@promptbook/cli 0.112.0-99 → 0.113.0-0

package/src/commitments/META_VISIBILITY/META_VISIBILITY.ts

@@ -0,0 +1,78 @@
+import { spaceTrim } from 'spacetrim';
+import type { AgentModelRequirements } from '../../book-2.0/agent-source/AgentModelRequirements';
+import { TODO_USE } from '../../utils/organization/TODO_USE';
+import { BaseCommitmentDefinition } from '../_base/BaseCommitmentDefinition';
+
+/**
+ * META VISIBILITY commitment definition.
+ *
+ * The `META VISIBILITY` commitment stores whether an agent is public, private, or unlisted.
+ * Agents Server mirrors this value into the database for efficient filtering, but the book
+ * commitment remains the editable source of truth.
+ *
+ * @private Metadata-only commitment used by Agents Server.
+ */
+export class MetaVisibilityCommitmentDefinition extends BaseCommitmentDefinition<'META VISIBILITY'> {
+    public constructor() {
+        super('META VISIBILITY');
+    }
+
+    /**
+     * Short one-line description of META VISIBILITY.
+     */
+    get description(): string {
+        return 'Set whether the agent is private, unlisted, or public.';
+    }
+
+    /**
+     * Icon for this commitment.
+     */
+    get icon(): string {
+        return '👁️';
+    }
+
+    /**
+     * Markdown documentation for META VISIBILITY commitment.
+     */
+    get documentation(): string {
+        return spaceTrim(`
+            # META VISIBILITY
+
+            Sets the agent visibility used by Agents Server.
+
+            ## Allowed values
+
+            - \`PRIVATE\` - accessible only to signed-in users with access.
+            - \`UNLISTED\` - accessible by direct link but hidden from public listings.
+            - \`PUBLIC\` - visible in public listings and accessible by anyone.
+
+            ## Key aspects
+
+            - Does not modify the agent's behavior, system message, or tools.
+            - Whitespace and letter case are normalized when persisted.
+            - If multiple \`META VISIBILITY\` commitments are present, persistence keeps one normalized value.
+            - Agents Server mirrors the value into the database for filtering, but the book is the source of truth.
+
+            ## Example
+
+            \`\`\`book
+            Helpful Assistant
+
+            GOAL Be helpful and friendly.
+            META VISIBILITY PUBLIC
+            \`\`\`
+        `);
+    }
+
+    public applyToAgentModelRequirements(
+        requirements: AgentModelRequirements,
+        content: string,
+    ): AgentModelRequirements {
+        TODO_USE(content);
+
+        // META VISIBILITY is metadata only and does not alter model requirements.
+        return requirements;
+    }
+}
+
+// Note: [💞] Ignore a discrepancy between file name and entity name

package/src/commitments/TEAM/TEAM.ts

@@ -448,7 +448,18 @@ function buildTeammateMetadata(entry: TeamToolEntry): TeamToolResult['teammate']
  * Builds the teammate request text, optionally including context.
  */
 function buildTeammateRequest(message: string, context?: string): string {
-    return context ? `${message}\n\nContext:\n${context}` : message;
+    if (!context) {
+        return message;
+    }
+
+    return spaceTrim(
+        (block) => `
+            ${block(message)}
+
+            Context:
+            ${block(context)}
+        `,
+    );
 }
 
 /**

package/src/commitments/USE_PROJECT/createUseProjectToolFunctions.ts

@@ -1,3 +1,4 @@
+import { spaceTrim } from 'spacetrim';
 import type { ToolFunction } from '../../scripting/javascript/JavascriptExecutionToolsOptions';
 import type { string_javascript_name } from '../../types/string_person_fullname';
 import { decodeAttachmentAsText, DEFAULT_ATTACHMENT_TEXT_DECODE_BYTES } from '../../utils/files/decodeAttachmentAsText';
@@ -197,7 +198,13 @@ export function createUseProjectToolFunctions(): Record<string_javascript_name,
                 const lineRangedContent = applyOptionalLineRange(decodedContent, args.startLine, args.endLine);
                 const wasCharacterTruncated = lineRangedContent.length > MAX_PROJECT_FILE_CONTENT_CHARACTERS;
                 const contentToReturn = wasCharacterTruncated
-                    ? `${lineRangedContent.slice(0, MAX_PROJECT_FILE_CONTENT_CHARACTERS)}\n\n[...truncated...]`
+                    ? spaceTrim(
+                          (block) => `
+                              ${block(lineRangedContent.slice(0, MAX_PROJECT_FILE_CONTENT_CHARACTERS))}
+
+                              [...truncated...]
+                          `,
+                      )
                     : lineRangedContent;
 
                 const wasTruncated = decoded.isTruncated || wasCharacterTruncated;

package/src/commitments/_common/teamInternalAgentAccess.ts

@@ -1,4 +1,5 @@
-import { SHA256 as sha256 } from 'crypto-js';
+import CryptoJS from 'crypto-js';
+import { isTimingSafeEqualString } from '../../utils/isTimingSafeEqualString';
 
 /**
  * Header used for same-server TEAM calls that may access private teammate agents.
@@ -30,21 +31,26 @@ export type TeamInternalAgentAccessHeadersOptions = {
 /**
  * Resolves the internal token used by same-server TEAM calls.
  *
- * @returns Hashed token, or `null` when the server does not have a private secret.
+ * `PROMPTBOOK_TEAM_AGENT_ACCESS_TOKEN` must be a dedicated secret — falling
+ * back to `ADMIN_PASSWORD`, `SUPABASE_SERVICE_ROLE_KEY`, or any other shared
+ * credential would let a leak of one secret compromise both authentication
+ * boundaries (admin login and same-server teammate-agent access). When the
+ * dedicated variable is missing, this function returns `null` so the calling
+ * server fails closed — same-server TEAM access is disabled and no header is
+ * sent — instead of silently authorizing requests with the wrong secret.
+ *
+ * @returns Hashed token, or `null` when the dedicated secret is not configured.
  *
  * @private internal Agents Server access wiring
  */
 export function resolveTeamInternalAgentAccessToken(): string | null {
-    const secret =
-        normalizeSecret(readEnvironmentVariable('PROMPTBOOK_TEAM_AGENT_ACCESS_TOKEN')) ||
-        normalizeSecret(readEnvironmentVariable('SUPABASE_SERVICE_ROLE_KEY')) ||
-        normalizeSecret(readEnvironmentVariable('ADMIN_PASSWORD'));
+    const secret = normalizeSecret(readEnvironmentVariable('PROMPTBOOK_TEAM_AGENT_ACCESS_TOKEN'));
 
     if (!secret) {
         return null;
     }
 
-    return sha256(`promptbook-team-agent-access:${secret}`).toString();
+    return CryptoJS.SHA256(`promptbook-team-agent-access:${secret}`).toString();
 }
 
 /**
@@ -79,7 +85,7 @@ export function isTeamInternalAgentAccessToken(value: string | null | undefined)
     const expectedToken = resolveTeamInternalAgentAccessToken();
     const providedToken = normalizeSecret(value);
 
-    return Boolean(expectedToken && providedToken && providedToken === expectedToken);
+    return Boolean(expectedToken && providedToken && isTimingSafeEqualString(providedToken, expectedToken));
 }
 
 /**

package/src/commitments/index.ts

@@ -28,6 +28,7 @@ import { MetaFontCommitmentDefinition } from './META_FONT/META_FONT';
 import { MetaImageCommitmentDefinition } from './META_IMAGE/META_IMAGE';
 import { MetaInputPlaceholderCommitmentDefinition } from './META_INPUT_PLACEHOLDER/META_INPUT_PLACEHOLDER';
 import { MetaLinkCommitmentDefinition } from './META_LINK/META_LINK';
+import { MetaVisibilityCommitmentDefinition } from './META_VISIBILITY/META_VISIBILITY';
 import { MetaVoiceCommitmentDefinition } from './META_VOICE/META_VOICE';
 import { ModelCommitmentDefinition } from './MODEL/MODEL';
 import { NoteCommitmentDefinition } from './NOTE/NOTE';
@@ -102,6 +103,7 @@ export const COMMITMENT_REGISTRY = [
     new MetaDomainCommitmentDefinition(),
     new MetaDisclaimerCommitmentDefinition(),
     new MetaInputPlaceholderCommitmentDefinition(),
+    new MetaVisibilityCommitmentDefinition(),
     new MetaCommitmentDefinition(),
     new MetaVoiceCommitmentDefinition(),
     new NoteCommitmentDefinition('NOTE'),

package/src/execution/createPipelineExecutor/getKnowledgeForTask.ts

@@ -4,7 +4,7 @@ import { getSingleLlmExecutionTools } from '../../llm-providers/_multiple/getSin
 import type { PipelineJson } from '../../pipeline/PipelineJson/PipelineJson';
 import type { TaskJson } from '../../pipeline/PipelineJson/TaskJson';
 import type { Parameters } from '../../types/Parameters';
-import { Prompt } from '../../types/Prompt';
+import type { Prompt } from '../../types/Prompt';
 import type { string_markdown } from '../../types/string_markdown';
 import type { string_parameter_value } from '../../types/string_name';
 import type { ExecutionTools } from '../ExecutionTools';

package/src/formats/csv/CsvFormatParser.ts

@@ -1,4 +1,4 @@
-import { unparse } from 'papaparse';
+import papaparse from 'papaparse';
 import { spaceTrim } from 'spacetrim';
 import type { TODO_any } from '../../utils/organization/TODO_any';
 import { TODO_USE } from '../../utils/organization/TODO_USE';
@@ -102,11 +102,11 @@ export const CsvFormatParser: FormatParser<
                             i > index ? { ...row, [outputParameterName]: PENDING_VALUE_PLACEHOLDER } : row,
                         );
                         */
-                        await onProgress(unparse(mappedData, { ...settings, ...MANDATORY_CSV_SETTINGS }));
+                        await onProgress(papaparse.unparse(mappedData, { ...settings, ...MANDATORY_CSV_SETTINGS }));
                     }
                 }
 
-                return unparse(mappedData, { ...settings, ...MANDATORY_CSV_SETTINGS });
+                return papaparse.unparse(mappedData, { ...settings, ...MANDATORY_CSV_SETTINGS });
             },
         },
         {
@@ -149,7 +149,7 @@ export const CsvFormatParser: FormatParser<
                     }),
                 );
 
-                return unparse(mappedData, { ...settings, ...MANDATORY_CSV_SETTINGS });
+                return papaparse.unparse(mappedData, { ...settings, ...MANDATORY_CSV_SETTINGS });
             },
         },
     ],

package/src/formats/csv/utils/csvParse.ts

@@ -1,5 +1,5 @@
 import type { ParseResult } from 'papaparse';
-import { parse } from 'papaparse';
+import papaparse from 'papaparse';
 import type { Parameters } from '../../../types/Parameters';
 import type { TODO_any } from '../../../utils/organization/TODO_any';
 import { TODO_USE } from '../../../utils/organization/TODO_USE';
@@ -31,6 +31,6 @@ export function csvParse(
         value = value.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
     }
 
-    const csv = parse<Parameters>(value, settings);
+    const csv = papaparse.parse<Parameters>(value, settings);
     return csv;
 }

package/src/import-plugins/JsonFileImportPlugin.ts

@@ -1,3 +1,4 @@
+import { spaceTrim } from 'spacetrim';
 import type { FileImportPlugin } from './FileImportPlugin';
 
 /**
@@ -14,10 +15,22 @@ export const JsonFileImportPlugin: FileImportPlugin = {
         try {
             const json = JSON.parse(content);
             const formattedJson = JSON.stringify(json, null, 4);
-            return `\`\`\`json\n${formattedJson}\n\`\`\``;
+            return spaceTrim(
+                (block) => `
+                    \`\`\`json
+                    ${block(formattedJson)}
+                    \`\`\`
+                `,
+            );
         } catch (error) {
             // If JSON is invalid, still import it but maybe not as pretty JSON
-            return `\`\`\`json\n${content}\n\`\`\``;
+            return spaceTrim(
+                (block) => `
+                    \`\`\`json
+                    ${block(content)}
+                    \`\`\`
+                `,
+            );
         }
     },
 };

package/src/import-plugins/TextFileImportPlugin.ts

@@ -1,3 +1,4 @@
+import { spaceTrim } from 'spacetrim';
 import { mimeTypeToExtension } from '../utils/files/mimeTypeToExtension';
 import type { FileImportPlugin } from './FileImportPlugin';
 
@@ -23,6 +24,12 @@ export const TextFileImportPlugin: FileImportPlugin = {
         const extension = mimeTypeToExtension(mimeType);
         const codeBlockType = extension || 'txt';
 
-        return `\`\`\`${codeBlockType}\n${content}\n\`\`\``;
+        return spaceTrim(
+            (block) => `
+                \`\`\`${codeBlockType}
+                ${block(content)}
+                \`\`\`
+            `,
+        );
     },
 };

package/src/llm-providers/_common/register/$provideLlmToolsConfigurationFromEnv.ts

@@ -13,7 +13,7 @@ import type { LlmToolsConfiguration } from './LlmToolsConfiguration';
  *
  * It looks for environment variables:
  * - `process.env.OPENAI_API_KEY`
- * - `process.env.ANTHROPIC_CLAUDE_API_KEY`
+ * - `process.env.ANTHROPIC_API_KEY` (or the deprecated `process.env.ANTHROPIC_CLAUDE_API_KEY`)
  * - ...
  *
  * @see Environment variables documentation or .env file for required variables.

package/src/llm-providers/_common/register/$provideLlmToolsFromEnv.ts

@@ -22,7 +22,7 @@ import { createLlmToolsFromConfiguration } from './createLlmToolsFromConfigurati
  *
  * It looks for environment variables:
  * - `process.env.OPENAI_API_KEY`
- * - `process.env.ANTHROPIC_CLAUDE_API_KEY`
+ * - `process.env.ANTHROPIC_API_KEY` (or the deprecated `process.env.ANTHROPIC_CLAUDE_API_KEY`)
  * - ...
  *
  * @param options Configuration options for the LLM tools

package/src/llm-providers/_common/register/$registeredLlmToolsMessage.ts

@@ -589,7 +589,12 @@ function colorizeAvailableProviderMessage(
  * @private internal function of `$registeredLlmToolsMessage`
  */
 function createUsedEnvMessage(): string {
-    return $usedEnvFilename === null ? `Unknown \`.env\` file` : `Used \`.env\` file:\n${$usedEnvFilename}`;
+    return $usedEnvFilename === null
+        ? `Unknown \`.env\` file`
+        : spaceTrim(`
+              Used \`.env\` file:
+              ${$usedEnvFilename}
+          `);
 }
 
 // TODO: [®] DRY Register logic

package/src/llm-providers/agent/AgentLlmExecutionTools.ts

@@ -1,4 +1,4 @@
-import { SHA256 as sha256 } from 'crypto-js';
+import CryptoJS from 'crypto-js';
 import hexEncoder from 'crypto-js/enc-hex';
 import type { Promisable } from 'type-fest';
 import type { AgentModelRequirements } from '../../book-2.0/agent-source/AgentModelRequirements';
@@ -230,7 +230,7 @@ export class AgentLlmExecutionTools implements LlmExecutionTools {
      * Returns a virtual model name representing the agent behavior.
      */
     public get modelName(): string_model_name {
-        const hash = sha256(hexEncoder.parse(this.options.agentSource)).toString(/* hex */);
+        const hash = CryptoJS.SHA256(hexEncoder.parse(this.options.agentSource)).toString(/* hex */);
         const agentId = hash.substring(0, 10);
 
         return (normalizeToKebabCase(this.title) + '-' + agentId) as string_model_name;

package/src/llm-providers/agent/AgentLlmExecutionToolsAgentKitRunner.ts

@@ -1,4 +1,4 @@
-import { SHA256 as sha256 } from 'crypto-js';
+import CryptoJS from 'crypto-js';
 import type { CallChatModelStreamOptions } from '../../execution/LlmExecutionTools';
 import type { ChatPromptResult, CommonPromptResult } from '../../execution/PromptResult';
 import type { Prompt } from '../../types/Prompt';
@@ -29,7 +29,7 @@ type AgentKitCacheState = {
  * Computes one stable hash from a JSON-serializable value.
  */
 function computeJsonHash(value: unknown): string {
-    return sha256(JSON.stringify(value)).toString();
+    return CryptoJS.SHA256(JSON.stringify(value)).toString();
 }
 
 /**

package/src/llm-providers/agent/AgentLlmExecutionToolsOpenAiAssistantRunner.ts

@@ -1,4 +1,4 @@
-import { SHA256 as sha256 } from 'crypto-js';
+import CryptoJS from 'crypto-js';
 import type { CallChatModelStreamOptions } from '../../execution/LlmExecutionTools';
 import type { ChatPromptResult, CommonPromptResult } from '../../execution/PromptResult';
 import type { ChatPrompt, Prompt } from '../../types/Prompt';
@@ -12,7 +12,7 @@ import { emitAgentLlmExecutionToolsAssistantPreparationProgress } from './emitAg
  * Computes one stable hash from a JSON-serializable value.
  */
 function computeJsonHash(value: unknown): string {
-    return sha256(JSON.stringify(value)).toString();
+    return CryptoJS.SHA256(JSON.stringify(value)).toString();
 }
 
 /**

package/src/llm-providers/anthropic-claude/register-configuration.ts

@@ -19,7 +19,7 @@ export const _AnthropicClaudeMetadataRegistration: Registration = $llmToolsMetad
     title: 'Anthropic Claude',
     packageName: '@promptbook/anthropic-claude',
     className: 'AnthropicClaudeExecutionTools',
-    envVariables: ['ANTHROPIC_CLAUDE_API_KEY'],
+    envVariables: ['ANTHROPIC_API_KEY', 'ANTHROPIC_CLAUDE_API_KEY'],
     trustLevel: 'CLOSED',
     order: MODEL_ORDERS.TOP_TIER,
 
@@ -39,13 +39,16 @@ export const _AnthropicClaudeMetadataRegistration: Registration = $llmToolsMetad
 
     createConfigurationFromEnv(env: Record<string_name, string>): LlmToolsConfiguration[number] | null {
         // Note: Note using `process.env` BUT `env` to pass in the environment variables dynamically
-        if (typeof env.ANTHROPIC_CLAUDE_API_KEY === 'string') {
+        // Note: `ANTHROPIC_API_KEY` takes precedence over the deprecated `ANTHROPIC_CLAUDE_API_KEY`
+        const apiKey = env.ANTHROPIC_API_KEY ?? env.ANTHROPIC_CLAUDE_API_KEY;
+
+        if (typeof apiKey === 'string') {
             return {
                 title: 'Claude (from env)',
                 packageName: '@promptbook/anthropic-claude',
                 className: 'AnthropicClaudeExecutionTools',
                 options: {
-                    apiKey: env.ANTHROPIC_CLAUDE_API_KEY!,
+                    apiKey,
                 } satisfies AnthropicClaudeExecutionToolsOptions,
             };
         }

package/src/llm-providers/openai/OpenAiAgentKitExecutionToolsToolBuilder.ts

@@ -449,7 +449,9 @@ export class OpenAiAgentKitExecutionToolsToolBuilder {
             );
         }
 
-        return Array.isArray(executionTools.script) ? executionTools.script : [executionTools.script];
+        return Array.isArray(executionTools.script)
+            ? executionTools.script
+            : [executionTools.script as ScriptExecutionTools];
     }
 
     /**

package/src/llm-providers/openai/OpenAiAssistantExecutionToolsToolRunner.ts

@@ -436,7 +436,7 @@ export class OpenAiAssistantExecutionToolsToolRunner {
 
         return Array.isArray(this.options.scriptExecutionTools)
             ? this.options.scriptExecutionTools
-            : [this.options.scriptExecutionTools];
+            : [this.options.scriptExecutionTools as ScriptExecutionTools];
     }
 
     /**

package/src/llm-providers/openai/OpenAiVectorStoreKnowledgeSourcePreparer.ts

@@ -134,7 +134,7 @@ export class OpenAiVectorStoreKnowledgeSourcePreparer {
             }
 
             return {
-                file: new File([parsed.buffer], parsed.filename, {
+                file: new File([new Uint8Array(parsed.buffer)], parsed.filename, {
                     type: parsed.mimeType,
                 }),
                 sizeBytes: parsed.buffer.length,