@promptbook/cli 0.112.0-99 → 0.112.0

package/apps/agents-server/src/utils/serverManagement/createManagedServer/seedServerDefaultAgents.ts

@@ -1,26 +1,10 @@
-import { access, readFile, readdir } from 'node:fs/promises';
-import { resolve } from 'node:path';
-import type { string_book } from '../../../../../../src/book-2.0/agent-source/string_book';
 import { createAgentPersistenceRecords } from '../../../../../../src/collection/agent-collection/constructors/agent-collection-in-supabase/createAgentPersistenceRecords';
-import { DatabaseError } from '../../../../../../src/errors/DatabaseError';
 import type { Client } from 'pg';
-import { spaceTrim } from 'spacetrim';
+import { DEFAULT_AGENT_VISIBILITY } from '../../agentVisibility';
+import { loadDefaultAgentBooks } from '../../defaultAgents/loadDefaultAgentBooks';
 import { createInsertStatement, quoteIdentifier, type SqlRecorder } from './createSqlRecorder';
 import type { NormalizedCreateServerInput } from './normalizeCreateServerInput';
 
-/**
- * Candidate directories where bundled default agent books can be located.
- *
- * The app test suite runs from `apps/agents-server`, while local development usually runs from the repository root.
- *
- * @private function of createManagedServer
- */
-const DEFAULT_AGENT_DIRECTORY_CANDIDATES = [
-    resolve(process.cwd(), 'agents', 'default'),
-    resolve(process.cwd(), '..', '..', 'agents', 'default'),
-    resolve(__dirname, '../../../../../../agents/default'),
-] as const;
-
 /**
  * Loads default agent books from the repository and persists them into the newly created server.
  *
@@ -45,7 +29,7 @@ export async function seedServerDefaultAgents(
         const createdAt = new Date().toISOString();
         const { agentInsertRecord, agentHistoryInsertRecord } = createAgentPersistenceRecords(
             defaultAgentBook,
-            { sortOrder: index },
+            { sortOrder: index, visibility: DEFAULT_AGENT_VISIBILITY },
             createdAt,
         );
 
@@ -62,9 +46,10 @@ export async function seedServerDefaultAgents(
                     "promptbookEngineVersion",
                     "usage",
                     "folderId",
-                    "sortOrder"
+                    "sortOrder",
+                    "visibility"
                 )
-                VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8, $9::jsonb, $10, $11)
+                VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8, $9::jsonb, $10, $11, $12)
             `,
             [
                 agentInsertRecord.agentName,
@@ -78,6 +63,7 @@ export async function seedServerDefaultAgents(
                 JSON.stringify(agentInsertRecord.usage),
                 agentInsertRecord.folderId ?? null,
                 agentInsertRecord.sortOrder ?? index,
+                agentInsertRecord.visibility ?? DEFAULT_AGENT_VISIBILITY,
             ],
         );
         sqlRecorder.addStatement(
@@ -87,6 +73,7 @@ export async function seedServerDefaultAgents(
                 usage: JSON.stringify(agentInsertRecord.usage),
                 folderId: agentInsertRecord.folderId ?? null,
                 sortOrder: agentInsertRecord.sortOrder ?? index,
+                visibility: agentInsertRecord.visibility ?? DEFAULT_AGENT_VISIBILITY,
             }),
         );
 
@@ -118,70 +105,3 @@ export async function seedServerDefaultAgents(
         sqlRecorder.addStatement(createInsertStatement(`${input.tablePrefix}AgentHistory`, agentHistoryInsertRecord));
     }
 }
-
-/**
- * Loads all default agent books in deterministic filename order.
- *
- * @returns Sorted default agent sources.
- *
- * @private function of `seedServerDefaultAgents`
- */
-async function loadDefaultAgentBooks(): Promise<ReadonlyArray<string_book>> {
-    const defaultAgentDirectory = await resolveDefaultAgentDirectory();
-    const directoryEntries = await readdir(defaultAgentDirectory);
-    const defaultAgentFilenames = directoryEntries
-        .filter((entry) => entry.toLowerCase().endsWith('.book'))
-        .sort((leftFilename, rightFilename) => leftFilename.localeCompare(rightFilename));
-
-    return Promise.all(
-        defaultAgentFilenames.map(async (filename) => {
-            const filePath = resolve(defaultAgentDirectory, filename);
-            return (await readFile(filePath, 'utf-8')) as string_book;
-        }),
-    );
-}
-
-/**
- * Resolves the repository directory that stores default managed-server agents.
- *
- * @returns Absolute path to `agents/default`.
- *
- * @private function of `seedServerDefaultAgents`
- */
-async function resolveDefaultAgentDirectory(): Promise<string> {
-    for (const directoryCandidate of DEFAULT_AGENT_DIRECTORY_CANDIDATES) {
-        try {
-            await access(directoryCandidate);
-            return directoryCandidate;
-        } catch {
-            // Continue to the next candidate directory.
-        }
-    }
-
-    throw new DatabaseError(
-        spaceTrim(
-            (block) => `
-                Failed to locate the default Agents Server books directory.
-
-                Checked:
-                ${block(
-                    DEFAULT_AGENT_DIRECTORY_CANDIDATES.map(
-                        (candidate) => `- \`${normalizePathForLogs(candidate)}\``,
-                    ).join('\n'),
-                )}
-            `,
-        ),
-    );
-}
-
-/**
- * Normalizes path separators for diagnostics.
- *
- * @param value - Raw filesystem path.
- * @returns Slash-normalized path.
- *
- * @private function of `seedServerDefaultAgents`
- */
-function normalizePathForLogs(value: string): string {
-    return value.split('\\').join('/');
-}

package/apps/agents-server/src/utils/serverManagement/createManagedServer.ts

@@ -108,6 +108,11 @@ export type CreateServerInput = {
      */
     readonly additionalUsers?: ReadonlyArray<ServerSeedUserInput>;
 
+    /**
+     * Whether bundled default agents from `agents/default` should be created during bootstrap.
+     */
+    readonly isDefaultAgentsInstalled?: boolean;
+
     /**
      * Initial metadata values for the new server.
      */

package/apps/agents-server/src/utils/session.ts

@@ -1,8 +1,10 @@
-import { createHmac } from 'crypto';
+import { createHmac, randomBytes } from 'crypto';
 import { cookies, headers } from 'next/headers';
 import { cache } from 'react';
+import { spaceTrim } from 'spacetrim';
+import { EnvironmentMismatchError } from '../../../../src/errors/EnvironmentMismatchError';
+import { isTimingSafeEqualString } from '../../../../src/utils/isTimingSafeEqualString';
 import { isStandaloneVpsRawIpBootstrapActive } from './standaloneVpsRawIpBootstrap';
-import { writeShibbolethAuthenticationLog } from './shibboleth/writeShibbolethAuthenticationLog';
 
 /**
  * Cookie name used to store the signed user session.
@@ -10,9 +12,64 @@ import { writeShibbolethAuthenticationLog } from './shibboleth/writeShibbolethAu
 export const SESSION_COOKIE_NAME = 'sessionToken';
 
 /**
- * Secret key used for signing session payloads.
+ * Cached HMAC signing key resolved from `SESSION_SECRET` on first use.
+ *
+ * Computed lazily so module imports never fail eagerly at build time and the
+ * environment can still be configured before the first authenticated request.
  */
-const SECRET_KEY = process.env.ADMIN_PASSWORD || 'default-secret-key-change-me';
+let resolvedSessionSigningKey: string | null = null;
+
+/**
+ * Resolves the HMAC signing key used for session payloads.
+ *
+ * In production, `SESSION_SECRET` must be configured explicitly — falling back
+ * to any shared credential (in particular `ADMIN_PASSWORD`) or a hardcoded
+ * literal would let anyone who learns that value forge session tokens for any
+ * user (including `admin`). Outside production, a per-process random key is
+ * generated on first use so local development works without configuration
+ * while still rejecting the unsafe hardcoded default.
+ *
+ * @returns HMAC signing key.
+ * @throws {EnvironmentMismatchError} When `SESSION_SECRET` is missing in production.
+ */
+function getSessionSigningKey(): string {
+    if (resolvedSessionSigningKey !== null) {
+        return resolvedSessionSigningKey;
+    }
+
+    const configuredSecret = process.env.SESSION_SECRET?.trim();
+    if (configuredSecret) {
+        resolvedSessionSigningKey = configuredSecret;
+        return resolvedSessionSigningKey;
+    }
+
+    if (process.env.NODE_ENV === 'production') {
+        throw new EnvironmentMismatchError(
+            spaceTrim(`
+                Missing required \`SESSION_SECRET\` environment variable in production.
+
+                The Agents Server signs session cookies with HMAC-SHA256 keyed by
+                \`SESSION_SECRET\`. Reusing \`ADMIN_PASSWORD\` or a hardcoded fallback
+                would let anyone who learns that value forge session tokens for any
+                user (including \`admin\`).
+
+                **Fix:** set \`SESSION_SECRET\` to a long random string (for example
+                the output of \`openssl rand -hex 32\`) in the deployment environment
+                and restart the server.
+            `),
+        );
+    }
+
+    resolvedSessionSigningKey = randomBytes(32).toString('hex');
+    console.warn(
+        spaceTrim(`
+            \`SESSION_SECRET\` is not configured — generated a random per-process
+            signing key for this non-production run. Existing session cookies will
+            be invalidated on every restart until \`SESSION_SECRET\` is set.
+        `),
+    );
+    return resolvedSessionSigningKey;
+}
 
 /**
  * Signed session payload persisted in the authentication cookie.
@@ -74,7 +131,7 @@ export type SessionCookieSecurityContext = {
  */
 export function serializeSessionToken(user: SessionUser): string {
     const payload = JSON.stringify(user);
-    const signature = createHmac('sha256', SECRET_KEY).update(payload).digest('hex');
+    const signature = createHmac('sha256', getSessionSigningKey()).update(payload).digest('hex');
     return `${Buffer.from(payload).toString('base64')}.${signature}`;
 }
 
@@ -95,9 +152,9 @@ export function parseSessionToken(token: string | null | undefined): SessionUser
     }
 
     const payload = Buffer.from(payloadBase64, 'base64').toString('utf-8');
-    const expectedSignature = createHmac('sha256', SECRET_KEY).update(payload).digest('hex');
+    const expectedSignature = createHmac('sha256', getSessionSigningKey()).update(payload).digest('hex');
 
-    if (signature !== expectedSignature) {
+    if (!isTimingSafeEqualString(signature, expectedSignature)) {
         return null;
     }
 
@@ -162,17 +219,9 @@ export function shouldUseSecureSessionCookieForRequest(context: SessionCookieSec
  */
 export async function setSession(user: SessionUser) {
     const token = serializeSessionToken(user);
-    const headerStore = await headers();
-    const cookieStore = await cookies();
-    const secure = shouldUseSecureSessionCookieForHeaders(headerStore);
+    const secure = await shouldUseSecureSessionCookie();
 
-    writeShibbolethAuthenticationLog(headerStore, {
-        event: 'session-set',
-        hasSessionCookie: cookieStore.has(SESSION_COOKIE_NAME),
-        isSecureSessionCookie: secure,
-    });
-
-    cookieStore.set(SESSION_COOKIE_NAME, token, {
+    (await cookies()).set(SESSION_COOKIE_NAME, token, {
         httpOnly: true,
         secure,
         path: '/',
@@ -184,17 +233,9 @@ export async function setSession(user: SessionUser) {
  * Clears the current authenticated session cookie.
  */
 export async function clearSession() {
-    const headerStore = await headers();
-    const cookieStore = await cookies();
-
-    writeShibbolethAuthenticationLog(headerStore, {
-        event: 'session-cleared',
-        hasSessionCookie: cookieStore.has(SESSION_COOKIE_NAME),
-    });
-
-    cookieStore.delete(SESSION_COOKIE_NAME);
+    (await cookies()).delete(SESSION_COOKIE_NAME);
     // Also clear legacy adminToken
-    cookieStore.delete('adminToken');
+    (await cookies()).delete('adminToken');
 }
 
 /**
@@ -217,12 +258,13 @@ export async function getSession(): Promise<SessionUser | null> {
 }
 
 /**
- * Resolves the runtime cookie security decision from one request header snapshot.
+ * Resolves the runtime cookie security decision from the current request headers.
  *
- * @param headerStore - Request headers from the active request.
  * @returns `true` when the session cookie should keep the `Secure` flag.
  */
-function shouldUseSecureSessionCookieForHeaders(headerStore: Pick<Headers, 'get'>): boolean {
+async function shouldUseSecureSessionCookie(): Promise<boolean> {
+    const headerStore = await headers();
+
     return shouldUseSecureSessionCookieForRequest({
         isProduction: process.env.NODE_ENV === 'production',
         host: headerStore.get('host'),

package/apps/agents-server/src/utils/shareTargetPayloads.ts

@@ -2,12 +2,17 @@ import { $getTableName } from '@/src/database/$getTableName';
 import { $provideSupabaseForServer } from '@/src/database/$provideSupabaseForServer';
 import type { Json } from '@/src/database/schema';
 import { FILE_SECURITY_CHECKERS } from '@/src/file-security-checkers';
+import {
+    $provideCdnForServer,
+    isSelfContainedS3StorageSelected,
+    resolveCdnPublicUrlForServer,
+} from '@/src/tools/$provideCdnForServer';
 import { $provideServer } from '@/src/tools/$provideServer';
 import { getUserFileCdnKey } from '@/src/utils/cdn/utils/getUserFileCdnKey';
+import { resolveFileUploadAvailability } from '@/src/utils/upload/fileUploadAvailability';
 import { validateMimeType } from '@/src/utils/validators/validateMimeType';
 import { normalizeChatAttachments } from '@promptbook-local/core';
 import type { TODO_any } from '@promptbook-local/types';
-import { put } from '@vercel/blob';
 import { after } from 'next/server';
 import { spaceTrim } from 'spacetrim';
 import { DatabaseError } from '../../../../src/errors/DatabaseError';
@@ -231,12 +236,27 @@ async function createShareTargetAttachment(file: File, maxFileUploadBytes: numbe
 
     const mimeType = resolveShareTargetMimeType(file.type);
     const blobPath = getUserFileCdnKey(buffer, normalizedFilename);
-    const uploadedBlob = await put(blobPath, buffer, {
-        access: 'public',
-        addRandomSuffix: false,
-        allowOverwrite: true,
-        contentType: mimeType,
-        token: process.env.VERCEL_BLOB_READ_WRITE_TOKEN!,
+    const providedServer = await $provideServer();
+    const fileUploadAvailability = resolveFileUploadAvailability({
+        serverId: providedServer.id,
+        serverPublicUrl: providedServer.publicUrl,
+        isSelfContainedS3StorageSelected: isSelfContainedS3StorageSelected(),
+    });
+
+    if (!fileUploadAvailability.isUploadAvailable) {
+        throw new NotAllowed(fileUploadAvailability.message || 'File uploads are not available for this server.');
+    }
+
+    const cdn = $provideCdnForServer({
+        cdnPublicUrl: resolveCdnPublicUrlForServer(providedServer.publicUrl),
+    });
+    const storageUrl = cdn.getItemUrl(blobPath).href;
+
+    await cdn.setItem(blobPath, {
+        type: mimeType,
+        data: buffer,
+        purpose: SHARE_TARGET_FILE_PURPOSE,
+        fileSize: buffer.byteLength,
     }).catch((error) => {
         throw new DatabaseError(
             spaceTrim(`
@@ -246,75 +266,26 @@ async function createShareTargetAttachment(file: File, maxFileUploadBytes: numbe
             `),
         );
     });
-    const fileRecordId = await insertShareTargetFileRecord({
-        fileName: normalizedFilename,
-        fileSize: buffer.byteLength,
-        fileType: mimeType,
-        storageUrl: uploadedBlob.url,
-    });
 
-    if (fileRecordId !== null) {
-        after(() =>
-            populateShareTargetFileSecurityResult({
-                fileId: fileRecordId,
-                storageUrl: uploadedBlob.url,
-            }).catch((error) => {
-                console.error('[share-target] Failed to finalize file security result', error);
-            }),
-        );
-    }
+    after(() =>
+        populateShareTargetFileSecurityResult({
+            storageUrl,
+        }).catch((error) => {
+            console.error('[share-target] Failed to finalize file security result', error);
+        }),
+    );
 
     return {
         name: normalizedFilename,
         type: mimeType,
-        url: uploadedBlob.url,
+        url: storageUrl,
     };
 }
 
-/**
- * Inserts one admin-visible file row for a shared attachment.
- */
-async function insertShareTargetFileRecord(options: {
-    fileName: string;
-    fileSize: number;
-    fileType: string;
-    storageUrl: string;
-}): Promise<number | null> {
-    try {
-        const supabase = $provideSupabaseForServer() as TODO_any;
-        const fileTableName = await $getTableName('File');
-        const { data, error } = await supabase
-            .from(fileTableName)
-            .insert({
-                fileName: options.fileName,
-                fileSize: options.fileSize,
-                fileType: options.fileType,
-                storageUrl: options.storageUrl,
-                shortUrl: null,
-                purpose: SHARE_TARGET_FILE_PURPOSE,
-                status: 'COMPLETED',
-                agentId: null,
-                securityResult: null,
-            })
-            .select('id')
-            .maybeSingle();
-
-        if (error) {
-            console.error('[share-target] Failed to store uploaded file metadata', error);
-            return null;
-        }
-
-        return typeof data?.id === 'number' ? data.id : null;
-    } catch (error) {
-        console.error('[share-target] Failed to insert shared file metadata', error);
-        return null;
-    }
-}
-
 /**
  * Populates best-effort file-security results after the share redirect has already returned.
  */
-async function populateShareTargetFileSecurityResult(options: { fileId: number; storageUrl: string }): Promise<void> {
+async function populateShareTargetFileSecurityResult(options: { storageUrl: string }): Promise<void> {
     const securityResult: Record<string, unknown> = {};
 
     for (const checkerId of Object.keys(FILE_SECURITY_CHECKERS)) {
@@ -342,7 +313,7 @@ async function populateShareTargetFileSecurityResult(options: { fileId: number;
         .update({
             securityResult,
         })
-        .eq('id', options.fileId);
+        .eq('storageUrl', options.storageUrl);
 
     if (error) {
         throw new DatabaseError(