@promptbook/cli 0.112.0-99 → 0.112.0

package/README.md

@@ -27,11 +27,27 @@ Create persistent AI agents that turn your company's scattered knowledge into ac
 
 
 
+### Standalone VPS
+
+Run the standalone VPS installer only on a fresh server. Interactive mode asks for the installation values:
+
+```bash
+sudo curl -fsSL https://raw.githubusercontent.com/webgptorg/promptbook/refs/heads/main/other/vps/install.sh | bash
+```
+
+Non-interactive mode takes defaults from command-line options. When `--openai-api-key` is provided with the default OpenAI Codex runner, the installer installs and configures Codex automatically; other runner authentication can be configured later from the UI or SSH:
+
+```bash
+sudo curl -fsSL https://raw.githubusercontent.com/webgptorg/promptbook/refs/heads/main/other/vps/install.sh | bash -s -- \
+    --non-interactive \
+    --yes-i-understand-that-script-should-be-run-on-fresh-server \
+    --domain s24.ptbk.io \
+    --openai-api-key sk-proj-abcdef \
+    --sentry-dsn https://abc@def.ingest.de.sentry.io/123 \
+    --admin-password xxx
+```
 
 
-<blockquote style="color: #ff8811">
-    <b>⚠ Warning:</b> This is a pre-release version of the library. It is not yet ready for production use. Please look at <a href="https://www.npmjs.com/package/@promptbook/core?activeTab=versions">latest stable release</a>.
-</blockquote>
 
 ## 📦 Package `@promptbook/cli`
 
@@ -541,9 +557,9 @@ Prompts marked with `[-]` are not ready yet, prompts containing `@@@` are treate
 #### Features
 
 -   **Multi-runner execution:** `openai-codex`, `github-copilot`, `cline`, `claude-code`, `opencode`, `gemini`
--   **Context injection:** `--context AGENTS.md` or inline extra instructions
+-   **Context injection:** `--agent agents/coding/developer.book --context AGENTS.md` or inline extra instructions
 -   **Reasoning control:** `--thinking-level low|medium|high|xhigh` for supported runners
--   **Interactive or unattended runs:** default wait mode, or `--no-wait` for batch execution
+-   **Unattended or interactive runs:** default auto mode, or `--no-auto` to wait for user confirmation before each prompt
 -   **Git safety:** clean working tree check by default, optional `--ignore-git-changes`
 -   **Opt-in remote pushes:** commits stay local unless you explicitly pass `--auto-push`
 -   **Prompt triage:** `--priority` to process only more important tasks first
@@ -561,11 +577,11 @@ npx ts-node ./src/cli/test/ptbk.ts coder generate-boilerplates --template prompt
 
 npx ts-node ./src/cli/test/ptbk.ts coder generate-boilerplates --template prompts/templates/agents-server.md
 
-npx ts-node ./src/cli/test/ptbk.ts coder run --agent github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md
+npx ts-node ./src/cli/test/ptbk.ts coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md
 
-npx ts-node ./src/cli/test/ptbk.ts coder run --agent github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md --auto-push
+npx ts-node ./src/cli/test/ptbk.ts coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md --auto-push
 
-npx ts-node ./src/cli/test/ptbk.ts coder run --agent github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md --ignore-git-changes --no-wait
+npx ts-node ./src/cli/test/ptbk.ts coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md --ignore-git-changes
 
 npx ts-node ./src/cli/test/ptbk.ts coder find-refactor-candidates
 
@@ -587,11 +603,11 @@ ptbk coder generate-boilerplates
 
 ptbk coder generate-boilerplates --template prompts/templates/common.md
 
-ptbk coder run --agent github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md --test npm run test
+ptbk coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md --test npm run test
 
-ptbk coder run --agent github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md --auto-push
+ptbk coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md --auto-push
 
-ptbk coder run --agent github-copilot --model gpt-5.4 --thinking-level xhigh --context AGENTS.md --test npm run test --ignore-git-changes --no-wait
+ptbk coder run --harness github-copilot --model gpt-5.4 --thinking-level xhigh --agent agents/coding/developer.book --context AGENTS.md --test npm run test --ignore-git-changes
 
 ptbk coder find-refactor-candidates
 
@@ -604,24 +620,24 @@ ptbk coder verify
 
 #### What each command does
 
-| Command                               | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- | ------ | ---- | ----- | ------------------------------------------------------------------------ |
+| Command                               | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- | ------ | ---- | ----- | ------------------------------------------------------------------------ |
 | `ptbk coder init`                     | Creates `prompts/`, `prompts/done/`, the project-generic template files materialized in `prompts/templates/` (currently `common.md`), and a starter `AGENTS.md`; ensures `.env` contains `CODING_AGENT_GIT_NAME`, `CODING_AGENT_GIT_EMAIL`, and `CODING_AGENT_GIT_SIGNING_KEY`; adds helper coder scripts to `package.json`; ensures `.gitignore` contains `/.promptbook`; and configures `.vscode/settings.json` to save pasted prompt images into `prompts/screenshots/`. |
-| `ptbk coder generate-boilerplates`    | Creates new prompt markdown files with fresh emoji tags so you can quickly fill in coding tasks; `--template` accepts either a built-in alias or a markdown file path relative to the project root.                                                                                                                                                                                                                                                                  |
-| `ptbk coder run`                      | Picks the next ready prompt, appends optional context, runs it through the selected coding agent, can optionally verify each attempt with a shell test command and feed failing output back for retries, then marks success or failure, commits the result, and pushes only when `--auto-push` is enabled.                                                                                                                                                           |
-| `ptbk coder find-refactor-candidates` | Scans the repository for oversized or overpacked files and writes prompt files for likely refactors; `--level <xlow                                                                                                                                                                                                                                                                                                                                                  | low | medium | high | xhigh | extreme>` ranges from a very benevolent scan to a very aggressive sweep. |
-| `ptbk coder verify`                   | Walks through completed prompts, archives truly finished work, and adds follow-up repair prompts for unfinished results.                                                                                                                                                                                                                                                                                                                                             |
+| `ptbk coder generate-boilerplates`    | Creates new prompt markdown files with fresh emoji tags so you can quickly fill in coding tasks; `--template` accepts either a built-in alias or a markdown file path relative to the project root.                                                                                                                                                                                                                                                                         |
+| `ptbk coder run`                      | Picks the next ready prompt, appends optional context, runs it through the selected coding agent, can optionally verify each attempt with a shell test command and feed failing output back for retries, then marks success or failure, commits the result, and pushes only when `--auto-push` is enabled.                                                                                                                                                                  |
+| `ptbk coder find-refactor-candidates` | Scans the repository for oversized or overpacked files and writes prompt files for likely refactors; `--level <xlow                                                                                                                                                                                                                                                                                                                                                         | low | medium | high | xhigh | extreme>` ranges from a very benevolent scan to a very aggressive sweep. |
+| `ptbk coder verify`                   | Walks through completed prompts, archives truly finished work, and adds follow-up repair prompts for unfinished results.                                                                                                                                                                                                                                                                                                                                                    |
 
 #### Most useful `ptbk coder run` flags
 
 | Flag                       | Purpose                                                                                            |
 | -------------------------- | -------------------------------------------------------------------------------------------------- |
-| `--agent <name>`           | Selects the coding backend.                                                                        |
+| `--harness <name>`         | Selects the coding harness.                                                                        |
 | `--model <model>`          | Chooses the runner model; required for `openai-codex` and `gemini`, optional for `github-copilot`. |
 | `--context <text-or-file>` | Appends extra instructions inline or from a file like `AGENTS.md`.                                 |
 | `--test <command>`         | Runs a verification command after each prompt attempt and feeds failing output back for retries.   |
 | `--thinking-level <level>` | Sets reasoning effort for supported runners.                                                       |
-| `--no-wait`                | Skips interactive pauses between prompts for unattended execution.                                 |
+| `--no-auto`                | Waits for user confirmation before each prompt instead of running automatically through the queue. |
 | `--ignore-git-changes`     | Disables the clean-working-tree guard.                                                             |
 | `--priority <n>`           | Runs only prompts at or above the given priority.                                                  |
 | `--dry-run`                | Prints which prompts are ready instead of executing them.                                          |
@@ -633,8 +649,8 @@ ptbk coder verify
 
 1. Initialize once with `ptbk coder init`.
 2. Customize `prompts/templates/*.md` if needed, then create or write prompt files in `prompts/`.
-3. Customize the starter `AGENTS.md` with repository-specific instructions, then pass `--context AGENTS.md`.
-4. Run one prompt at a time interactively, or use `--no-wait` for unattended batches.
+3. Customize the starter `AGENTS.md` with repository-specific instructions, then pass `--agent agents/coding/developer.book --context AGENTS.md`.
+4. Run unattended batches by default, or pass `--no-auto` to confirm each prompt interactively.
 5. Finish with `ptbk coder verify` so resolved prompts are archived and broken ones get explicit repair follow-ups.
 
 

package/agents/default/developer.book

@@ -0,0 +1,23 @@
+Promptbook Developer
+
+RULE
+Keep in mind the DRY _(don't repeat yourself)_ principle.
+
+RULE
+Keep in mind the SOLID principles.
+
+RULE
+Do a proper analysis of the current functionality before you start implementing.
+
+RULE
+Keep small responsibilities of functions and classes, avoid creating big functions or classes that do many things.
+
+RULE
+Constants should always be `UPPER_SNAKE_CASE`.
+
+RULE
+Boolean variables should always be prefixed with `is`, for example `isUserChatJobLeaseExpired` or `IS_DEBUG_MODE`.
+
+RULE
+Do not use abbreviations, for example use `isExpired` instead of `isExp`, `translateMessage` instead of `t`, etc.
+It is fine to use well-known abbreviations, for example `id`, `url`, `html`, etc.

package/apps/agents-server/README.md

@@ -9,7 +9,7 @@ The installed CLI can initialize a local Agents Server project before it starts
 ```bash
 npm install ptbk
 ptbk agents-server init
-ptbk agents-server start --agent github-copilot --model gpt-5.4 --thinking-level xhigh
+ptbk agents-server start --harness github-copilot --model gpt-5.4 --thinking-level xhigh
 ```
 
 `ptbk agents-server init` adds missing placeholders to `.env` and local runtime exclusions to `.gitignore` without deleting existing configuration. Use `PTBK_AGENTS_SERVER_DATABASE=supabase` for a Supabase-backed server or `PTBK_AGENTS_SERVER_DATABASE=sqlite` for a standalone local database in `.promptbook`. When using Supabase, fill the initialized values from your project before starting the server. The Supabase project URL and API keys are available in the [Supabase project API settings](https://supabase.com/docs/guides/api/api-keys), and the PostgreSQL connection string is available from the [Supabase database connection guide](https://supabase.com/docs/guides/database/connecting-to-postgres).
@@ -41,6 +41,24 @@ ptbk agents-server start --agent github-copilot --model gpt-5.4 --thinking-level
 <a id="agents-server-env-admin-password"></a>
 -   `ADMIN_PASSWORD`: Password for the built-in `admin` login on a self-hosted Agents Server. Choose a private value before using the admin UI.
 
+<a id="agents-server-env-session-secret"></a>
+-   `SESSION_SECRET`: HMAC signing key used to sign the session cookie. Must be set explicitly in production — the server refuses to start session signing when missing instead of falling back to a hardcoded default. Use a long random string, for example the output of `openssl rand -hex 32`. Keep it separate from `ADMIN_PASSWORD` so a leak of either credential cannot forge the other.
+
+<a id="agents-server-env-ptbk-agents-server-user-chat-worker-token"></a>
+-   `PTBK_AGENTS_SERVER_USER_CHAT_WORKER_TOKEN`: Shared internal token used to authorize background worker routes (`/api/internal/user-chat-jobs/run`, `/api/internal/user-chat-timeouts/run`, and `/api/internal/agent-runner-limits`). Must be set explicitly in production — the server refuses to resolve the worker token when missing instead of falling back to `ADMIN_PASSWORD`, `SUPABASE_SERVICE_ROLE_KEY`, or a hardcoded constant. Use a long random string, for example the output of `openssl rand -hex 32`. The CLI launcher (`ptbk agents-server start`) generates a per-process value automatically when the variable is empty so local development works without configuration.
+
+<a id="agents-server-env-promptbook-team-agent-access-token"></a>
+-   `PROMPTBOOK_TEAM_AGENT_ACCESS_TOKEN`: Dedicated secret used by same-server `TEAM` calls to authorize access to private teammate agents. Must be a dedicated random string — falling back to `ADMIN_PASSWORD` or `SUPABASE_SERVICE_ROLE_KEY` would let a leak of one credential compromise both authentication boundaries. When not configured, same-server team access stays disabled (the integration fails closed) so leaving the variable empty is safe but disables the feature. Use a long random string, for example the output of `openssl rand -hex 32`.
+
+<a id="agents-server-env-sendgrid-inbound-parse-public-key"></a>
+-   `SENDGRID_INBOUND_PARSE_PUBLIC_KEY`: Public verification key from SendGrid Signed Webhook settings for `/api/emails/incoming/sendgrid`. The route verifies `X-Twilio-Email-Event-Webhook-Signature` over the raw multipart body before parsing or inserting an inbound `EMAIL` message. Configure either this public key or `SENDGRID_INBOUND_PARSE_WEBHOOK_SECRET`; the SendGrid public-key flow is preferred.
+
+<a id="agents-server-env-sendgrid-inbound-parse-webhook-secret"></a>
+-   `SENDGRID_INBOUND_PARSE_WEBHOOK_SECRET`: Shared secret for deployments that sign SendGrid Inbound Parse callbacks with HMAC instead of SendGrid's public-key signature flow. Leave empty when `SENDGRID_INBOUND_PARSE_PUBLIC_KEY` is configured. Use a dedicated random string and keep it separate from `SENDGRID_API_KEY`, `ADMIN_PASSWORD`, and other server secrets.
+
+<a id="agents-server-env-sendgrid-inbound-parse-hosts"></a>
+-   `SENDGRID_INBOUND_PARSE_HOSTS`: Comma-separated list of public hostnames allowed to receive SendGrid Inbound Parse callbacks, for example `mail.example.com,parse.example.com`. The route rejects signed requests delivered through any other `Host` / `X-Forwarded-Host`, so point SendGrid only at the hostnames that are also protected by your reverse-proxy or platform IP allowlisting.
+
 ## Creating servers
 
 When creating new Agents server, search across the repository for [☁]
@@ -54,4 +72,3 @@ When creating new Agents server, search across the repository for [☁]
 -   [☁] If using `USE PROJECT` auto-auth, configure [GitHub App integration](./GITHUB_APP.md)
 -   [☁] Add the server to [the list of our servers](https://docs.google.com/spreadsheets/d/1X26iMQqubsxftqD1EJNSlzPYFS94QjCFPXyKdHHDeVs/edit?gid=848307752#gid=848307752)
 -   [☁] Run migration script _(run new instance)_
--   [☁] For testing servers, look at the server and change the `CORE_SERVER` to `https://core-test.ptbk.io/`

package/apps/agents-server/env-manual/GITHUB_APP.md

@@ -32,7 +32,7 @@ GitHub App configuration now lives in **Metadata** so you can customize it per s
     - **GITHUB_APP_ID** – numeric GitHub App ID from the app settings.
     - **GITHUB_APP_SLUG** – slug used in `https://github.com/apps/<slug>`.
     - **GITHUB_APP_PRIVATE_KEY** – PEM-encoded private key. Replace literal newlines with `\n` when editing through the UI and keep the `BEGIN/END` markers.
-    - **GITHUB_APP_STATE_SECRET** (optional, recommended) – random string used to sign OAuth/connect state. If unset, `ADMIN_PASSWORD` will be used as a fallback.
+    - **GITHUB_APP_STATE_SECRET** (optional, recommended) – random string used to sign OAuth/connect state.
 
 The values stored in Metadata override any legacy `.env` entries and can differ per server host.
 

package/apps/agents-server/next.config.ts

@@ -1,6 +1,8 @@
+import { withSentryConfig } from '@sentry/nextjs';
 import type { NextConfig } from 'next';
 import { readdirSync } from 'fs';
 import path from 'path';
+import { SENTRY_ORGANIZATION, SENTRY_PROJECT } from './src/utils/errorReporting/sentrySdkConfig';
 
 /**
  * Next.js build output directory.
@@ -20,6 +22,11 @@ const agentsServerNodeModulesPath = process.env.PTBK_AGENTS_SERVER_NODE_MODULES_
  */
 const isNextValidationIgnored = process.env.PTBK_AGENTS_SERVER_IGNORE_NEXT_VALIDATION === 'true';
 
+/**
+ * Whether Sentry source maps can be uploaded during production builds.
+ */
+const IS_SENTRY_SOURCE_MAP_UPLOAD_ENABLED = Boolean(process.env.SENTRY_AUTH_TOKEN);
+
 /**
  * Exact aliases for local generated Promptbook package entrypoints.
  */
@@ -122,7 +129,19 @@ const nextConfig: NextConfig = {
     },
 };
 
-export default nextConfig;
+export default withSentryConfig(nextConfig, {
+    org: SENTRY_ORGANIZATION,
+    project: SENTRY_PROJECT,
+    silent: true,
+    sourcemaps: {
+        disable: !IS_SENTRY_SOURCE_MAP_UPLOAD_ENABLED,
+    },
+    webpack: {
+        treeshake: {
+            removeDebugLogging: true,
+        },
+    },
+});
 
 /**
  * Creates webpack/Turbopack aliases from imports like `@promptbook-local/core` to generated local sources.

package/apps/agents-server/package.json

@@ -7,7 +7,7 @@
         "dev": "next dev -p 4440",
         "test": "npm run lint && npm run test-build && npm run test-e2e",
         "test-e2e": "playwright test",
-        "pretest-build": "npx kill-port 4021",
+        "pretest-build": "npx kill-port 4021 4440 || exit 0",
         "test-build": "node -r ./scripts/ignore-kill-eperm.js ../../node_modules/next/dist/bin/next build && node ./scripts/prerender-homepage.js",
         "build": "node -r ./scripts/ignore-kill-eperm.js ../../node_modules/next/dist/bin/next build && node ./scripts/prerender-homepage.js",
         "start": "next start -p 4440",

package/apps/agents-server/playwright.config.ts

@@ -26,6 +26,9 @@ const APP_URL = `http://127.0.0.1:${APP_PORT}`;
  */
 const APP_E2E_ENV = {
     ADMIN_PASSWORD: 'e2e-admin-password',
+    SESSION_SECRET: 'e2e-session-secret-must-differ-from-admin-password',
+    PTBK_AGENTS_SERVER_USER_CHAT_WORKER_TOKEN: 'e2e-user-chat-worker-token-must-differ-from-admin-password',
+    PROMPTBOOK_TEAM_AGENT_ACCESS_TOKEN: 'e2e-team-agent-access-token-must-differ-from-admin-password',
     NEXT_DIST_DIR: '.next-e2e',
     NEXT_PUBLIC_SITE_URL: APP_URL,
     PTBK_AGENTS_SERVER_DATABASE: 'supabase',

package/apps/agents-server/scripts/prerender-homepage.js

@@ -45,6 +45,10 @@ const WAIT_TIMEOUT_MS = 15000;
  * Timeout for the final homepage download once the server is confirmed ready.
  */
 const HOME_REQUEST_TIMEOUT_MS = 30000;
+/**
+ * Timeout for stopping the temporary production server before escalating cleanup.
+ */
+const STOP_SERVER_TIMEOUT_MS = 10000;
 /**
  * When enabled, homepage prerender failures abort the whole build.
  */
@@ -136,6 +140,65 @@ function waitForServerReady(serverProcess) {
     });
 }
 
+/**
+ * Waits briefly for the temporary production server to exit after cleanup starts.
+ *
+ * @param serverProcess - Spawned `next start` child process.
+ * @param gracefulExit - Promise resolved by the child `exit` event.
+ * @returns Whether the child exited within the timeout window.
+ */
+async function waitForServerStop(serverProcess, gracefulExit) {
+    if (serverProcess.exitCode !== null || serverProcess.signalCode !== null) {
+        return true;
+    }
+
+    return await Promise.race([
+        gracefulExit.then(() => true),
+        new Promise((resolve) => setTimeout(() => resolve(false), STOP_SERVER_TIMEOUT_MS)),
+    ]);
+}
+
+/**
+ * Force-stops the temporary production server when normal shutdown does not finish in time.
+ *
+ * Windows can leave `next start` alive after an `EPERM` kill attempt, so use `taskkill`
+ * against the exact PID before giving up on cleanup.
+ *
+ * @param serverProcess - Spawned `next start` child process.
+ */
+async function forceStopServer(serverProcess) {
+    if (serverProcess.exitCode !== null || serverProcess.signalCode !== null) {
+        return;
+    }
+
+    if (process.platform !== 'win32') {
+        try {
+            serverProcess.kill('SIGKILL');
+        } catch (error) {
+            if (!isIgnorableStopServerError(error)) {
+                throw error;
+            }
+        }
+        return;
+    }
+
+    await new Promise((resolve, reject) => {
+        const taskKillProcess = spawn('taskkill', ['/PID', String(serverProcess.pid), '/T', '/F'], {
+            stdio: 'ignore',
+        });
+
+        taskKillProcess.on('error', reject);
+        taskKillProcess.on('exit', (code) => {
+            if (code === 0 || serverProcess.exitCode !== null || serverProcess.signalCode !== null) {
+                resolve();
+                return;
+            }
+
+            reject(new Error(`Failed to stop temporary production server process ${serverProcess.pid} with taskkill.`));
+        });
+    });
+}
+
 /**
  * Runs the production server for the built app, captures `/`, and keeps the HTML.
  */
@@ -196,7 +259,19 @@ async function prerenderHomePage() {
     } finally {
         detachStopServerHandlers();
         stopServer();
-        await gracefulExit;
+
+        if (!(await waitForServerStop(serverProcess, gracefulExit))) {
+            console.warn(
+                `Timed out waiting ${STOP_SERVER_TIMEOUT_MS}ms for the temporary production server to stop. Trying a forceful shutdown.`,
+            );
+            await forceStopServer(serverProcess);
+
+            if (!(await waitForServerStop(serverProcess, gracefulExit))) {
+                console.warn(
+                    `Timed out waiting ${STOP_SERVER_TIMEOUT_MS}ms for the temporary production server after forceful shutdown.`,
+                );
+            }
+        }
     }
 }
 

package/apps/agents-server/src/app/AddAgentButton.tsx

@@ -1,6 +1,5 @@
 'use client';
 
-import { useRouter } from 'next/navigation';
 import { FileCard } from '../components/Homepage/FileCard';
 import { useAgentNaming } from '../components/AgentNaming/AgentNamingContext';
 import { showAlert } from '../components/AsyncDialogs/asyncDialogs';
@@ -21,15 +20,11 @@ type AddAgentButtonProps = {
  * Renders the add-agent card and creation dialog workflow.
  */
 export function AddAgentButton({ currentFolderId }: AddAgentButtonProps) {
-    const router = useRouter();
     const { formatText } = useAgentNaming();
     const { t } = useServerLanguage();
     const addButtonLabel = formatText(t('agentCreation.addButtonLabel'));
 
     const { isPreparingDialog, openNewAgentDialog, dialog } = useNewAgentDialog({
-        onCreated: ({ targetPath }) => {
-            router.push(targetPath);
-        },
         onCreateFailed: async (error) => {
             console.error('Failed to create agent:', error);
             await showAlert({

package/apps/agents-server/src/app/[agentName]/layout.tsx

@@ -0,0 +1 @@
+export { default, generateMetadata } from '../agents/[agentName]/layout';

package/apps/agents-server/src/app/actions.ts

@@ -3,18 +3,33 @@
 import { $generateBookBoilerplate } from '@promptbook-local/core';
 import { string_agent_name, string_book } from '@promptbook-local/types';
 import { revalidatePath } from 'next/cache';
+import { headers } from 'next/headers';
 import { string_agent_permanent_id } from '../../../../src/types/typeAliases';
 import { DEFAULT_NAME_POOL, NAME_POOL_METADATA_KEY, parseNamePool } from '../constants/namePool';
-import { NEW_AGENT_WIZZARD_METADATA_KEY, parseNewAgentWizardMode } from '../constants/newAgentWizard';
+import { NEW_AGENT_WIZARD_METADATA_KEY, parseNewAgentWizardMode } from '../constants/newAgentWizard';
 import { getMetadata } from '../database/getMetadata';
 import { $provideAgentCollectionForServer } from '../tools/$provideAgentCollectionForServer';
+import { invalidateCachedActiveOrganizationSnapshots } from '../utils/agentOrganization/loadAgentOrganizationState';
+import { resolveAgentRouteTarget } from '../utils/agentRouting/resolveAgentRouteTarget';
+import { buildAgentChatHref, buildAgentProfileHref } from '../utils/agentRouting/agentRouteHrefs';
 import { type AgentVisibility, parseAgentVisibility } from '../utils/agentVisibility';
-import { authenticateUser } from '../utils/authenticateUser';
+import { authenticateUserWithRateLimit } from '../utils/authenticateUser';
+import { resolveAuthenticationAttemptHeaderIp } from '../utils/authenticationAttemptRateLimit';
 import { createAgentWithDefaultVisibility } from '../utils/createAgentWithDefaultVisibility';
 import { resolveCurrentUserIdentity } from '../utils/currentUserIdentity';
 import { isUserAdmin } from '../utils/isUserAdmin';
 import { clearSession, setSession } from '../utils/session';
 
+/**
+ * Maximum attempts used to confirm a freshly created agent route resolves before navigation starts.
+ */
+const CREATED_AGENT_ROUTE_READY_ATTEMPTS = 20;
+
+/**
+ * Delay between created-agent route-resolution retries.
+ */
+const CREATED_AGENT_ROUTE_READY_DELAY_MS = 100;
+
 /**
  * Creates a new agent from the generated boilerplate template.
  *
@@ -34,6 +49,8 @@ export async function $createAgentAction(): Promise<{ agentName: string_agent_na
     const { agentName, permanentId } = await createAgentWithDefaultVisibility(collection, agentSource, {
         userId: currentUserIdentity?.userId,
     });
+    revalidateCreatedAgentPaths(permanentId);
+    await waitForCreatedAgentRoute(permanentId);
 
     return { agentName, permanentId };
 }
@@ -58,11 +75,44 @@ export async function $getNewAgentCreationSettingsAction(): Promise<{
     defaultVisibility: AgentVisibility;
 }> {
     return {
-        mode: parseNewAgentWizardMode(await getMetadata(NEW_AGENT_WIZZARD_METADATA_KEY)),
+        mode: parseNewAgentWizardMode(await getMetadata(NEW_AGENT_WIZARD_METADATA_KEY)),
         defaultVisibility: parseAgentVisibility(await getMetadata('DEFAULT_VISIBILITY')),
     };
 }
 
+/**
+ * Clears cached organization snapshots and route payloads after a new agent is created.
+ *
+ * @param permanentId - Canonical identifier of the newly created agent.
+ */
+function revalidateCreatedAgentPaths(permanentId: string_agent_permanent_id): void {
+    invalidateCachedActiveOrganizationSnapshots();
+    revalidatePath('/', 'layout');
+    revalidatePath('/');
+    revalidatePath('/agents');
+    revalidatePath('/dashboard');
+    revalidatePath(buildAgentProfileHref(permanentId));
+    revalidatePath(buildAgentChatHref(permanentId));
+}
+
+/**
+ * Waits until the new agent can be resolved by the same routing helper the chat page uses.
+ *
+ * @param permanentId - Canonical identifier of the newly created agent.
+ */
+async function waitForCreatedAgentRoute(permanentId: string_agent_permanent_id): Promise<void> {
+    for (let attempt = 0; attempt < CREATED_AGENT_ROUTE_READY_ATTEMPTS; attempt++) {
+        const routeTarget = await resolveAgentRouteTarget(permanentId, { forceRefresh: true });
+        if (routeTarget?.kind === 'local' && routeTarget.canonicalAgentId === permanentId) {
+            return;
+        }
+
+        await new Promise((resolve) => setTimeout(resolve, CREATED_AGENT_ROUTE_READY_DELAY_MS));
+    }
+
+    throw new Error(`Created agent "${permanentId}" could not be resolved for routing immediately after creation.`);
+}
+
 /**
  * Creates a new agent using provided book content.
  *
@@ -89,6 +139,8 @@ export async function $createAgentFromBookAction(
         visibility: visibility ?? undefined,
         userId: currentUserIdentity?.userId,
     });
+    revalidateCreatedAgentPaths(permanentId);
+    await waitForCreatedAgentRoute(permanentId);
 
     return { agentName, permanentId };
 }
@@ -100,15 +152,24 @@ export async function $createAgentFromBookAction(
  * @returns Success state for the login attempt.
  */
 export async function loginAction(formData: FormData) {
-    const username = formData.get('username') as string;
-    const password = formData.get('password') as string;
+    const username = formData.get('username');
+    const password = formData.get('password');
 
-    console.info(`Login attempt for user: ${username}`);
+    if (typeof username !== 'string' || typeof password !== 'string' || !username || !password) {
+        return { success: false, message: 'Username and password are required' };
+    }
 
-    const user = await authenticateUser(username, password);
+    const requestIp = resolveAuthenticationAttemptHeaderIp(await headers());
+    const authenticationResult = await authenticateUserWithRateLimit(username, password, {
+        requestIp,
+    });
+
+    if (authenticationResult.isRateLimited) {
+        return { success: false, message: authenticationResult.message };
+    }
 
-    if (user) {
-        await setSession(user);
+    if (authenticationResult.user) {
+        await setSession(authenticationResult.user);
         revalidatePath('/', 'layout');
         return { success: true };
     } else {

package/apps/agents-server/src/app/admin/about/page.tsx

@@ -413,7 +413,7 @@ export default async function AdminAboutPage() {
     ];
 
     return (
-        <div className="min-h-screen bg-gradient-to-br from-blue-50 via-white to-purple-50">
+        <div className="min-h-screen bg-gradient-to-br from-blue-50 via-white to-purple-50 dark:from-slate-950 dark:via-slate-950 dark:to-slate-900">
             <div className="container mx-auto px-4 py-16">
                 <Card className="mb-10 space-y-4">
                     <div>

package/apps/agents-server/src/app/admin/api-tokens/ApiTokensClient.tsx

@@ -2,9 +2,11 @@
 
 import { Copy, Plus, Trash } from 'lucide-react';
 import { useEffect, useState } from 'react';
+import { useServerLanguage } from '../../../components/ServerLanguage/ServerLanguageProvider';
 import { SecretInput } from '../../../components/SecretInput/SecretInput';
 import { showConfirm } from '../../../components/AsyncDialogs/asyncDialogs';
 import { ApiTokenEntry, createApiToken, deleteApiToken, fetchApiTokens } from '../../../utils/apiTokensClient';
+import { formatServerLanguageHumanReadableDate } from '../../../utils/localization/formatServerLanguageHumanReadableDate';
 
 /**
  * Props for rendering a single API token in a masked input.
@@ -44,6 +46,7 @@ function TokenSecretField({ token, onCopy }: TokenSecretFieldProps) {
  * Renders the admin API token management UI.
  */
 export function ApiTokensClient() {
+    const { language } = useServerLanguage();
     const [tokens, setTokens] = useState<ApiTokenEntry[]>([]);
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState<string | null>(null);
@@ -182,7 +185,7 @@ export function ApiTokensClient() {
                                     </td>
                                     <td className="px-6 py-4 text-sm text-gray-500">{entry.note || '-'}</td>
                                     <td className="px-6 py-4 whitespace-nowrap text-sm text-gray-500">
-                                        {new Date(entry.createdAt).toLocaleDateString()}
+                                        {formatServerLanguageHumanReadableDate(entry.createdAt, language)}
                                     </td>
                                     <td className="px-6 py-4 whitespace-nowrap text-right text-sm font-medium">
                                         <button

package/apps/agents-server/src/app/admin/chat-feedback/ChatFeedbackClient.tsx

@@ -1,6 +1,7 @@
 'use client';
 
 import { useAgentNaming } from '../../../components/AgentNaming/AgentNamingContext';
+import { useServerLanguage } from '../../../components/ServerLanguage/ServerLanguageProvider';
 import { ChatFeedbackFiltersCard } from './ChatFeedbackFiltersCard';
 import { ChatFeedbackTable } from './ChatFeedbackTable';
 import { ChatFeedbackThreadDialog } from './ChatFeedbackThreadDialog';
@@ -21,6 +22,7 @@ type ChatFeedbackClientProps = {
  */
 export function ChatFeedbackClient({ initialAgentName }: ChatFeedbackClientProps) {
     const { formatText } = useAgentNaming();
+    const { language } = useServerLanguage();
     const chatFeedbackState = useChatFeedbackState({ initialAgentName, formatText });
 
     return (
@@ -68,6 +70,7 @@ export function ChatFeedbackClient({ initialAgentName }: ChatFeedbackClientProps
 
             <ChatFeedbackTable
                 formatText={formatText}
+                language={language}
                 items={chatFeedbackState.items}
                 total={chatFeedbackState.total}
                 loading={chatFeedbackState.loading}

package/apps/agents-server/src/app/admin/chat-feedback/ChatFeedbackTable.tsx

@@ -1,4 +1,6 @@
 import { Card } from '../../../components/Homepage/Card';
+import type { ServerLanguageCode } from '../../../languages/ServerLanguageRegistry';
+import { formatServerLanguageHumanReadableDate } from '../../../utils/localization/formatServerLanguageHumanReadableDate';
 import type { UseChatFeedbackState } from './useChatFeedbackState';
 
 /**
@@ -25,18 +27,18 @@ type ChatFeedbackTableProps = Pick<
      * Active text formatter for agent naming.
      */
     formatText: (text: string) => string;
+
+    /**
+     * Active UI language used for date formatting.
+     */
+    language: ServerLanguageCode;
 };
 
 /**
  * Formats date.
  */
-function formatDate(dateString: string | null | undefined): string {
-    if (!dateString) return '-';
-
-    const date = new Date(dateString);
-    if (Number.isNaN(date.getTime())) return dateString;
-
-    return date.toLocaleString();
+function formatDate(dateString: string | null | undefined, language: ServerLanguageCode): string {
+    return formatServerLanguageHumanReadableDate(dateString, language, { fallbackLabel: '-' });
 }
 
 /**
@@ -71,6 +73,7 @@ function ChatFeedbackPreviewCell({ value }: { value: unknown }) {
  */
 export function ChatFeedbackTable({
     formatText,
+    language,
     items,
     total,
     loading,
@@ -136,7 +139,9 @@ export function ChatFeedbackTable({
                         <tbody className="divide-y divide-gray-200 bg-white">
                             {items.map((row) => (
                                 <tr key={row.id}>
-                                    <td className="whitespace-nowrap px-4 py-3 text-gray-700">{formatDate(row.createdAt)}</td>
+                                    <td className="whitespace-nowrap px-4 py-3 text-gray-700">
+                                        {formatDate(row.createdAt, language)}
+                                    </td>
                                     <td className="whitespace-nowrap px-4 py-3 text-gray-700">{row.agentName}</td>
                                     <td className="whitespace-nowrap px-4 py-3 text-gray-700">{row.rating || '-'}</td>
                                     <td className="max-w-xs px-4 py-3 text-gray-700">