKey, recentAttempts);
+
+    return {
+        isAllowed: true,
+        retryAfterSeconds: 0,
+    };
+}
+
+/**
+ * Resolves a stable rate-limit bucket key for one authenticated user.
+ *
+ * @param currentUser - Authenticated caller resolved from the request.
+ * @returns Per-user bucket key.
+ *
+ * @private internal helper for POST /api/chat/export/pdf
+ */
+function resolveChatPdfExportRateLimitUserKey(currentUser: UserInfo): string {
+    if (typeof currentUser.id === 'number' && Number.isFinite(currentUser.id)) {
+        return `user:${currentUser.id}`;
+    }
+
+    return `username:${currentUser.username.trim().toLowerCase()}`;
+}
+
+/**
+ * Builds a standards-compatible attachment header with both quoted ASCII
+ * fallback and RFC 5987 UTF-8 filename.
+ *
+ * @param filename - Sanitized chat export filename.
+ * @returns Value for the `Content-Disposition` header.
+ *
+ * @private internal helper for POST /api/chat/export/pdf
+ */
+function createChatPdfExportContentDisposition(filename: string): string {
+    const fallbackFilename = createChatPdfExportFallbackFilename(filename);
+    const encodedFilename = encodeRFC5987Value(filename);
+
+    return `attachment; filename="${fallbackFilename}"; filename*=UTF-8''${encodedFilename}`;
+}
+
+/**
+ * Creates a quoted-string-safe ASCII fallback filename.
+ *
+ * @param filename - Preferred filename.
+ * @returns Filename safe for a quoted `Content-Disposition` parameter.
+ *
+ * @private internal helper for POST /api/chat/export/pdf
+ */
+function createChatPdfExportFallbackFilename(filename: string): string {
+    const fallbackFilename = filename
+        .replace(/[^\x20-\x7e]/g, '_')
+        .replace(/[\r\n"\\/;]/g, '_')
+        .trim();
+
+    return fallbackFilename || 'chat-export.pdf';
+}
+
+/**
+ * Encodes a `Content-Disposition` filename according to RFC 5987.
+ *
+ * @param value - Raw filename value.
+ * @returns Percent-encoded filename.
+ *
+ * @private internal helper for POST /api/chat/export/pdf
+ */
+function encodeRFC5987Value(value: string): string {
+    return encodeURIComponent(value).replace(/['()*]/g, (character) =>
+        `%${character.charCodeAt(0).toString(16).toUpperCase()}`,
+    );
+}

package/apps/agents-server/src/app/api/emails/incoming/sendgrid/route.ts

@@ -1,6 +1,10 @@
 import { $getTableName } from '../../../../../database/$getTableName';
 import { $provideSupabaseForServer } from '../../../../../database/$provideSupabaseForServer';
 import { parseInboundSendgridEmail } from '../../../../../message-providers/email/sendgrid/parseInboundSendgridEmail';
+import {
+    resolveSendgridInboundParseWebhookErrorStatus,
+    verifySendgridInboundParseWebhook,
+} from '../../../../../message-providers/email/sendgrid/verifySendgridInboundParseWebhook';
 import { NextRequest, NextResponse } from 'next/server';
 
 /**
@@ -8,7 +12,10 @@ import { NextRequest, NextResponse } from 'next/server';
  */
 export async function POST(request: NextRequest) {
     try {
-        const formData = await request.formData();
+        const rawBody = Buffer.from(await request.arrayBuffer());
+        verifySendgridInboundParseWebhook(request.headers, rawBody);
+
+        const formData = await createRequestFromRawBody(request, rawBody).formData();
         const rawEmail = formData.get('email');
 
         if (typeof rawEmail !== 'string') {
@@ -45,7 +52,22 @@ export async function POST(request: NextRequest) {
         console.error('Error processing inbound email', error);
         return NextResponse.json(
             { error: error instanceof Error ? error.message : 'Unknown error' },
-            { status: 500 },
+            { status: resolveSendgridInboundParseWebhookErrorStatus(error) },
         );
     }
 }
+
+/**
+ * Recreates a request from verified raw bytes so `formData()` can parse the multipart payload.
+ *
+ * @param request - Original incoming request.
+ * @param rawBody - Verified raw request body.
+ * @returns Request with an unread body stream.
+ */
+function createRequestFromRawBody(request: NextRequest, rawBody: Buffer): Request {
+    return new Request(request.url, {
+        method: request.method,
+        headers: request.headers,
+        body: new Uint8Array(rawBody),
+    });
+}

package/apps/agents-server/src/app/api/metadata/import/route.ts

@@ -28,7 +28,8 @@ export async function POST(request: NextRequest) {
     }
 
     try {
-        const importSummary = await importMetadataConfigurationPayload(payload);
+        const isDefaultResetSkipped = request.nextUrl.searchParams.get('isDefaultResetSkipped') === 'true';
+        const importSummary = await importMetadataConfigurationPayload(payload, { isDefaultResetSkipped });
         return NextResponse.json(importSummary);
     } catch (error) {
         if (error instanceof ParseError) {

package/apps/agents-server/src/app/api/users/[username]/route.ts

@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server';
 import { $provideSupabaseForServer } from '../../../../database/$provideSupabaseForServer';
 import { getPasswordValidationMessage, hashPassword } from '../../../../utils/auth';
 import { isUserAdmin } from '../../../../utils/isUserAdmin';
+import { PUBLIC_USER_SELECT_COLUMNS, toPublicUser, type PublicUser } from '../../../../utils/publicUser';
 
 /**
  * Handles patch.
@@ -34,7 +35,7 @@ export async function PATCH(request: Request, { params }: { params: Promise<{ us
             .from(await $getTableName('User'))
             .update(updates)
             .eq('username', usernameParam)
-            .select('*')
+            .select(PUBLIC_USER_SELECT_COLUMNS)
             .single();
 
         if (error) {
@@ -45,7 +46,7 @@ export async function PATCH(request: Request, { params }: { params: Promise<{ us
             return NextResponse.json({ error: 'User not found' }, { status: 404 });
         }
 
-        return NextResponse.json(updatedUser);
+        return NextResponse.json(toPublicUser(updatedUser as unknown as PublicUser));
     } catch (error) {
         console.error('Update user error:', error);
         const passwordValidationMessage = getPasswordValidationMessage(error);

package/apps/agents-server/src/app/api/users/route.ts

@@ -2,6 +2,7 @@ import { $getTableName } from '@/src/database/$getTableName';
 import { $provideSupabaseForServer } from '../../../database/$provideSupabaseForServer';
 import { getPasswordValidationMessage, hashPassword } from '../../../utils/auth';
 import { isUserAdmin } from '../../../utils/isUserAdmin';
+import { PUBLIC_USER_SELECT_COLUMNS, toPublicUser, type PublicUser } from '../../../utils/publicUser';
 import { NextResponse } from 'next/server';
 
 /**
@@ -16,14 +17,14 @@ export async function GET() {
         const supabase = $provideSupabaseForServer();
         const { data: users, error } = await supabase
             .from(await $getTableName('User'))
-            .select('*')
+            .select(PUBLIC_USER_SELECT_COLUMNS)
             .order('username');
 
         if (error) {
             throw error;
         }
 
-        return NextResponse.json(users);
+        return NextResponse.json(((users || []) as unknown as PublicUser[]).map(toPublicUser));
     } catch (error) {
         console.error('List users error:', error);
         return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
@@ -58,7 +59,7 @@ export async function POST(request: Request) {
                 createdAt: new Date().toISOString(),
                 updatedAt: new Date().toISOString(),
             })
-            .select('*')
+            .select(PUBLIC_USER_SELECT_COLUMNS)
             .single();
 
         if (error) {
@@ -69,7 +70,7 @@ export async function POST(request: Request) {
             throw error;
         }
 
-        return NextResponse.json(newUser);
+        return NextResponse.json(toPublicUser(newUser as unknown as PublicUser));
     } catch (error) {
         console.error('Create user error:', error);
         const passwordValidationMessage = getPasswordValidationMessage(error);

package/apps/agents-server/src/components/Homepage/AgentsList.tsx

@@ -6,7 +6,6 @@ import type { AgentOrganizationAgent, AgentOrganizationFolder } from '../../util
 import { AgentsListDialogs } from './AgentsListDialogs';
 import { AgentsListHeader } from './AgentsListHeader';
 import { AgentsListViewContent } from './AgentsListViewContent';
-import { AGENTS_IMPORT_FILE_INPUT_ACCEPT } from './useAgentsListImportExportState';
 import type { AgentWithVisibility } from './useFederatedAgents';
 import { useAgentsListState } from './useAgentsListState';
 
@@ -82,17 +81,6 @@ export function AgentsList(props: AgentsListProps) {
             onDragOver={isAdmin ? state.handleAgentsFileDragOver : undefined}
             onDrop={isAdmin ? state.handleAgentsFileDrop : undefined}
         >
-            {isAdmin && (
-                <input
-                    ref={state.importFileInputRef}
-                    type="file"
-                    multiple
-                    accept={AGENTS_IMPORT_FILE_INPUT_ACCEPT}
-                    className="hidden"
-                    onChange={(event) => void state.handleAgentsImportFileChange(event)}
-                    disabled={state.isAgentsImporting}
-                />
-            )}
             {isAdmin && state.isAgentsImportDragActive && (
                 <div className="pointer-events-none absolute inset-0 z-20 flex items-center justify-center rounded-xl border-2 border-dashed border-blue-400 bg-blue-50/85 text-sm font-medium text-blue-800 shadow-sm">
                     Drop books or ZIP archives to import agents
@@ -109,7 +97,6 @@ export function AgentsList(props: AgentsListProps) {
                 isAgentsImporting={state.isAgentsImporting}
                 onCreateFolder={state.handleCreateFolder}
                 onExportAgents={() => void state.handleAgentsExport()}
-                onImportAgents={state.handleAgentsImportClick}
                 onNavigateToFolder={state.navigateToFolder}
                 onSetViewMode={state.setViewMode}
                 viewMode={state.viewMode}
@@ -138,6 +125,7 @@ export function AgentsList(props: AgentsListProps) {
                 handleDragEnd={state.handleDragEnd}
                 handleDragOver={state.handleDragOver}
                 handleDragStart={state.handleDragStart}
+                handleAgentsFileDropIntoFolder={state.handleAgentsFileDropIntoFolder}
                 handleFolderContextMenu={state.handleFolderContextMenu}
                 handleRenameFolder={state.handleRenameFolder}
                 handleRequestAgentVisibilityChange={state.handleRequestAgentVisibilityChange}

package/apps/agents-server/src/components/Homepage/AgentsListHeader.tsx

@@ -8,7 +8,6 @@ import {
     Grid,
     Map,
     Network,
-    UploadIcon,
     type LucideIcon,
 } from 'lucide-react';
 import type { AgentOrganizationFolder } from '../../utils/agentOrganization/types';
@@ -70,13 +69,9 @@ type AgentsListHeaderProps = {
      */
     readonly isAdmin: boolean;
     /**
-     * Downloads an agents export.
+     * Downloads an agents archive.
      */
     readonly onExportAgents: () => void;
-    /**
-     * Opens the agents import file picker.
-     */
-    readonly onImportAgents: () => void;
     /**
      * Opens the create-folder dialog.
      */
@@ -135,7 +130,6 @@ export function AgentsListHeader({
     isAgentsImporting,
     onCreateFolder,
     onExportAgents,
-    onImportAgents,
     onNavigateToFolder,
     onSetViewMode,
     viewMode,
@@ -180,20 +174,10 @@ export function AgentsListHeader({
                                 onClick={onExportAgents}
                                 disabled={isAgentsExporting || isAgentsImporting}
                                 className="flex items-center gap-2 px-3 py-2 rounded-lg border border-gray-200 bg-white text-gray-700 hover:bg-gray-50 transition-colors text-sm disabled:cursor-not-allowed disabled:opacity-60"
-                                title="Export agents"
+                                title="Download agents"
                             >
                                 <DownloadIcon className="w-4 h-4" />
-                                {isAgentsExporting ? 'Exporting...' : 'Export'}
-                            </button>
-                            <button
-                                type="button"
-                                onClick={onImportAgents}
-                                disabled={isAgentsExporting || isAgentsImporting}
-                                className="flex items-center gap-2 px-3 py-2 rounded-lg border border-gray-200 bg-white text-gray-700 hover:bg-gray-50 transition-colors text-sm disabled:cursor-not-allowed disabled:opacity-60"
-                                title="Import agents"
-                            >
-                                <UploadIcon className="w-4 h-4" />
-                                {isAgentsImporting ? 'Importing...' : 'Import'}
+                                {isAgentsExporting ? 'Downloading...' : 'Download'}
                             </button>
                         </>
                     )}

package/apps/agents-server/src/components/Homepage/AgentsListListView.tsx

@@ -101,6 +101,10 @@ type AgentsListListViewProps = {
      * dnd-kit drag-start handler.
      */
     readonly handleDragStart: ComponentProps<typeof DndContext>['onDragStart'];
+    /**
+     * Imports dropped book files or ZIP archives directly into one folder.
+     */
+    readonly handleAgentsFileDropIntoFolder: SortableFolderCardProps['onFileDrop'];
     /**
      * Handles folder context-menu requests.
      */
@@ -193,6 +197,7 @@ export function AgentsListListView({
     handleDragEnd,
     handleDragOver,
     handleDragStart,
+    handleAgentsFileDropIntoFolder,
     handleFolderContextMenu,
     handleRenameFolder,
     handleRequestAgentVisibilityChange,
@@ -239,6 +244,7 @@ export function AgentsListListView({
                             onRename={canOrganize ? () => handleRenameFolder(folder.id) : undefined}
                             onDelete={canOrganize ? () => handleDeleteFolder(folder.id) : undefined}
                             onContextMenu={handleFolderContextMenu}
+                            onFileDrop={isAdmin ? handleAgentsFileDropIntoFolder : undefined}
                             dragHandleLabel={dragFolderLabel}
                             allowFullCardDrag={allowFullCardDrag}
                         />

package/apps/agents-server/src/components/Homepage/AgentsListViewContent.tsx

@@ -111,6 +111,10 @@ type AgentsListViewContentProps = {
      * dnd-kit drag-start handler.
      */
     readonly handleDragStart: ComponentProps<typeof DndContext>['onDragStart'];
+    /**
+     * Imports dropped book files or ZIP archives directly into one folder.
+     */
+    readonly handleAgentsFileDropIntoFolder: ComponentProps<typeof AgentsListListView>['handleAgentsFileDropIntoFolder'];
     /**
      * Handles folder context-menu requests.
      */
@@ -269,6 +273,7 @@ export function AgentsListViewContent({
     handleDragEnd,
     handleDragOver,
     handleDragStart,
+    handleAgentsFileDropIntoFolder,
     handleFolderContextMenu,
     handleRenameFolder,
     handleRequestAgentVisibilityChange,
@@ -308,6 +313,7 @@ export function AgentsListViewContent({
                 handleDragEnd={handleDragEnd}
                 handleDragOver={handleDragOver}
                 handleDragStart={handleDragStart}
+                handleAgentsFileDropIntoFolder={handleAgentsFileDropIntoFolder}
                 handleFolderContextMenu={handleFolderContextMenu}
                 handleRenameFolder={handleRenameFolder}
                 handleRequestAgentVisibilityChange={handleRequestAgentVisibilityChange}

package/apps/agents-server/src/components/Homepage/SortableFolderCard.tsx

@@ -4,7 +4,7 @@ import { CSS } from '@dnd-kit/utilities';
 import { useSortable } from '@dnd-kit/sortable';
 import type { string_url } from '@promptbook-local/types';
 import type { AgentBasicInformation } from '../../../../../src/book-2.0/agent-source/AgentBasicInformation';
-import type { CSSProperties, MouseEvent } from 'react';
+import type { CSSProperties, DragEvent, MouseEvent } from 'react';
 import type { AgentOrganizationFolder } from '../../utils/agentOrganization/types';
 import { FolderCard } from './FolderCard';
 import { buildCardDragProps, DragHandle } from './DragHandle';
@@ -61,6 +61,10 @@ export type SortableFolderCardProps = {
      * Context menu handler for the folder.
      */
     readonly onContextMenu?: (event: MouseEvent<HTMLDivElement>, folder: AgentOrganizationFolder) => void;
+    /**
+     * File-drop handler for importing agents directly into this folder.
+     */
+    readonly onFileDrop?: (event: DragEvent<HTMLDivElement>, folderId: number) => void;
     /**
      * Accessible label displayed for the drag handle.
      */
@@ -88,6 +92,7 @@ export function SortableFolderCard({
     onRename,
     onDelete,
     onContextMenu,
+    onFileDrop,
     dragHandleLabel,
     allowFullCardDrag,
 }: SortableFolderCardProps) {
@@ -125,6 +130,7 @@ export function SortableFolderCard({
             className={`relative ${canOrganize ? 'select-none' : ''} ${isDragging ? 'opacity-0' : ''} ${dropClasses}`}
             {...dragProps}
             onContextMenu={(event) => onContextMenu?.(event, folder)}
+            onDrop={(event) => onFileDrop?.(event, folder.id)}
         >
             <FolderCard
                 folderName={folder.name}