@promptbook/cli 0.112.0-95 → 0.112.0-97

package/apps/agents-server/src/database/resolvePostgresConnectionString.ts

@@ -0,0 +1,26 @@
+import spaceTrim from 'spacetrim';
+import { DatabaseError } from '../../../../src/errors/DatabaseError';
+
+/**
+ * Resolves the PostgreSQL connection string used by Supabase-backed Agents Server database access.
+ *
+ * @returns PostgreSQL connection string.
+ * @throws DatabaseError when neither supported environment variable is configured.
+ *
+ * @private exported from Agents Server database utilities
+ */
+export function resolvePostgresConnectionString(): string {
+    const connectionString = process.env.POSTGRES_URL || process.env.DATABASE_URL;
+
+    if (!connectionString) {
+        throw new DatabaseError(
+            spaceTrim(`
+                Environment variable \`POSTGRES_URL\` or \`DATABASE_URL\` must be defined.
+
+                Configure one of these variables to use the Supabase/PostgreSQL database backend.
+            `),
+        );
+    }
+
+    return connectionString;
+}

package/apps/agents-server/src/database/sqlite/$provideAgentsServerSqliteDatabase.ts

@@ -0,0 +1,83 @@
+import { existsSync, mkdirSync } from 'fs';
+import { dirname } from 'path';
+import { resolveAgentsServerSqliteDatabasePath } from './resolveAgentsServerSqliteDatabasePath';
+
+/**
+ * Shape of the `better-sqlite3` module constructor loaded at runtime.
+ *
+ * @private internal SQLite utility of Agents Server
+ */
+export type BetterSqliteConstructor = new (path: string) => AgentsServerSqliteDatabase;
+
+/**
+ * Minimal `better-sqlite3` database surface shared by Agents Server SQLite utilities.
+ *
+ * @private internal SQLite utility of Agents Server
+ */
+export type AgentsServerSqliteDatabase = {
+    readonly pragma: (source: string) => unknown;
+    readonly exec: (source: string) => void;
+    readonly prepare: (source: string) => AgentsServerSqliteStatement;
+    readonly transaction: <TArguments extends ReadonlyArray<unknown>, TResult>(
+        fn: (...args: TArguments) => TResult,
+    ) => (...args: TArguments) => TResult;
+    readonly close?: () => void;
+};
+
+/**
+ * Minimal `better-sqlite3` prepared statement surface shared by Agents Server SQLite utilities.
+ *
+ * @private internal SQLite utility of Agents Server
+ */
+export type AgentsServerSqliteStatement = {
+    readonly reader?: boolean;
+    readonly all: (...values: ReadonlyArray<unknown>) => Array<Record<string, unknown>>;
+    readonly get: (...values: ReadonlyArray<unknown>) => Record<string, unknown> | undefined;
+    readonly run: (...values: ReadonlyArray<unknown>) => {
+        readonly changes: number;
+        readonly lastInsertRowid: number | bigint;
+    };
+};
+
+/**
+ * Cached SQLite database connection.
+ */
+let agentsServerSqliteDatabase: AgentsServerSqliteDatabase | null = null;
+
+/**
+ * Opens and initializes the shared local SQLite database.
+ *
+ * @returns Shared SQLite database connection.
+ *
+ * @private exported from Agents Server SQLite utilities
+ */
+export function $provideAgentsServerSqliteDatabase(): AgentsServerSqliteDatabase {
+    if (agentsServerSqliteDatabase) {
+        return agentsServerSqliteDatabase;
+    }
+
+    const databasePath = resolveAgentsServerSqliteDatabasePath();
+    const databaseDirectory = dirname(databasePath);
+
+    if (!existsSync(databaseDirectory)) {
+        mkdirSync(databaseDirectory, { recursive: true });
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const BetterSqlite = require('better-sqlite3') as BetterSqliteConstructor;
+    agentsServerSqliteDatabase = new BetterSqlite(databasePath);
+    agentsServerSqliteDatabase.pragma('journal_mode = WAL');
+    agentsServerSqliteDatabase.pragma('foreign_keys = ON');
+
+    return agentsServerSqliteDatabase;
+}
+
+/**
+ * Closes the cached SQLite connection and resets adapter state for isolated tests.
+ *
+ * @private exported from Agents Server SQLite utilities
+ */
+export function $resetAgentsServerSqliteDatabaseForTests(): void {
+    agentsServerSqliteDatabase?.close?.();
+    agentsServerSqliteDatabase = null;
+}

package/apps/agents-server/src/database/sqlite/$provideLocalSqliteSupabase.ts

@@ -1,8 +1,10 @@
-import { existsSync, mkdirSync } from 'fs';
-import { dirname } from 'path';
 import type { SupabaseClient } from '@supabase/supabase-js';
 import type { TODO_any } from '@promptbook-local/types';
-import { resolveAgentsServerSqliteDatabasePath } from './resolveAgentsServerSqliteDatabasePath';
+import {
+    $provideAgentsServerSqliteDatabase,
+    $resetAgentsServerSqliteDatabaseForTests,
+    type AgentsServerSqliteDatabase,
+} from './$provideAgentsServerSqliteDatabase';
 
 /**
  * Minimal query result shape consumed by Agents Server Supabase call sites.
@@ -63,33 +65,6 @@ type LocalSqliteUpsertOptions = {
     readonly onConflict?: string;
 };
 
-/**
- * Shape of the `better-sqlite3` module constructor loaded at runtime.
- */
-type BetterSqliteConstructor = new (path: string) => BetterSqliteDatabase;
-
-/**
- * Minimal `better-sqlite3` database surface used by this adapter.
- */
-type BetterSqliteDatabase = {
-    readonly pragma: (source: string) => unknown;
-    readonly exec: (source: string) => void;
-    readonly prepare: (source: string) => BetterSqliteStatement;
-    readonly close?: () => void;
-};
-
-/**
- * Minimal `better-sqlite3` prepared statement surface used by this adapter.
- */
-type BetterSqliteStatement = {
-    readonly all: (...values: ReadonlyArray<unknown>) => Array<Record<string, unknown>>;
-    readonly get: (...values: ReadonlyArray<unknown>) => Record<string, unknown> | undefined;
-    readonly run: (...values: ReadonlyArray<unknown>) => {
-        readonly changes: number;
-        readonly lastInsertRowid: number | bigint;
-    };
-};
-
 /**
  * Columns whose values are persisted as JSON text in local SQLite.
  */
@@ -170,11 +145,6 @@ const DEFAULT_UPSERT_CONFLICT_COLUMNS_BY_TABLE = new Map<string, ReadonlyArray<s
     ['ServerLimit', ['key']],
 ]);
 
-/**
- * Cached SQLite database connection.
- */
-let sqliteDatabase: BetterSqliteDatabase | null = null;
-
 /**
  * Cached Supabase-shaped local client.
  */
@@ -188,7 +158,7 @@ export function $provideLocalSqliteSupabase(): SupabaseClient {
         return localSqliteSupabase;
     }
 
-    localSqliteSupabase = new LocalSqliteSupabaseClient(getSqliteDatabase()) as unknown as SupabaseClient;
+    localSqliteSupabase = new LocalSqliteSupabaseClient($provideAgentsServerSqliteDatabase()) as unknown as SupabaseClient;
     return localSqliteSupabase;
 }
 
@@ -196,40 +166,15 @@ export function $provideLocalSqliteSupabase(): SupabaseClient {
  * Closes the cached SQLite connection and resets adapter state for isolated tests.
  */
 export function $resetLocalSqliteSupabaseForTests(): void {
-    sqliteDatabase?.close?.();
-    sqliteDatabase = null;
+    $resetAgentsServerSqliteDatabaseForTests();
     localSqliteSupabase = null;
 }
 
-/**
- * Opens and initializes the shared local SQLite database.
- */
-function getSqliteDatabase(): BetterSqliteDatabase {
-    if (sqliteDatabase) {
-        return sqliteDatabase;
-    }
-
-    const databasePath = resolveAgentsServerSqliteDatabasePath();
-    const databaseDirectory = dirname(databasePath);
-
-    if (!existsSync(databaseDirectory)) {
-        mkdirSync(databaseDirectory, { recursive: true });
-    }
-
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
-    const BetterSqlite = require('better-sqlite3') as BetterSqliteConstructor;
-    sqliteDatabase = new BetterSqlite(databasePath);
-    sqliteDatabase.pragma('journal_mode = WAL');
-    sqliteDatabase.pragma('foreign_keys = ON');
-
-    return sqliteDatabase;
-}
-
 /**
  * Supabase-shaped client with only the table query surface used by Agents Server.
  */
 class LocalSqliteSupabaseClient {
-    public constructor(private readonly database: BetterSqliteDatabase) {}
+    public constructor(private readonly database: AgentsServerSqliteDatabase) {}
 
     /**
      * Starts a query for one SQLite table.
@@ -244,7 +189,7 @@ class LocalSqliteSupabaseClient {
  */
 class LocalSqliteTable {
     public constructor(
-        private readonly database: BetterSqliteDatabase,
+        private readonly database: AgentsServerSqliteDatabase,
         private readonly tableName: string,
     ) {}
 
@@ -304,7 +249,7 @@ class LocalSqliteQueryBuilder implements PromiseLike<LocalSqliteQueryResult> {
     private isReturningSelection = false;
 
     public constructor(
-        private readonly database: BetterSqliteDatabase,
+        private readonly database: AgentsServerSqliteDatabase,
         private readonly tableName: string,
     ) {}
 
@@ -851,7 +796,11 @@ type ParsedPostgrestFilter = {
 /**
  * Ensures a table and all required columns exist.
  */
-function ensureTable(database: BetterSqliteDatabase, tableName: string, requiredColumns: ReadonlyArray<string>): void {
+function ensureTable(
+    database: AgentsServerSqliteDatabase,
+    tableName: string,
+    requiredColumns: ReadonlyArray<string>,
+): void {
     const tableBaseName = resolveTableBaseName(tableName);
     const primaryKey = TEXT_PRIMARY_KEY_TABLES.has(tableBaseName)
         ? '"id" TEXT PRIMARY KEY'
@@ -886,7 +835,7 @@ function ensureTable(database: BetterSqliteDatabase, tableName: string, required
 /**
  * Creates known unique indexes after required columns exist.
  */
-function ensureUniqueIndexes(database: BetterSqliteDatabase, tableName: string, tableBaseName: string): void {
+function ensureUniqueIndexes(database: AgentsServerSqliteDatabase, tableName: string, tableBaseName: string): void {
     const uniqueIndexes = UNIQUE_INDEX_COLUMNS_BY_TABLE.get(tableBaseName) || [];
 
     for (const columns of uniqueIndexes) {
@@ -900,7 +849,7 @@ function ensureUniqueIndexes(database: BetterSqliteDatabase, tableName: string,
  * Inserts one row into the table.
  */
 function insertRow(
-    database: BetterSqliteDatabase,
+    database: AgentsServerSqliteDatabase,
     tableName: string,
     row: Record<string, unknown>,
 ): { readonly lastInsertRowid: number | bigint } {
@@ -921,7 +870,7 @@ function insertRow(
  * Updates one row by SQLite rowid.
  */
 function updateRowid(
-    database: BetterSqliteDatabase,
+    database: AgentsServerSqliteDatabase,
     tableName: string,
     rowid: number | bigint,
     row: Record<string, unknown>,
@@ -940,7 +889,7 @@ function updateRowid(
  * Finds the rowid matching an upsert conflict target.
  */
 function findConflictRowid(
-    database: BetterSqliteDatabase,
+    database: AgentsServerSqliteDatabase,
     tableName: string,
     row: Record<string, unknown>,
     conflictColumns: ReadonlyArray<string>,
@@ -960,7 +909,7 @@ function findConflictRowid(
  * Selects rows by rowids for a mutation returning clause.
  */
 function selectRowsByRowids(
-    database: BetterSqliteDatabase,
+    database: AgentsServerSqliteDatabase,
     tableName: string,
     rowids: ReadonlyArray<number | bigint>,
     selectedColumns: ReadonlyArray<string>,

package/apps/agents-server/src/languages/ServerTranslationKeys.ts

@@ -142,6 +142,8 @@ export const SERVER_TRANSLATION_KEYS = [
     'header.createNewUser',
     'header.servers',
     'header.environmentVariables',
+    'header.update',
+    'header.database',
     'header.logs',
     'header.codeRunners',
     'header.models',

package/apps/agents-server/src/languages/translations/czech.yaml

@@ -136,6 +136,8 @@ header.viewAllUsers: Zobrazit všechny uživatele
 header.createNewUser: Vytvořit nového uživatele
 header.servers: Servery
 header.environmentVariables: Proměnné prostředí
+header.update: Aktualizace
+header.database: Databáze
 header.logs: Logy
 header.codeRunners: Code runnery
 header.models: Modely

package/apps/agents-server/src/languages/translations/english.yaml

@@ -138,6 +138,8 @@ header.viewAllUsers: View all users
 header.createNewUser: Create new user
 header.servers: Servers
 header.environmentVariables: Environment variables
+header.update: Update
+header.database: Database
 header.logs: Logs
 header.codeRunners: Code runners
 header.models: Models

package/apps/agents-server/src/middleware.ts

@@ -3,6 +3,7 @@ import { applyVisibilityHeaders } from './middleware/applyVisibilityHeaders';
 import { createMiddlewareRequestContext } from './middleware/createMiddlewareRequestContext';
 import { resolveAccessControlResponse } from './middleware/resolveAccessControlResponse';
 import { resolveMiddlewareResponse } from './middleware/resolveMiddlewareResponse';
+import { writeShibbolethAuthenticationLog } from './utils/shibboleth/writeShibbolethAuthenticationLog';
 
 /**
  * Main Next.js middleware coordinating request context loading, access control,
@@ -12,6 +13,15 @@ import { resolveMiddlewareResponse } from './middleware/resolveMiddlewareRespons
  * @returns Middleware response.
  */
 export async function middleware(request: NextRequest): Promise<NextResponse> {
+    if (shouldLogShibbolethRequestFromMiddleware(request)) {
+        writeShibbolethAuthenticationLog(request.headers, {
+            event: 'middleware-request',
+            pathname: request.nextUrl.pathname,
+            method: request.method,
+            hasSessionCookie: request.cookies.has('sessionToken'),
+        });
+    }
+
     const middlewareRequestContext = await createMiddlewareRequestContext(request);
     const applyResponseHeaders = async (response: NextResponse): Promise<void> => {
         await applyVisibilityHeaders({
@@ -58,3 +68,25 @@ export const config = {
         '/((?!_next/static|_next/image|favicon.ico|logo-|fonts/|robots.txt|api/internal).*)',
     ],
 };
+
+/**
+ * Decides whether the current middleware request should emit Shibboleth diagnostics.
+ *
+ * We log the first anonymous request plus explicit auth/SAML routes so standalone VPS
+ * pm2 logs show the incoming Shibboleth attributes without flooding every authenticated
+ * page load once the browser already carries a session cookie.
+ *
+ * @param request - Incoming middleware request.
+ * @returns `true` when the request is useful for Shibboleth diagnostics.
+ */
+function shouldLogShibbolethRequestFromMiddleware(request: NextRequest): boolean {
+    const pathname = request.nextUrl.pathname.toLowerCase();
+    const isAuthenticationPath = pathname.startsWith('/api/auth');
+    const isShibbolethPath = pathname.includes('shibboleth') || pathname.includes('saml');
+
+    if (isAuthenticationPath || isShibbolethPath) {
+        return true;
+    }
+
+    return !request.cookies.has('sessionToken');
+}

package/apps/agents-server/src/tools/$provideServer.ts

@@ -1,7 +1,7 @@
 import { NEXT_PUBLIC_SITE_URL, SUPABASE_TABLE_PREFIX } from '@/config';
 import { headers } from 'next/headers';
 import { cache } from 'react';
-import { isAgentsServerSqliteMode } from '../database/agentsServerDatabaseMode';
+import { isAgentsServerStandaloneMode } from '../database/agentsServerDatabaseMode';
 import { resolveInternalServerOrigin } from '../utils/resolveInternalServerOrigin';
 import { createServerPublicUrl, listRegisteredServersUsingServiceRole } from '../utils/serverRegistry';
 import { resolveServerSelection } from '../utils/serverSelection';
@@ -37,7 +37,7 @@ const getCachedProvidedServer = cache(async (): Promise<ProvidedServer> => {
     const requestHost = headersList.get('host');
     const xPromptbookServer = headersList.get('x-promptbook-server');
 
-    if (isAgentsServerSqliteMode()) {
+    if (isAgentsServerStandaloneMode()) {
         if (isLocalDevelopmentHost(requestHost)) {
             return {
                 id: null,