@shuffleio/shuffle-mcps 0.0.31 → 0.0.32

package/dist/index.js

@@ -422,7 +422,9 @@ __export(index_exports, {
   deleteDatastoreItem: () => deleteDatastoreItem,
   deleteDatastoreItems: () => deleteDatastoreItems,
   diagnoseOutputWarning: () => diagnoseOutputWarning,
+  extractActionAppNames: () => extractActionAppNames,
   extractValidatedIngestionApps: () => extractValidatedIngestionApps,
+  extractWorkflowActionAppNames: () => extractWorkflowActionAppNames,
   extractWorkflowAppNames: () => extractWorkflowAppNames,
   fetchApps: () => fetchApps,
   fetchAppsViaApiConfig: () => fetchAppsViaApiConfig,
@@ -473,13 +475,13 @@ __export(index_exports, {
   useSyncHostBaseUrl: () => useSyncHostBaseUrl
 });
 module.exports = __toCommonJS(index_exports);
-var import_shuffle_mcp3 = require("./shuffle-mcp-ER33P3W2.css");
+var import_shuffle_mcp3 = require("./shuffle-mcp-TWJGPBOQ.css");
 var import_react22 = __toESM(require("react"));
 
 // ShuffleMcpThemeProvider.tsx
 var import_react = __toESM(require("react"));
 var import_material = require("@mui/material");
-var import_shuffle_mcp = require("./shuffle-mcp-ER33P3W2.css");
+var import_shuffle_mcp = require("./shuffle-mcp-TWJGPBOQ.css");
 var import_jsx_runtime = require("react/jsx-runtime");
 var readHtmlDarkClass = () => {
   if (typeof document === "undefined") return false;
@@ -1319,6 +1321,65 @@ var isIngestionApp = (appName) => {
   return isEmailApp(appName) || CASES_PATTERNS.some((p) => name.includes(p)) || EDR_PATTERNS.some((p) => name.includes(p)) || SIEM_PATTERNS.some((p) => name.includes(p));
 };
 var normalizeAppName = (name) => name.toLowerCase().trim().replace(/[\s_\-]+/g, "_");
+var IGNORED_WORKFLOW_APP_NAMES = /* @__PURE__ */ new Set([
+  "shuffle_tools",
+  "singul",
+  "integration",
+  "ai_agent",
+  "shuffle_agent",
+  "shuffle_ai"
+]);
+var isIgnoredWorkflowAppName = (name) => IGNORED_WORKFLOW_APP_NAMES.has(normalizeAppName(name));
+var looksLikeOpaqueId = (raw) => {
+  const trimmed = raw.trim();
+  if (/^[a-f0-9]{16,}$/i.test(trimmed)) return true;
+  if (/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(trimmed)) return true;
+  return false;
+};
+var addWorkflowAppName = (names, seen, raw) => {
+  if (typeof raw !== "string" || !raw.trim()) return;
+  const parts = raw.includes(",") ? raw.split(",") : [raw];
+  for (const part of parts) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    const key = normalizeAppName(trimmed);
+    if (!key || isIgnoredWorkflowAppName(trimmed) || looksLikeOpaqueId(trimmed) || seen.has(key)) continue;
+    seen.add(key);
+    names.push(trimmed);
+  }
+};
+var collectParameterAppNames = (input, names, seen, depth = 0) => {
+  if (!input || depth > 4) return;
+  if (Array.isArray(input)) {
+    input.forEach((item) => collectParameterAppNames(item, names, seen, depth + 1));
+    return;
+  }
+  if (typeof input !== "object") return;
+  const obj = input;
+  if (String(obj.name || "").toLowerCase() === "app_name") addWorkflowAppName(names, seen, obj.value);
+  for (const [key, value] of Object.entries(obj)) {
+    const lower = key.toLowerCase();
+    if (lower === "app_name") addWorkflowAppName(names, seen, value);
+    else if (lower === "parameters" || lower === "fields" || lower === "value") collectParameterAppNames(value, names, seen, depth + 1);
+  }
+};
+function extractActionAppNames(action) {
+  const names = [];
+  const seen = /* @__PURE__ */ new Set();
+  collectParameterAppNames(action?.parameters, names, seen);
+  addWorkflowAppName(names, seen, action?.app_name);
+  addWorkflowAppName(names, seen, action?.app_id);
+  return names;
+}
+function extractWorkflowActionAppNames(workflow) {
+  const names = [];
+  const seen = /* @__PURE__ */ new Set();
+  if (!workflow?.actions || !Array.isArray(workflow.actions)) return names;
+  for (const action of workflow.actions) {
+    for (const name of extractActionAppNames(action)) addWorkflowAppName(names, seen, name);
+  }
+  return names;
+}
 var getIngestionCategory = (appName, appCategories) => {
   const name = appName.toLowerCase();
   const categories = (appCategories || []).map((c) => c.toLowerCase());
@@ -1332,20 +1393,14 @@ var INGEST_TICKETS_WORKFLOW_NAME = "Ingest Tickets";
 var FORWARD_TICKETS_WORKFLOW_NAME = "Forward Tickets";
 function extractWorkflowAppNames(workflow) {
   const names = /* @__PURE__ */ new Set();
-  if (!workflow?.actions || !Array.isArray(workflow.actions)) return names;
-  for (const action of workflow.actions) {
-    if (action.app_name) {
-      names.add(normalizeAppName(action.app_name));
-    }
-    if (action.app_id) {
-      names.add(normalizeAppName(action.app_id));
-    }
-    if (action.parameters) {
-      for (const param of action.parameters) {
-        if (param.name === "app_name" && param.value) {
-          names.add(normalizeAppName(param.value));
-        }
-      }
+  for (const raw of extractWorkflowActionAppNames(workflow)) {
+    const parts = typeof raw === "string" && raw.includes(",") ? raw.split(",") : [raw];
+    for (const part of parts) {
+      const trimmed = (part || "").trim();
+      if (!trimmed) continue;
+      if (isIgnoredWorkflowAppName(trimmed) || looksLikeOpaqueId(trimmed)) continue;
+      const key = normalizeAppName(trimmed);
+      if (key) names.add(key);
     }
   }
   return names;
@@ -2060,6 +2115,7 @@ function AppTitleHeader({
   isActivated = null,
   activateLoading = false,
   onActivateToggle,
+  highlightActivate = false,
   onAdd
 }) {
   return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_framer_motion.motion.div, { initial: { opacity: 0, y: 12 }, animate: { opacity: 1, y: 0 }, transition: { duration: 0.3 }, children: /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(
@@ -2163,7 +2219,16 @@ function AppTitleHeader({
               py: 0.5,
               minHeight: 0,
               flexShrink: 0,
-              ...isActivated ? { color: "hsl(var(--muted-foreground))", borderColor: "hsl(var(--border))", "&:hover": { borderColor: "hsl(var(--destructive))", color: "hsl(var(--destructive))", bgcolor: "hsla(var(--destructive) / 0.08)" } } : { bgcolor: "hsl(var(--primary))", "&:hover": { bgcolor: "hsl(var(--primary) / 0.85)" } }
+              ...isActivated ? { color: "hsl(var(--muted-foreground))", borderColor: "hsl(var(--border))", "&:hover": { borderColor: "hsl(var(--destructive))", color: "hsl(var(--destructive))", bgcolor: "hsla(var(--destructive) / 0.08)" } } : { bgcolor: "hsl(var(--primary))", "&:hover": { bgcolor: "hsl(var(--primary) / 0.85)" } },
+              ...highlightActivate ? {
+                boxShadow: "0 0 0 0 hsla(var(--primary) / 0.6)",
+                animation: "appTitleActivatePulse 1.1s ease-out infinite",
+                "@keyframes appTitleActivatePulse": {
+                  "0%": { boxShadow: "0 0 0 0 hsla(var(--primary) / 0.55)" },
+                  "70%": { boxShadow: "0 0 0 10px hsla(var(--primary) / 0)" },
+                  "100%": { boxShadow: "0 0 0 0 hsla(var(--primary) / 0)" }
+                }
+              } : {}
             },
             children: activateLoading ? "\u2026" : isActivated ? "Deactivate" : "Activate"
           }
@@ -5706,6 +5771,7 @@ function AppDetailDrawer({
   onAddToCanvas,
   isAuthenticated = true,
   activeOrgId,
+  autoActivate = false,
   globalUrl,
   userdata,
   isLoaded,
@@ -5903,8 +5969,9 @@ function AppDetailDrawer({
   (0, import_react11.useEffect)(() => {
     lastValidAuthRef.current = null;
   }, [appName]);
-  const handleActivateToggle = async () => {
+  const handleActivateToggle = async (opts) => {
     if (!appName || activateLoading) return;
+    const silent = !!opts?.silent;
     const wasActivated = isActivated;
     const prevAppId = activatedAppId;
     setIsActivated(!wasActivated);
@@ -5918,7 +5985,7 @@ function AppDetailDrawer({
         });
         if (!res.ok) throw new Error("Deactivate failed");
         setActivatedAppId(null);
-        toast.success(`${displayName} deactivated`);
+        if (!silent) toast.success(`${displayName} deactivated`);
       } else {
         const appId2 = resolvedAlgoliaId;
         if (!appId2) throw new Error("App ID not resolved yet");
@@ -5929,17 +5996,38 @@ function AppDetailDrawer({
         });
         if (!activateRes.ok) throw new Error(`Activate failed (${activateRes.status})`);
         setActivatedAppId(appId2);
-        toast.success(`${displayName} activated`);
+        if (!silent) toast.success(`${displayName} activated`);
       }
     } catch (err) {
       console.error("[Activate] Error:", err);
-      toast.error(err?.message || "Activation failed");
+      if (!silent) toast.error(err?.message || "Activation failed");
       setIsActivated(wasActivated);
       setActivatedAppId(prevAppId);
     } finally {
       setActivateLoading(false);
     }
   };
+  const autoActivateFiredRef = (0, import_react11.useRef)(null);
+  const [autoActivatePulse, setAutoActivatePulse] = (0, import_react11.useState)(false);
+  (0, import_react11.useEffect)(() => {
+    if (!open || !autoActivate || !appName) return;
+    const key = `${appName}`;
+    if (autoActivateFiredRef.current === key) return;
+    if (isActivated !== false) return;
+    if (!resolvedAlgoliaId) return;
+    if (activateLoading) return;
+    autoActivateFiredRef.current = key;
+    setAutoActivatePulse(true);
+    handleActivateToggle({ silent: true }).finally(() => {
+      setTimeout(() => setAutoActivatePulse(false), 1200);
+    });
+  }, [open, autoActivate, appName, isActivated, resolvedAlgoliaId, activateLoading]);
+  (0, import_react11.useEffect)(() => {
+    if (!open) {
+      autoActivateFiredRef.current = null;
+      setAutoActivatePulse(false);
+    }
+  }, [open, appName]);
   const isLoadingAll = appLoading || isAuthenticated && appAuthLoading;
   return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
     import_material9.Drawer,
@@ -6015,7 +6103,8 @@ function AppDetailDrawer({
               categories: appInfo?.categories,
               isActivated: onAddToCanvas ? null : effectiveActivated,
               activateLoading,
-              onActivateToggle: handleActivateToggle,
+              onActivateToggle: () => handleActivateToggle(),
+              highlightActivate: autoActivatePulse,
               onAdd: onAddToCanvas && appName ? () => {
                 onAddToCanvas({ name: appName, icon: resolvedImage || "", algoliaId: resolvedAlgoliaId });
                 onClose();
@@ -6119,7 +6208,7 @@ function AppDetailDrawer({
 }
 
 // views/ShuffleMCP.tsx
-var import_shuffle_mcp2 = require("./shuffle-mcp-ER33P3W2.css");
+var import_shuffle_mcp2 = require("./shuffle-mcp-TWJGPBOQ.css");
 init_appsCache();
 
 // components/SegmentedControl.tsx
@@ -6287,7 +6376,7 @@ function SegmentedControl({
                   children: opt.label
                 }
               ),
-              !isAction && typeof opt.count === "number" && /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+              !isAction && (typeof opt.count === "number" || typeof opt.count === "string") && /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
                 "span",
                 {
                   style: {
@@ -6786,8 +6875,8 @@ var ShuffleMCP = import_react12.default.forwardRef(({
               value: sourceFilter,
               onChange: (v) => setSourceFilter(v),
               options: [
-                { value: "all", label: "All", count: results.length + filteredPrivateApps.length, title: "All available apps \u2014 both the public catalog and your private apps." },
-                { value: "public", label: "Public", count: results.length, title: "Public apps from the Shuffle catalog (powered by Algolia)." },
+                { value: "all", label: "All", count: results.length >= hitsPerPage ? `${results.length + filteredPrivateApps.length}+` : results.length + filteredPrivateApps.length, title: "All available apps \u2014 both the public catalog and your private apps." },
+                { value: "public", label: "Public", count: results.length >= hitsPerPage ? `${results.length}+` : results.length, title: "Public apps from the Shuffle catalog (powered by Algolia)." },
                 { value: "private", label: "Private", count: filteredPrivateApps.length, title: "Private apps are apps you have activated in your organization, or your own custom apps \u2014 not just from the public Algolia catalog." },
                 { value: "authenticated", label: "Authenticated", count: [...filteredPrivateApps, ...results].filter((a, i, arr) => arr.findIndex((x) => x.name?.toLowerCase() === a.name?.toLowerCase()) === i).filter(isAppConfigured).length, title: "Apps you have authenticated and that are ready to use." }
               ]
@@ -6963,9 +7052,11 @@ function AppSearchDrawer({
   pinnedApps,
   highlightAppName,
   highlightDelayMs = 5e3,
+  realtimeHighlightAppNames,
   multiSelect = false,
   selectedApps,
   onSelectionChange,
+  autoActivate = false,
   globalUrl,
   theme,
   colorMode
@@ -7224,6 +7315,41 @@ function AppSearchDrawer({
                       "0%, 100%": { boxShadow: "0 0 0 2px hsl(var(--primary)), 0 0 12px 1px hsl(var(--primary) / 0.4)" },
                       "50%": { boxShadow: "0 0 0 2px hsl(var(--primary)), 0 0 24px 4px hsl(var(--primary) / 0.75)" }
                     }
+                  } : {},
+                  ...realtimeHighlightAppNames && realtimeHighlightAppNames.length > 0 ? {
+                    [realtimeHighlightAppNames.map((n) => `& .singul-dropdown-item[data-app-name="${n}"]`).join(", ")]: {
+                      position: "relative",
+                      zIndex: 2,
+                      borderColor: "hsl(var(--primary) / 0.78) !important",
+                      backgroundColor: "hsl(var(--primary) / 0.08) !important",
+                      outline: "none !important",
+                      boxShadow: "none !important",
+                      animation: "shuffleHighlightPulseStrong 1.5s ease-in-out infinite",
+                      transition: "border-color 120ms ease, background-color 120ms ease",
+                      "&::before": {
+                        content: '""',
+                        position: "absolute",
+                        left: "10px",
+                        top: "14px",
+                        bottom: "14px",
+                        width: "3px",
+                        borderRadius: "999px",
+                        backgroundColor: "hsl(var(--primary))"
+                      },
+                      "& .singul-app-info": {
+                        paddingLeft: "8px"
+                      }
+                    },
+                    "@keyframes shuffleHighlightPulseStrong": {
+                      "0%, 100%": {
+                        borderColor: "hsl(var(--primary) / 0.62)",
+                        backgroundColor: "hsl(var(--primary) / 0.06)"
+                      },
+                      "50%": {
+                        borderColor: "hsl(var(--primary) / 0.92)",
+                        backgroundColor: "hsl(var(--primary) / 0.12)"
+                      }
+                    }
                   } : {}
                 },
                 children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_framer_motion8.AnimatePresence, { mode: "wait", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
@@ -7246,8 +7372,9 @@ function AppSearchDrawer({
                         layout: "grid",
                         gridColumns: 2,
                         inline: true,
+                        initialQuery,
                         initialFilterQuery: initialQuery,
-                        hitsPerPage: 12,
+                        hitsPerPage: 20,
                         showDescription: false,
                         showCategories: true,
                         showCheckbox: multiSelect,
@@ -7338,7 +7465,8 @@ function AppSearchDrawer({
         theme,
         colorMode,
         onRefresh: onClose,
-        onAddToCanvas
+        onAddToCanvas,
+        autoActivate
       }
     )
   ] });
@@ -7605,11 +7733,173 @@ function ShufflePipelinesBanner() {
 var ShufflePipelinesBanner_default = ShufflePipelinesBanner;
 
 // components/AgentUI.tsx
-var import_react15 = require("react");
+var import_react15 = __toESM(require("react"));
 var import_lucide_react11 = require("lucide-react");
 var import_react_router_dom2 = require("react-router-dom");
 var import_material16 = require("@mui/material");
 var import_react_markdown4 = __toESM(require("react-markdown"));
+
+// components/agentPromptSuggestions.ts
+var AGENT_PROMPT_SUGGESTIONS = [
+  // — Email & comms ————————————————————————————————————————————————
+  "Take care of my emails by pretending to be me and answering them",
+  "Triage my inbox every hour and draft replies for anything urgent",
+  "Summarise my unread emails from the last 24 hours and rank them by importance",
+  "Forward any phishing-looking emails in my inbox to the security team and quarantine them",
+  "Reply to scheduling requests in my inbox using my working hours and calendar availability",
+  "Every morning, send me a digest of overnight emails grouped by sender and topic",
+  "Auto-unsubscribe from marketing emails I have not opened in 60 days",
+  "Snooze low-priority newsletters until Friday afternoon",
+  "Flag and archive shipping notifications once the package is delivered",
+  "Clean up my inbox by archiving anything older than 30 days that I have already read",
+  // — Calendar & meetings ————————————————————————————————————————————
+  "Block focus time on my calendar every weekday morning between 9 and 11",
+  "Decline meetings that conflict with my focus blocks and propose alternatives",
+  "Send me a daily agenda every weekday at 8am with prep notes per meeting",
+  "Reschedule any meeting without an agenda 24 hours before it starts",
+  "Send meeting notes and action items to all attendees after every call",
+  "Find a 30-minute slot this week that works for me and the people I mention",
+  "Cancel recurring meetings that I have skipped 3 times in a row",
+  "Remind me 15 minutes before any meeting that I have not prepared for",
+  // — Incidents & SOC operations ———————————————————————————————————
+  "Triage new incidents every 15 minutes and assign severity, owner, and next steps",
+  "Watch for new critical incidents and page the on-call engineer immediately",
+  "Close incidents older than 30 days that have had no activity and no observables",
+  "Merge duplicate incidents that share the same observable or hostname",
+  "Enrich every new incident with threat intel and asset context within 2 minutes",
+  "Auto-acknowledge incidents from known maintenance windows and link them to the change ticket",
+  "Summarise yesterday's incidents into a daily standup brief for the SOC team",
+  "Escalate any incident that breaches its SLA to the team lead",
+  "Tag every incident with the MITRE ATT&CK technique that best matches its observables",
+  "Watch the alert queue and group related alerts into a single incident",
+  "Auto-resolve incidents whose root cause matches a previously closed incident",
+  "Reopen any closed incident if the same observable shows up again within 7 days",
+  "Send a weekly incident trend report every Monday morning to the security leadership",
+  // — Threat intel & IOCs —————————————————————————————————————————
+  "Pull new IOCs from my threat feeds every hour and push them to the firewall blocklist",
+  "Check every external IP in today's incidents against VirusTotal and AbuseIPDB",
+  "Sweep the environment for any host that has connected to a known bad domain in the last 7 days",
+  "Subscribe to new CISA advisories and turn them into detection rules where possible",
+  "Cross-reference observed file hashes against MalwareBazaar daily",
+  "Watch for newly registered domains that look like our brand and report them",
+  "Alert me whenever a new CVE with a known exploit affects software in our inventory",
+  "Refresh the IOC datastore every 6 hours and prune entries older than 30 days",
+  // — Detection engineering ———————————————————————————————————————
+  "Review noisy detection rules every week and propose tuning suggestions",
+  "Convert the latest Sigma rules from the public repo into our SIEM's format and stage them for review",
+  "Tell me which detection rules have not fired in the last 90 days so I can retire them",
+  "Audit MITRE ATT&CK coverage every Monday and flag techniques with zero detections",
+  "Backtest new detection rules against the last 30 days of logs before promoting them to production",
+  // — SIEM operations ———————————————————————————————————————————
+  "Triage new Splunk alerts every 10 minutes and assign severity, owner, and next steps",
+  "Watch Microsoft Sentinel for high-severity incidents and page the on-call analyst immediately",
+  "Suppress noisy SIEM alerts that fire more than 50 times per hour and open a tuning ticket",
+  "Correlate failed login spikes in the SIEM with VPN logs and flag possible brute-force attempts",
+  "Hunt the SIEM every morning for sign-ins from countries we do not operate in",
+  "Forward critical SIEM detections straight to Case Management and skip the alert queue",
+  "Run a weekly SIEM data-source health check and alert me on any log source silent for over 1 hour",
+  "Enrich every SIEM alert with asset owner, criticality, and recent vulnerabilities before triage",
+  "Search the SIEM for the latest IOCs from threat intel feeds every 30 minutes",
+  "Summarise top 10 noisiest SIEM rules every Friday and propose tuning candidates",
+  "Detect lateral movement patterns in SIEM auth logs and open an incident with the affected hosts",
+  "Watch the SIEM for any disable or delete of audit logging and treat it as a critical incident",
+  // — EDR operations ————————————————————————————————————————————
+  "Isolate any endpoint that triggers a critical CrowdStrike alert and notify the user's manager",
+  "Kill any process on a flagged host that matches a known malware family in EDR telemetry",
+  "Watch SentinelOne for ransomware behavior detections and auto-contain the host within 60 seconds",
+  "Pull the process tree from EDR for every malware detection and attach it to the incident",
+  "Sweep all endpoints for a given hash or filename when a new IOC arrives and report matches",
+  "Detect newly created local admin accounts on any endpoint and require approval before keeping them",
+  "Alert when an EDR agent goes offline for more than 1 hour and open a ticket against the asset owner",
+  "Quarantine any binary flagged as suspicious by EDR and email the user with next steps",
+  "Hunt EDR telemetry every night for LOLBins executed from user-writable directories",
+  "Correlate EDR alerts with SIEM auth events to detect credential theft followed by execution",
+  "Run a weekly EDR coverage report and list endpoints without an active agent",
+  "Auto-resolve EDR alerts that match a known-good signed binary on our allowlist",
+  // — Vulnerability management ————————————————————————————————————
+  "Scan our asset inventory daily and open tickets for any new critical or high vulnerability",
+  "Remind asset owners every Friday about open vulnerabilities older than 14 days",
+  "Re-scan hosts that recently patched a critical vulnerability and close the ticket if clean",
+  "Send the patch compliance report every Monday morning to IT and security leadership",
+  "Correlate vulnerabilities with active exploits in the wild and re-prioritise the queue",
+  // — Endpoint & host monitoring ———————————————————————————————————
+  "Watch my host monitors and alert me if any agent goes offline for more than 1 hour",
+  "Isolate any endpoint that triggers a critical EDR alert and notify the user's manager",
+  "Kill any process on a flagged host that matches a known malware family",
+  "Run an inventory of installed software on every endpoint every Sunday",
+  "Detect new local admin accounts created on any endpoint and require approval",
+  "Make sure full-disk encryption is on for every laptop and report exceptions weekly",
+  // — Identity & access —————————————————————————————————————————
+  "Review user access every quarter and flag anyone with privileges they have not used in 90 days",
+  "Disable accounts that have not logged in for 60 days and notify their manager",
+  "Watch for impossible travel sign-ins and force a password reset plus MFA re-enrolment",
+  "Alert me whenever someone is added to an admin group and require justification within 24 hours",
+  "Audit MFA enrolment weekly and email any user without a second factor",
+  "Rotate service account credentials every 90 days and update the vault",
+  "Detect dormant API keys older than 180 days and revoke them after notice",
+  "Make sure new joiners get baseline access provisioned within 1 hour of their start date",
+  "Make sure leavers have all access revoked within 15 minutes of their termination event",
+  // — Cloud, infra & posture ————————————————————————————————————
+  "Check our cloud accounts every hour for public S3 buckets and lock them down",
+  "Detect new IAM roles with wildcard permissions and require review before they go live",
+  "Watch for unencrypted databases in production and open a ticket against the owner",
+  "Run a CIS benchmark scan against all production cloud accounts every Sunday",
+  "Alert on any new security group that opens ports to 0.0.0.0/0",
+  "Monitor cloud spend daily and warn me if any service's cost jumps more than 50% week-over-week",
+  "Check certificate expiry across our domains weekly and renew anything within 30 days",
+  "Watch our DNS records for unauthorised changes and revert them",
+  // — Phishing & user reports ———————————————————————————————————
+  "Investigate phishing reports from the abuse mailbox and respond to the reporter within 1 hour",
+  "Detonate suspicious attachments in a sandbox and attach the verdict to the incident",
+  "Pull URLs from reported phishing emails and submit them to URLhaus and PhishTank",
+  "Send a phishing simulation to a sample of users every month and report results",
+  // — Compliance, audit & reporting —————————————————————————————
+  "Generate the SOC2 evidence pack at the start of every month",
+  "Track changes to security policies and alert the GRC team when one is edited",
+  "Send a weekly KPI report covering MTTD, MTTR, and open incident backlog",
+  "Audit log retention every Sunday and confirm we still meet the 1-year requirement",
+  "Generate a monthly executive summary of incidents, vulnerabilities, and detection coverage",
+  // — Backups, DR & uptime ————————————————————————————————————
+  "Verify nightly backups completed successfully and alert me if any failed",
+  "Test restore from backup on a sample workload every month and report results",
+  "Watch our public status page for incidents at our critical vendors and notify the team",
+  "Ping our public endpoints every minute and open an incident if any return non-2xx for 3 minutes",
+  // — Tickets, workflow & docs ——————————————————————————————————
+  "Triage new Jira tickets in the security project every hour and assign by category",
+  "Close tickets that have been waiting on the reporter for more than 14 days",
+  "Summarise this week's closed tickets into release notes every Friday",
+  "Pull action items out of meeting notes I share and create tickets for them",
+  "Keep the on-call runbook in sync with the latest incident postmortems",
+  "Review pull requests in our security repos and leave a summary comment within an hour",
+  // — People, HR & onboarding ————————————————————————————————————
+  "Send a welcome message and security training link to every new joiner on their start date",
+  "Run the offboarding checklist whenever someone is marked as a leaver in HR",
+  "Remind managers to complete quarterly performance reviews 1 week before the deadline",
+  "Send birthday and work anniversary greetings from me on the right day",
+  // — Personal / lightweight ops chores —————————————————————————
+  "Order more office coffee whenever the inventory drops below 2 bags",
+  "File my receipts every Friday and submit the expense report",
+  "Track my open invoices and chase clients whose payment is more than 14 days overdue",
+  "Send a polite follow-up to anyone I have emailed but who has not replied in 5 working days",
+  "Read the security news feeds every morning and summarise the top 5 stories for me"
+];
+var matchAgentPromptSuggestions = (input, limit = 8) => {
+  const q = (input || "").trim().toLowerCase();
+  if (!q) return [];
+  const scored = [];
+  for (const text of AGENT_PROMPT_SUGGESTIONS) {
+    const lower = text.toLowerCase();
+    const idx = lower.indexOf(q);
+    if (idx < 0) continue;
+    const score = idx === 0 ? -1e3 + text.length : idx * 10 + text.length;
+    scored.push({ text, score });
+  }
+  scored.sort((a, b) => a.score - b.score);
+  return scored.slice(0, limit).map((s) => s.text);
+};
+var DEFAULT_AGENT_PROMPT_PLACEHOLDER = "Take care of my emails by pretending to be me and answering them";
+
+// components/AgentUI.tsx
 var import_remark_gfm4 = __toESM(require("remark-gfm"));
 var import_remark_breaks = __toESM(require("remark-breaks"));
 var import_react18_json_view2 = __toESM(require("react18-json-view"));
@@ -9547,7 +9837,7 @@ var AgentUI = ({
   autoLoadApps = true,
   title = "What do you want to do?",
   subtitle,
-  placeholder = 'Describe a task, e.g. "Get my emails for today and summarise them"',
+  placeholder = DEFAULT_AGENT_PROMPT_PLACEHOLDER,
   defaultInput = "",
   autoSubmit = false,
   hideHeroIcon = false,
@@ -9599,6 +9889,29 @@ var AgentUI = ({
   const hasApiKey = !!apiKey || !!API_CONFIG.apiKey;
   const navigate = (0, import_react_router_dom2.useNavigate)();
   const [actionInput, setActionInput] = (0, import_react15.useState)(defaultInput);
+  const promptAnchorRef = import_react15.default.useRef(null);
+  const [suggestionsDismissed, setSuggestionsDismissed] = (0, import_react15.useState)(false);
+  const [suggestionIndex, setSuggestionIndex] = (0, import_react15.useState)(-1);
+  const promptSuggestions = (0, import_react15.useMemo)(
+    () => matchAgentPromptSuggestions(actionInput, 8),
+    [actionInput]
+  );
+  (0, import_react15.useEffect)(() => {
+    setSuggestionIndex(-1);
+    setSuggestionsDismissed(false);
+  }, [actionInput]);
+  const suggestionsOpen = promptSuggestions.length > 0 && !suggestionsDismissed;
+  const acceptSuggestion = (0, import_react15.useCallback)((s) => {
+    setActionInput(s);
+    setSuggestionsDismissed(true);
+    setSuggestionIndex(-1);
+    requestAnimationFrame(() => {
+      try {
+        inputRef.current?.focus();
+      } catch {
+      }
+    });
+  }, []);
   const BUILTIN_DEFAULT_APPS = [
     { name: "http" },
     { name: "shuffle_tools" }
@@ -10592,6 +10905,34 @@ var AgentUI = ({
     }
   }, [submitOverride, actionInput, chosenApps, submitInput]);
   const onKeyDown = (e) => {
+    if (suggestionsOpen && promptSuggestions.length > 0) {
+      if (e.key === "ArrowDown") {
+        e.preventDefault();
+        setSuggestionIndex((i) => (i + 1) % promptSuggestions.length);
+        return;
+      }
+      if (e.key === "ArrowUp") {
+        e.preventDefault();
+        setSuggestionIndex((i) => i <= 0 ? promptSuggestions.length - 1 : i - 1);
+        return;
+      }
+      if (e.key === "Escape") {
+        e.preventDefault();
+        setSuggestionsDismissed(true);
+        setSuggestionIndex(-1);
+        return;
+      }
+      if (e.key === "Tab" && suggestionIndex >= 0) {
+        e.preventDefault();
+        acceptSuggestion(promptSuggestions[suggestionIndex]);
+        return;
+      }
+      if (e.key === "Enter" && suggestionIndex >= 0 && !e.metaKey && !e.ctrlKey && !e.shiftKey) {
+        e.preventDefault();
+        acceptSuggestion(promptSuggestions[suggestionIndex]);
+        return;
+      }
+    }
     if ((e.metaKey || e.ctrlKey) && e.key === "Enter") {
       e.preventDefault();
       handlePrimarySubmit();
@@ -11249,7 +11590,7 @@ var AgentUI = ({
                     mt: -1,
                     maxWidth: 600
                   }, children: subtitle }),
-                  /* @__PURE__ */ (0, import_jsx_runtime20.jsxs)(import_material16.Box, { sx: {
+                  /* @__PURE__ */ (0, import_jsx_runtime20.jsxs)(import_material16.Box, { ref: promptAnchorRef, sx: {
                     width: "100%",
                     display: "flex",
                     flexDirection: "column",
@@ -11457,6 +11798,67 @@ var AgentUI = ({
                       ) }) })
                     ] })
                   ] }),
+                  /* @__PURE__ */ (0, import_jsx_runtime20.jsx)(
+                    import_material16.Popper,
+                    {
+                      open: suggestionsOpen,
+                      anchorEl: promptAnchorRef.current,
+                      placement: "bottom-start",
+                      style: { zIndex: 1300, width: promptAnchorRef.current?.offsetWidth },
+                      modifiers: [{ name: "offset", options: { offset: [0, 6] } }],
+                      children: /* @__PURE__ */ (0, import_jsx_runtime20.jsx)(import_material16.ClickAwayListener, { onClickAway: () => setSuggestionsDismissed(true), children: /* @__PURE__ */ (0, import_jsx_runtime20.jsx)(
+                        import_material16.Paper,
+                        {
+                          elevation: 6,
+                          sx: {
+                            bgcolor: "hsl(var(--card))",
+                            border: "1px solid hsl(var(--border))",
+                            borderRadius: 2,
+                            overflow: "hidden",
+                            maxHeight: 320,
+                            overflowY: "auto"
+                          },
+                          children: /* @__PURE__ */ (0, import_jsx_runtime20.jsx)(import_material16.MenuList, { dense: true, disablePadding: true, children: promptSuggestions.map((s, i) => {
+                            const q = actionInput.trim();
+                            const lower = s.toLowerCase();
+                            const idx = q ? lower.indexOf(q.toLowerCase()) : -1;
+                            const before = idx >= 0 ? s.slice(0, idx) : s;
+                            const match = idx >= 0 ? s.slice(idx, idx + q.length) : "";
+                            const after = idx >= 0 ? s.slice(idx + q.length) : "";
+                            return /* @__PURE__ */ (0, import_jsx_runtime20.jsxs)(
+                              import_material16.MenuItem,
+                              {
+                                selected: i === suggestionIndex,
+                                onMouseEnter: () => setSuggestionIndex(i),
+                                onMouseDown: (e) => {
+                                  e.preventDefault();
+                                  acceptSuggestion(s);
+                                },
+                                sx: {
+                                  fontSize: "0.88rem",
+                                  color: "hsl(var(--foreground))",
+                                  py: 0.75,
+                                  px: 2,
+                                  "&.Mui-selected, &.Mui-selected:hover": {
+                                    bgcolor: "hsl(var(--muted) / 0.6)"
+                                  }
+                                },
+                                children: [
+                                  /* @__PURE__ */ (0, import_jsx_runtime20.jsx)(import_lucide_react11.Search, { size: 14, style: { marginRight: 10, color: "hsl(var(--muted-foreground))", flexShrink: 0 } }),
+                                  /* @__PURE__ */ (0, import_jsx_runtime20.jsxs)(import_material16.Box, { component: "span", sx: { whiteSpace: "normal", lineHeight: 1.4 }, children: [
+                                    before,
+                                    /* @__PURE__ */ (0, import_jsx_runtime20.jsx)(import_material16.Box, { component: "span", sx: { fontWeight: 700, color: "hsl(var(--foreground))" }, children: match }),
+                                    after
+                                  ] })
+                                ]
+                              },
+                              s
+                            );
+                          }) })
+                        }
+                      ) })
+                    }
+                  ),
                   !hideAppPicker && /* @__PURE__ */ (0, import_jsx_runtime20.jsx)(import_material16.Box, { sx: { display: "flex", justifyContent: "center" }, children: /* @__PURE__ */ (0, import_jsx_runtime20.jsxs)(import_material16.Box, { sx: {
                     display: "inline-flex",
                     flexWrap: "wrap",
@@ -12290,6 +12692,32 @@ var ENDPOINT_PRESETS = [
   { label: "LM Studio (localhost)", url: "http://localhost:1234/v1", apiKeyHint: "Local LM Studio does not require an API key \u2014 any non-empty value works." },
   { label: CUSTOM_PRESET, url: "" }
 ];
+var PROVIDER_DOMAINS = {
+  "Shuffle AI": "shuffler.io",
+  OpenAI: "openai.com",
+  Anthropic: "anthropic.com",
+  "Google Gemini": "gemini.google.com",
+  Mistral: "mistral.ai",
+  Groq: "groq.com",
+  DeepSeek: "deepseek.com",
+  "Together AI": "together.ai",
+  OpenRouter: "openrouter.ai",
+  "Ollama (localhost)": "ollama.com",
+  "LM Studio (localhost)": "lmstudio.ai"
+};
+var ProviderLogo = ({ label, url }) => {
+  const [errored, setErrored] = (0, import_react16.useState)(false);
+  let domain = PROVIDER_DOMAINS[label];
+  if (!domain && url) {
+    try {
+      domain = new URL(url).hostname.replace(/^www\./, "");
+    } catch {
+    }
+  }
+  const src = domain ? `https://www.google.com/s2/favicons?domain=${domain}&sz=64` : "";
+  const initial = label.trim().charAt(0).toUpperCase() || "?";
+  return /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_material18.Box, { sx: { width: 18, height: 18, borderRadius: "4px", display: "flex", alignItems: "center", justifyContent: "center", bgcolor: "hsl(var(--muted))", overflow: "hidden", flexShrink: 0 }, children: src && !errored ? /* @__PURE__ */ (0, import_jsx_runtime22.jsx)("img", { src, alt: "", width: 18, height: 18, style: { display: "block" }, onError: () => setErrored(true) }) : /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_material18.Typography, { sx: { fontSize: "0.65rem", fontWeight: 600, color: "hsl(var(--muted-foreground))", lineHeight: 1 }, children: initial }) });
+};
 var LocalLLMConfig = ({ compact, globalUrl, userdata, isLoaded, isLoggedIn, serverside, theme, colorMode }) => {
   useSyncHostBaseUrl(globalUrl);
   const { authStates, authenticatedApps, handleAuthChange, handleTestConnection, handleSaveAuth, refreshAuth } = useAppAuth();
@@ -12433,12 +12861,28 @@ var LocalLLMConfig = ({ compact, globalUrl, userdata, isLoaded, isLoggedIn, serv
           isOptionEqualToValue: (opt, val) => opt === val,
           renderOption: (props, option) => {
             const preset = ENDPOINT_PRESETS.find((p) => p.label === option);
-            return /* @__PURE__ */ (0, import_react17.createElement)("li", { ...props, key: option }, /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_material18.Box, { sx: { display: "flex", alignItems: "center", gap: 1, width: "100%", minWidth: 0 }, children: [
+            return /* @__PURE__ */ (0, import_react17.createElement)("li", { ...props, key: option }, /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_material18.Box, { sx: { display: "flex", alignItems: "center", gap: 1.25, width: "100%", minWidth: 0 }, children: [
+              /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(ProviderLogo, { label: option, url: preset?.url }),
               /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_material18.Typography, { sx: { fontSize: "0.85rem", color: "hsl(var(--popover-foreground))" }, children: option }),
               preset?.url && /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_material18.Typography, { component: "span", sx: { ml: "auto", color: "hsl(var(--muted-foreground))", fontSize: "0.75rem", overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }, children: preset.url })
             ] }));
           },
-          renderInput: (params) => /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_material18.TextField, { ...params, placeholder: "Search a provider\u2026" }),
+          renderInput: (params) => {
+            const preset = ENDPOINT_PRESETS.find((p) => p.label === effectivePreset);
+            return /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
+              import_material18.TextField,
+              {
+                ...params,
+                placeholder: "Search a provider\u2026",
+                slotProps: {
+                  input: {
+                    ...params.InputProps,
+                    startAdornment: effectivePreset ? /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_material18.Box, { sx: { display: "flex", alignItems: "center", pl: 0.5, mr: 0.5 }, children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(ProviderLogo, { label: effectivePreset, url: preset?.url }) }) : void 0
+                  }
+                }
+              }
+            );
+          },
           slotProps: {
             paper: { sx: { bgcolor: "hsl(var(--popover))", color: "hsl(var(--popover-foreground))", border: "1px solid hsl(var(--border))" } },
             popper: { sx: { zIndex: 9999 } }
@@ -13401,17 +13845,20 @@ var AgentRunRow = ({ run, onClick, sx, appIcons, onAppClick }) => {
             ] })
           ] })
         ] }),
-        tools.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime24.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime24.jsx)(
           import_material20.Box,
           {
             onClick: (e) => e.stopPropagation(),
             sx: {
               display: { xs: "none", sm: "flex" },
               alignItems: "center",
+              justifyContent: "flex-end",
               flexShrink: 0,
-              ml: 1
+              ml: 1,
+              width: 140,
+              minHeight: 28
             },
-            children: /* @__PURE__ */ (0, import_jsx_runtime24.jsx)(
+            children: tools.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime24.jsx)(
               import_material20.AvatarGroup,
               {
                 max: 5,
@@ -13460,6 +13907,17 @@ var AgentRunRow = ({ run, onClick, sx, appIcons, onAppClick }) => {
                   ) }, t.name);
                 })
               }
+            ) : /* @__PURE__ */ (0, import_jsx_runtime24.jsx)(
+              import_material20.Typography,
+              {
+                sx: {
+                  fontSize: "0.7rem",
+                  color: "hsl(var(--muted-foreground))",
+                  opacity: 0.5,
+                  fontStyle: "italic"
+                },
+                children: "No apps"
+              }
             )
           }
         )
@@ -14677,7 +15135,9 @@ var LocalLLMConfig2 = withMcpTheme(LocalLLMConfig_default, "LocalLLMConfig");
   deleteDatastoreItem,
   deleteDatastoreItems,
   diagnoseOutputWarning,
+  extractActionAppNames,
   extractValidatedIngestionApps,
+  extractWorkflowActionAppNames,
   extractWorkflowAppNames,
   fetchApps,
   fetchAppsViaApiConfig,