@promptbook/cli 0.113.0-1 → 0.113.0-11

package/apps/agents-server/src/app/api/admin/update/route.ts

@@ -1,6 +1,11 @@
 import { NextResponse } from 'next/server';
 import { isUserGlobalAdmin } from '@/src/utils/isUserGlobalAdmin';
-import { readVpsSelfUpdateOverview, startVpsSelfUpdate } from '@/src/utils/vpsSelfUpdate';
+import {
+    readVpsSelfUpdateOverview,
+    rescheduleAutomaticVpsSelfUpdateScheduler,
+    startVpsSelfUpdate,
+    updateVpsSelfUpdateAutomaticConfiguration,
+} from '@/src/utils/vpsSelfUpdate';
 
 export const runtime = 'nodejs';
 export const dynamic = 'force-dynamic';
@@ -32,13 +37,11 @@ export async function POST(request: Request) {
     }
 
     try {
-        const body = (await request.json().catch(() => null)) as
-            | {
-                  readonly environment?: string;
-                  readonly customRef?: string | null;
-                  readonly originRepositoryUrl?: string | null;
-              }
-            | null;
+        const body = (await request.json().catch(() => null)) as {
+            readonly environment?: string;
+            readonly customRef?: string | null;
+            readonly originRepositoryUrl?: string | null;
+        } | null;
 
         if (!body?.environment || typeof body.environment !== 'string') {
             return NextResponse.json({ error: 'Update environment is required.' }, { status: 400 });
@@ -48,6 +51,7 @@ export async function POST(request: Request) {
             environmentId: body.environment,
             customRef: body.customRef ?? null,
             originRepositoryUrl: body.originRepositoryUrl ?? null,
+            trigger: 'manual',
         });
 
         return NextResponse.json(overview, { status: 202 });
@@ -58,3 +62,46 @@ export async function POST(request: Request) {
         );
     }
 }
+
+/**
+ * Persists automatic standalone VPS self-update configuration.
+ */
+export async function PATCH(request: Request) {
+    if (!(await isUserGlobalAdmin())) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    try {
+        const body = (await request.json().catch(() => null)) as {
+            readonly automaticConfiguration?: {
+                readonly isEnabled?: boolean;
+                readonly environment?: string;
+                readonly cronExpression?: string;
+            };
+        } | null;
+        const automaticConfiguration = body?.automaticConfiguration;
+
+        if (
+            !automaticConfiguration ||
+            typeof automaticConfiguration.isEnabled !== 'boolean' ||
+            typeof automaticConfiguration.environment !== 'string' ||
+            typeof automaticConfiguration.cronExpression !== 'string'
+        ) {
+            return NextResponse.json({ error: 'Automatic self-update configuration is required.' }, { status: 400 });
+        }
+
+        await updateVpsSelfUpdateAutomaticConfiguration({
+            isEnabled: automaticConfiguration.isEnabled,
+            environmentId: automaticConfiguration.environment,
+            cronExpression: automaticConfiguration.cronExpression,
+        });
+        rescheduleAutomaticVpsSelfUpdateScheduler();
+
+        return NextResponse.json(await readVpsSelfUpdateOverview());
+    } catch (error) {
+        return NextResponse.json(
+            { error: error instanceof Error ? error.message : 'Failed to save automatic update configuration.' },
+            { status: 500 },
+        );
+    }
+}

package/apps/agents-server/src/app/api/admin/update/versions/route.ts

@@ -0,0 +1,34 @@
+import { NextResponse } from 'next/server';
+import { isUserGlobalAdmin } from '@/src/utils/isUserGlobalAdmin';
+import { deleteVpsSelfUpdateInstalledVersion, readVpsSelfUpdateOverview } from '@/src/utils/vpsSelfUpdate';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+/**
+ * Deletes one old installed Agents Server version from the standalone VPS releases directory.
+ */
+export async function DELETE(request: Request) {
+    if (!(await isUserGlobalAdmin())) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    try {
+        const body = (await request.json().catch(() => null)) as {
+            readonly versionName?: string;
+        } | null;
+
+        if (!body?.versionName || typeof body.versionName !== 'string') {
+            return NextResponse.json({ error: 'Version name is required.' }, { status: 400 });
+        }
+
+        await deleteVpsSelfUpdateInstalledVersion(body.versionName);
+
+        return NextResponse.json(await readVpsSelfUpdateOverview());
+    } catch (error) {
+        return NextResponse.json(
+            { error: error instanceof Error ? error.message : 'Failed to delete the installed version.' },
+            { status: 500 },
+        );
+    }
+}

package/apps/agents-server/src/app/api/auth/shibboleth/acs/route.ts

@@ -6,6 +6,7 @@ import {
     getShibbolethRequestDetails,
     recordShibbolethAuthenticationAttempt,
     resolveShibbolethAuthenticationConfiguration,
+    resolveShibbolethPublicRequestUrl,
     sanitizeShibbolethRelayState,
 } from '../../../../../utils/shibbolethAuthentication';
 import { setSession } from '../../../../../utils/session';
@@ -15,6 +16,7 @@ import { setSession } from '../../../../../utils/session';
  */
 export async function POST(request: Request) {
     const requestDetails = getShibbolethRequestDetails(request);
+    const publicRequestUrl = resolveShibbolethPublicRequestUrl(request);
     let relayState = '/';
 
     try {
@@ -34,7 +36,7 @@ export async function POST(request: Request) {
         }
 
         const configuration = await resolveShibbolethAuthenticationConfiguration({
-            requestUrl: request.url,
+            requestUrl: publicRequestUrl,
             isIdentityProviderMetadataValidationEnabled: true,
         });
 
@@ -95,7 +97,7 @@ export async function POST(request: Request) {
             rawAttributes: linkedUser.profileAttributes.rawAttributes,
         });
 
-        return NextResponse.redirect(new URL(relayState, request.url), 303);
+        return NextResponse.redirect(new URL(relayState, configuration.serviceProviderUrls.origin), 303);
     } catch (error) {
         const errorMessage = error instanceof Error ? error.message : 'Failed to finish Shibboleth authentication.';
         await recordShibbolethAuthenticationAttempt({

package/apps/agents-server/src/app/api/auth/shibboleth/login/route.ts

@@ -4,6 +4,7 @@ import {
     getShibbolethRequestDetails,
     recordShibbolethAuthenticationAttempt,
     resolveShibbolethAuthenticationConfiguration,
+    resolveShibbolethPublicRequestUrl,
     sanitizeShibbolethRelayState,
 } from '../../../../../utils/shibbolethAuthentication';
 
@@ -12,11 +13,12 @@ import {
  */
 export async function GET(request: Request) {
     const requestDetails = getShibbolethRequestDetails(request);
+    const publicRequestUrl = resolveShibbolethPublicRequestUrl(request);
     const relayState = sanitizeShibbolethRelayState(new URL(request.url).searchParams.get('returnTo'));
 
     try {
         const configuration = await resolveShibbolethAuthenticationConfiguration({
-            requestUrl: request.url,
+            requestUrl: publicRequestUrl,
             isIdentityProviderMetadataValidationEnabled: true,
         });
 

package/apps/agents-server/src/app/api/auth/shibboleth/metadata/route.ts

@@ -1,11 +1,14 @@
 import { NextResponse } from 'next/server';
-import { createShibbolethServiceProviderMetadataXml } from '../../../../../utils/shibbolethAuthentication';
+import {
+    createShibbolethServiceProviderMetadataXml,
+    resolveShibbolethPublicRequestUrl,
+} from '../../../../../utils/shibbolethAuthentication';
 
 /**
  * Handles get.
  */
 export async function GET(request: Request) {
-    const metadataXml = await createShibbolethServiceProviderMetadataXml(request.url);
+    const metadataXml = await createShibbolethServiceProviderMetadataXml(resolveShibbolethPublicRequestUrl(request));
 
     return new NextResponse(metadataXml, {
         headers: {

package/apps/agents-server/src/app/api/auth/shibboleth/status/route.ts

@@ -1,12 +1,15 @@
 import { NextResponse } from 'next/server';
-import { resolveShibbolethAuthenticationConfiguration } from '../../../../../utils/shibbolethAuthentication';
+import {
+    resolveShibbolethAuthenticationConfiguration,
+    resolveShibbolethPublicRequestUrl,
+} from '../../../../../utils/shibbolethAuthentication';
 
 /**
  * Handles get.
  */
 export async function GET(request: Request) {
     const configuration = await resolveShibbolethAuthenticationConfiguration({
-        requestUrl: request.url,
+        requestUrl: resolveShibbolethPublicRequestUrl(request),
         isIdentityProviderMetadataValidationEnabled: false,
     });
 

package/apps/agents-server/src/app/api/page-preview/check/route.ts

@@ -1,8 +1,9 @@
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
 import { assertsError } from '../../../../../../../src/errors/assertsError';
+import { assertSafeUrl } from '../../../../utils/assertSafeUrl';
+import { getCurrentUser } from '../../../../utils/getCurrentUser';
 import { checkIfUrlCanBeEmbedded } from '../../../../utils/iframe/checkIfUrlCanBeEmbedded';
-import { resolvePagePreviewRequestUrl } from '../../../../utils/pagePreview/resolvePagePreviewRequestUrl';
 
 /**
  * Checks whether a given URL can be embedded in an iframe by inspecting
@@ -17,13 +18,27 @@ import { resolvePagePreviewRequestUrl } from '../../../../utils/pagePreview/reso
  * The destination URL is validated against private/internal IP ranges before fetching.
  */
 export async function GET(request: NextRequest): Promise<NextResponse> {
-    const requestUrlResolution = await resolvePagePreviewRequestUrl(request);
-    if (requestUrlResolution.errorResponse !== null) {
-        return requestUrlResolution.errorResponse;
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const url = request.nextUrl.searchParams.get('url');
+
+    if (!url) {
+        return NextResponse.json({ error: 'Missing required query parameter: url' }, { status: 400 });
+    }
+
+    // Guard against SSRF: reject private/internal IPs and non-HTTP(S) schemes
+    try {
+        assertSafeUrl(url);
+    } catch (error) {
+        assertsError(error);
+        return NextResponse.json({ error: error.message }, { status: 400 });
     }
 
     try {
-        const canEmbed = await checkIfUrlCanBeEmbedded(requestUrlResolution.url);
+        const canEmbed = await checkIfUrlCanBeEmbedded(url);
         return NextResponse.json({ canEmbed });
     } catch (error) {
         assertsError(error);

package/apps/agents-server/src/app/api/page-preview/input/route.ts

@@ -0,0 +1,161 @@
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+import { getCurrentUser } from '../../../../utils/getCurrentUser';
+import {
+    findUserPagePreviewBrowserSession,
+    normalizePagePreviewBrowserSessionId,
+} from '../../../../utils/pagePreviewBrowserSessions';
+
+/**
+ * Maximum absolute wheel delta accepted from one preview input event.
+ *
+ * @private route constant of `/api/page-preview/input`
+ */
+const MAX_WHEEL_DELTA = 1600;
+
+/**
+ * Payload accepted by the live page-preview input route.
+ *
+ * @private route type of `/api/page-preview/input`
+ */
+type PagePreviewInputPayload = {
+    readonly sessionId?: unknown;
+    readonly type?: unknown;
+    readonly xRatio?: unknown;
+    readonly yRatio?: unknown;
+    readonly deltaX?: unknown;
+    readonly deltaY?: unknown;
+};
+
+/**
+ * Normalized browser input event.
+ *
+ * @private route type of `/api/page-preview/input`
+ */
+type PagePreviewInputEvent =
+    | {
+          readonly sessionId: string;
+          readonly type: 'click';
+          readonly xRatio: number;
+          readonly yRatio: number;
+      }
+    | {
+          readonly sessionId: string;
+          readonly type: 'wheel';
+          readonly xRatio: number;
+          readonly yRatio: number;
+          readonly deltaX: number;
+          readonly deltaY: number;
+      };
+
+/**
+ * Applies one pointer or wheel event to an active live browser preview session.
+ */
+export async function POST(request: NextRequest): Promise<NextResponse> {
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const payload = (await request.json().catch(() => null)) as PagePreviewInputPayload | null;
+    const inputEvent = normalizePagePreviewInputEvent(payload);
+    if (!inputEvent) {
+        return NextResponse.json({ error: 'Invalid browser preview input.' }, { status: 400 });
+    }
+
+    const session = findUserPagePreviewBrowserSession(inputEvent.sessionId, currentUser);
+    if (!session?.page || !session.viewport) {
+        return NextResponse.json({ error: 'Browser preview session is not active.' }, { status: 404 });
+    }
+
+    const x = inputEvent.xRatio * session.viewport.width;
+    const y = inputEvent.yRatio * session.viewport.height;
+
+    if (inputEvent.type === 'click') {
+        await session.page.mouse.click(x, y);
+    } else {
+        await session.page.mouse.move(x, y);
+        await session.page.mouse.wheel(inputEvent.deltaX, inputEvent.deltaY);
+    }
+
+    return NextResponse.json({ ok: true });
+}
+
+/**
+ * Normalizes and validates one browser-preview input payload.
+ *
+ * @param payload - Unknown JSON payload.
+ * @returns Normalized input event or `null` when invalid.
+ */
+function normalizePagePreviewInputEvent(payload: PagePreviewInputPayload | null): PagePreviewInputEvent | null {
+    if (!payload) {
+        return null;
+    }
+
+    const sessionId = normalizePagePreviewBrowserSessionId(
+        typeof payload.sessionId === 'string' ? payload.sessionId : null,
+    );
+    const xRatio = normalizeRatio(payload.xRatio);
+    const yRatio = normalizeRatio(payload.yRatio);
+
+    if (!sessionId || xRatio === null || yRatio === null) {
+        return null;
+    }
+
+    if (payload.type === 'click') {
+        return {
+            sessionId,
+            type: 'click',
+            xRatio,
+            yRatio,
+        };
+    }
+
+    if (payload.type !== 'wheel') {
+        return null;
+    }
+
+    const deltaX = normalizeWheelDelta(payload.deltaX);
+    const deltaY = normalizeWheelDelta(payload.deltaY);
+    if (deltaX === null || deltaY === null) {
+        return null;
+    }
+
+    return {
+        sessionId,
+        type: 'wheel',
+        xRatio,
+        yRatio,
+        deltaX,
+        deltaY,
+    };
+}
+
+/**
+ * Normalizes a pointer coordinate ratio.
+ *
+ * @param value - Unknown payload value.
+ * @returns Ratio clamped to the viewport bounds, or `null` when invalid.
+ */
+function normalizeRatio(value: unknown): number | null {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        return null;
+    }
+
+    return Math.max(0, Math.min(1, value));
+}
+
+/**
+ * Normalizes one mouse-wheel delta.
+ *
+ * @param value - Unknown payload value.
+ * @returns Clamped wheel delta, or `null` when invalid.
+ */
+function normalizeWheelDelta(value: unknown): number | null {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        return null;
+    }
+
+    return Math.max(-MAX_WHEEL_DELTA, Math.min(MAX_WHEEL_DELTA, value));
+}
+

package/apps/agents-server/src/app/api/page-preview/screenshot/route.ts

@@ -2,12 +2,9 @@ import { $provideBrowserForServer } from '@/src/tools/$provideBrowserForServer';
 import { serializeError } from '@promptbook-local/utils';
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
-import {
-    LIVE_PAGE_PREVIEW_VIEWPORT_HEIGHT,
-    LIVE_PAGE_PREVIEW_VIEWPORT_WIDTH,
-} from '../../../../../../../src/book-components/Chat/utils/livePagePreviewConstants';
 import { assertsError } from '../../../../../../../src/errors/assertsError';
-import { resolvePagePreviewRequestUrl } from '../../../../utils/pagePreview/resolvePagePreviewRequestUrl';
+import { assertSafeUrl } from '../../../../utils/assertSafeUrl';
+import { getCurrentUser } from '../../../../utils/getCurrentUser';
 
 /**
  * Takes a screenshot of the given URL using a headless browser.
@@ -21,9 +18,23 @@ import { resolvePagePreviewRequestUrl } from '../../../../utils/pagePreview/reso
  * The destination URL is validated against private/internal IP ranges before fetching.
  */
 export async function GET(request: NextRequest): Promise<NextResponse> {
-    const requestUrlResolution = await resolvePagePreviewRequestUrl(request);
-    if (requestUrlResolution.errorResponse !== null) {
-        return requestUrlResolution.errorResponse;
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const url = request.nextUrl.searchParams.get('url');
+
+    if (!url) {
+        return NextResponse.json({ error: 'Missing required query parameter: url' }, { status: 400 });
+    }
+
+    // Guard against SSRF: reject private/internal IPs and non-HTTP(S) schemes
+    try {
+        assertSafeUrl(url);
+    } catch (error) {
+        assertsError(error);
+        return NextResponse.json({ error: error.message }, { status: 400 });
     }
 
     try {
@@ -31,11 +42,8 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
         const page = await browserContext.newPage();
 
         try {
-            await page.setViewportSize({
-                width: LIVE_PAGE_PREVIEW_VIEWPORT_WIDTH,
-                height: LIVE_PAGE_PREVIEW_VIEWPORT_HEIGHT,
-            });
-            await page.goto(requestUrlResolution.url, { waitUntil: 'domcontentloaded', timeout: 30_000 });
+            await page.setViewportSize({ width: 1280, height: 800 });
+            await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30_000 });
             const screenshotBuffer = await page.screenshot({ type: 'png' });
 
             // eslint-disable-next-line @typescript-eslint/no-explicit-any

package/apps/agents-server/src/app/api/page-preview/stream/route.ts

@@ -0,0 +1,81 @@
+import { serializeError } from '@promptbook-local/utils';
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+import { assertsError } from '../../../../../../../src/errors/assertsError';
+import { assertSafeUrl } from '../../../../utils/assertSafeUrl';
+import {
+    createPagePreviewBrowserStream,
+    PAGE_PREVIEW_STREAM_CONTENT_TYPE,
+} from '../../../../utils/createPagePreviewBrowserStream';
+import { getCurrentUser } from '../../../../utils/getCurrentUser';
+import {
+    normalizePagePreviewBrowserSessionId,
+    registerPagePreviewBrowserSession,
+} from '../../../../utils/pagePreviewBrowserSessions';
+
+/**
+ * Forces this route to stream a fresh live browser session for every request.
+ */
+export const dynamic = 'force-dynamic';
+
+/**
+ * Streams a live browser preview of a public URL.
+ *
+ * Query parameters:
+ * - `url` — fully-qualified public HTTP(S) URL to preview
+ * - `sessionId` — client-created browser-preview session id used for interaction events
+ *
+ * Requires authentication to prevent unauthenticated SSRF and browser-process abuse.
+ */
+export async function GET(request: NextRequest): Promise<NextResponse> {
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const url = request.nextUrl.searchParams.get('url');
+    const sessionId = normalizePagePreviewBrowserSessionId(request.nextUrl.searchParams.get('sessionId'));
+
+    if (!url) {
+        return NextResponse.json({ error: 'Missing required query parameter: url' }, { status: 400 });
+    }
+
+    if (!sessionId) {
+        return NextResponse.json({ error: 'Missing or invalid query parameter: sessionId' }, { status: 400 });
+    }
+
+    try {
+        assertSafeUrl(url);
+    } catch (error) {
+        assertsError(error);
+        return NextResponse.json({ error: error.message }, { status: 400 });
+    }
+
+    try {
+        registerPagePreviewBrowserSession({
+            sessionId,
+            url,
+            user: currentUser,
+        });
+
+        const stream = createPagePreviewBrowserStream({
+            request,
+            sessionId,
+            url,
+        });
+
+        return new NextResponse(stream, {
+            headers: {
+                'Content-Type': PAGE_PREVIEW_STREAM_CONTENT_TYPE,
+                'Cache-Control': 'no-cache, no-store, max-age=0, must-revalidate',
+                Connection: 'keep-alive',
+                'X-Accel-Buffering': 'no',
+            },
+        });
+    } catch (error) {
+        assertsError(error);
+        console.error('[page-preview] failed to start live browser stream', error);
+        return NextResponse.json({ error: serializeError(error) }, { status: 500 });
+    }
+}
+