assistant-ui 0.0.125 → 0.0.127

package/src/lib/cloud-remote.test.ts

@@ -11,14 +11,19 @@ afterEach(() => {
   vi.unstubAllGlobals();
 });
 
-const harness = (reply: CloudCliResponse, token: string | null = "token") => {
+const harness = (
+  reply: CloudCliResponse,
+  token: string | null = "token",
+  extra: Partial<Parameters<typeof runCloudCommand>[1]> = {},
+) => {
   const output = { stdout: "", stderr: "" };
-  const send = vi.fn(async () => reply);
+  const send = vi.fn(async (..._args: unknown[]) => reply);
   return {
     output,
     send,
     run: (args: string[]) =>
       runCloudCommand(args, {
+        ...extra,
         cloudUrl: "https://cloud.example.com",
         accessToken: async () => token,
         stdout: (text) => {
@@ -136,7 +141,7 @@ describe("cloud remote commands", () => {
     expect(init.headers).toMatchObject({ Authorization: "Bearer tok" });
     expect(JSON.parse(init.body as string)).toMatchObject({
       command: "help 'a b'",
-      client: { name: "assistant-ui" },
+      client: { name: "assistant-ui", actions: ["print_url", "open_url"] },
     });
   });
 
@@ -153,4 +158,95 @@ describe("cloud remote commands", () => {
     )[1];
     expect(init.headers).not.toHaveProperty("Authorization");
   });
+
+  it("prints a print_url link on stderr and never opens it", async () => {
+    const openUrl = vi.fn();
+    const { run, output } = harness(
+      {
+        stdout: "Deleting needs a confirmation.\n",
+        exitCode: 0,
+        actions: [
+          {
+            type: "print_url",
+            url: "https://cloud.example.com/o/acme/settings",
+            label: "Confirm in the dashboard",
+          },
+        ],
+      },
+      "token",
+      { interactive: true, openUrl },
+    );
+    await expect(run(["projects", "delete", "web"])).resolves.toBe(0);
+    expect(output).toEqual({
+      stdout: "Deleting needs a confirmation.\n",
+      stderr:
+        "Confirm in the dashboard: https://cloud.example.com/o/acme/settings\n",
+    });
+    expect(openUrl).not.toHaveBeenCalled();
+  });
+
+  it("opens an open_url link only when interactive, without --no-open, on the same Cloud", async () => {
+    const reply = (url: string): CloudCliResponse => ({
+      exitCode: 0,
+      actions: [{ type: "open_url", url }],
+    });
+    const dashboard = "https://cloud.example.com/o/acme";
+    const cases: [boolean, boolean, string, boolean][] = [
+      [true, false, dashboard, true],
+      [true, true, dashboard, false],
+      [false, false, dashboard, false],
+      [true, false, "https://evil.example.org/", false],
+    ];
+    for (const [interactive, noOpen, url, opens] of cases) {
+      const openUrl = vi.fn();
+      const { run, output } = harness(reply(url), "token", {
+        interactive,
+        noOpen,
+        openUrl,
+      });
+      await expect(run(["x"])).resolves.toBe(0);
+      expect(output.stderr).toBe(`Open: ${url}\n`);
+      expect(openUrl).toHaveBeenCalledTimes(opens ? 1 : 0);
+    }
+  });
+
+  it("fails a malformed link action before printing", async () => {
+    for (const url of [undefined, 3, "javascript:alert(1)", "not a url"]) {
+      const { run, output } = harness({
+        stdout: "x\n",
+        exitCode: 0,
+        actions: [{ type: "open_url", url }],
+      });
+      await expect(run(["x"])).resolves.toBe(1);
+      expect(output.stdout).toBe("");
+      expect(output.stderr).toMatch(/malformed "open_url"/);
+    }
+  });
+
+  it("passes the directory's default org and project to the server", async () => {
+    const { run, send } = harness({ exitCode: 0 }, "token", {
+      defaults: async () => ({ org: "org_1", project: "proj_1" }),
+    });
+    await run(["projects", "show"]);
+    expect(send).toHaveBeenCalledWith(
+      "https://cloud.example.com",
+      ["projects", "show"],
+      "token",
+      { org: "org_1", project: "proj_1" },
+    );
+  });
+
+  it("sends defaults in the request body only when there are some", async () => {
+    const fetchMock = vi.fn(async () => Response.json({ exitCode: 0 }));
+    vi.stubGlobal("fetch", fetchMock);
+    await sendCloudCommand("https://cloud.example.com", ["x"], null, {
+      org: "org_1",
+    });
+    await sendCloudCommand("https://cloud.example.com", ["x"], null, {});
+    const bodies = fetchMock.mock.calls.map((call) =>
+      JSON.parse((call as unknown as [string, RequestInit])[1].body as string),
+    );
+    expect(bodies[0].defaults).toEqual({ org: "org_1" });
+    expect(bodies[1]).not.toHaveProperty("defaults");
+  });
 });

package/src/lib/cloud-remote.ts

@@ -4,6 +4,12 @@ export const CLOUD_CLI_RUN_PATH = "/api/cli/run";
 
 export type CloudCliAction = { type: string; [key: string]: unknown };
 
+/**
+ * The organization and project a command uses when it is given no --org or
+ * --project, read from the `.assistant-ui/cloud.json` that setup writes.
+ */
+export type CloudCliDefaults = { org?: string; project?: string };
+
 export type CloudCliResponse = {
   stdout?: string;
   stderr?: string;
@@ -62,6 +68,7 @@ export const sendCloudCommand = async (
   cloudUrl: string,
   args: readonly string[],
   accessToken: string | null,
+  defaults?: CloudCliDefaults | null,
 ): Promise<CloudCliResponse> => {
   const url = `${validateCloudUrl(cloudUrl)}${CLOUD_CLI_RUN_PATH}`;
   let response: Response;
@@ -78,7 +85,10 @@ export const sendCloudCommand = async (
           name: "assistant-ui",
           version: cliVersion,
           platform: `${process.platform}-${process.arch}`,
+          // The server sends only the actions listed here.
+          actions: Object.keys(ACTION_HANDLERS),
         },
+        ...(defaults && (defaults.org || defaults.project) ? { defaults } : {}),
       }),
       redirect: "error",
       signal: AbortSignal.timeout(60_000),
@@ -98,12 +108,62 @@ export const sendCloudCommand = async (
   return body;
 };
 
-// A response naming an action this client lacks fails before printing, so the
-// server can roll a new action out behind the client version it is sent.
-const ACTION_HANDLERS: Record<
-  string,
-  (action: CloudCliAction) => Promise<number>
-> = {};
+type ActionContext = {
+  cloudUrl: string;
+  /** False when the user passed --no-open or no one is at the terminal. */
+  open: boolean;
+  openUrl: (url: string) => void;
+  stderr: (text: string) => void;
+};
+
+type ActionHandler = {
+  /** Checks the action's fields; a malformed action fails before printing. */
+  valid(action: CloudCliAction): boolean;
+  run(action: CloudCliAction, context: ActionContext): Promise<number> | number;
+};
+
+const httpUrl = (value: unknown): URL | null => {
+  if (typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:" ? url : null;
+  } catch {
+    return null;
+  }
+};
+
+const urlAction = (action: CloudCliAction): boolean =>
+  !!httpUrl(action["url"]) &&
+  (action["label"] === undefined || typeof action["label"] === "string");
+
+const printUrl = (action: CloudCliAction, context: ActionContext): void => {
+  const label = (action["label"] as string | undefined) ?? "Open";
+  context.stderr(`${label}: ${action["url"] as string}\n`);
+};
+
+// The request lists these (`client.actions`) and the server sends no others;
+// a response naming one this client lacks still fails before printing.
+const ACTION_HANDLERS: Record<string, ActionHandler> = {
+  print_url: {
+    valid: urlAction,
+    run: (action, context) => {
+      printUrl(action, context);
+      return 0;
+    },
+  },
+  // Prints the link, then opens it in a browser when someone is at the
+  // terminal. Only links on the Cloud the command ran against are opened.
+  open_url: {
+    valid: urlAction,
+    run: (action, context) => {
+      printUrl(action, context);
+      const url = httpUrl(action["url"])!;
+      if (context.open && url.origin === new URL(context.cloudUrl).origin)
+        context.openUrl(url.href);
+      return 0;
+    },
+  },
+};
 
 export const runCloudCommand = async (
   args: readonly string[],
@@ -113,10 +173,20 @@ export const runCloudCommand = async (
     stdout: (text: string) => void;
     stderr: (text: string) => void;
     send?: typeof sendCloudCommand;
+    /** The default org/project for this directory, if setup configured one. */
+    defaults?: () => Promise<CloudCliDefaults | null>;
+    /** Whether someone is at the terminal to see a browser open. */
+    interactive?: boolean;
+    /** --no-open: print links without opening them. */
+    noOpen?: boolean;
+    openUrl?: (url: string) => void;
   },
 ): Promise<number> => {
   let response: CloudCliResponse;
   try {
+    const defaults = deps.defaults
+      ? await deps.defaults().catch(() => null)
+      : null;
     response = await (deps.send ?? sendCloudCommand)(
       deps.cloudUrl,
       args,
@@ -126,6 +196,7 @@ export const runCloudCommand = async (
         );
         return null;
       }),
+      ...(defaults ? [defaults] : []),
     );
   } catch (error) {
     deps.stderr(`${error instanceof Error ? error.message : String(error)}\n`);
@@ -140,10 +211,25 @@ export const runCloudCommand = async (
     );
     return 1;
   }
+  const malformed = response.actions?.find(
+    (action) => !ACTION_HANDLERS[action.type]!.valid(action),
+  );
+  if (malformed) {
+    deps.stderr(
+      `Unexpected response from the server (malformed "${malformed.type}" action).\n`,
+    );
+    return 1;
+  }
   if (response.stdout) deps.stdout(response.stdout);
   if (response.stderr) deps.stderr(response.stderr);
+  const context: ActionContext = {
+    cloudUrl: deps.cloudUrl,
+    open: !deps.noOpen && !!deps.interactive && !!deps.openUrl,
+    openUrl: deps.openUrl ?? (() => {}),
+    stderr: deps.stderr,
+  };
   for (const action of response.actions ?? []) {
-    const code = await ACTION_HANDLERS[action.type]!(action);
+    const code = await ACTION_HANDLERS[action.type]!.run(action, context);
     if (code !== 0) return code;
   }
   return response.exitCode;

package/src/lib/safe-project-file.ts

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import path from "node:path";
+
+export const assertSafeProjectFile = (file: string, projectRoot: string) => {
+  try {
+    if (fs.lstatSync(file).isSymbolicLink()) {
+      throw new Error(`${file} is a symbolic link`);
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+  }
+
+  const root = fs.realpathSync(projectRoot);
+  let parent = path.dirname(file);
+  const missing: string[] = [];
+  while (!fs.existsSync(parent)) {
+    const next = path.dirname(parent);
+    if (next === parent) break;
+    missing.unshift(path.basename(parent));
+    parent = next;
+  }
+  const resolvedParent = path.join(fs.realpathSync(parent), ...missing);
+  const relative = path.relative(root, resolvedParent);
+  if (
+    relative === ".." ||
+    relative.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relative)
+  ) {
+    throw new Error(`${file} has a parent directory outside the project`);
+  }
+};

package/templates/cloud-harness/components/assistant-ui/elements/attachment-state.ts

@@ -0,0 +1,59 @@
+"use client";
+
+import { useAui, useAuiState } from "@assistant-ui/react";
+import { useAttachmentSrc } from "@/hooks/use-attachment-src";
+
+export function useAttachmentState() {
+  const aui = useAui();
+  const isComposer = aui.attachment.source !== "message";
+  const src = useAttachmentSrc();
+
+  const isImage = useAuiState((s) => s.attachment.type === "image");
+  const name = useAuiState((s) => s.attachment.name);
+  const typeLabel = useAuiState((s) => {
+    const type = s.attachment.type;
+    switch (type) {
+      case "image":
+        return "Image";
+      case "document":
+        return "Document";
+      case "file":
+        return "File";
+      default:
+        return type;
+    }
+  });
+
+  // An attachment on a submission is still being prepared, whether or not the
+  // adapter reports progress while it uploads.
+  const uploadState = useAuiState((s) =>
+    s.attachment.status.type === "incomplete" &&
+    s.attachment.status.reason === "error"
+      ? "error"
+      : s.attachment.status.type === "running" ||
+          (s.optional.message?.submission !== undefined &&
+            s.attachment.status.type !== "complete")
+        ? "uploading"
+        : undefined,
+  );
+  const isUploading = uploadState === "uploading";
+  const isError = uploadState === "error";
+
+  const errorMessage = useAuiState((s) =>
+    s.attachment.status.type === "incomplete" &&
+    s.attachment.status.reason === "error"
+      ? (s.attachment.status.message ?? "Upload failed")
+      : undefined,
+  );
+
+  return {
+    isComposer,
+    src,
+    isImage,
+    name,
+    typeLabel,
+    isUploading,
+    isError,
+    errorMessage,
+  };
+}

package/templates/cloud-harness/components/assistant-ui/elements/attachment.aui.tsx

@@ -17,8 +17,6 @@ import {
   AttachmentPrimitive,
   ComposerPrimitive,
   MessagePrimitive,
-  useAuiState,
-  useAui,
 } from "@assistant-ui/react";
 import {
   Tooltip,
@@ -34,7 +32,7 @@ import {
 } from "@/components/ui/dialog";
 import { Avatar, AvatarImage, AvatarFallback } from "@/components/ui/avatar";
 import { TooltipIconButton } from "@/components/assistant-ui/elements/tooltip-icon-button";
-import { useAttachmentSrc } from "@/hooks/use-attachment-src";
+import { useAttachmentState } from "./attachment-state";
 import { cn } from "@/lib/utils";
 
 type AttachmentPreviewProps = {
@@ -112,47 +110,16 @@ const AttachmentThumb: FC<{ src: string | undefined }> = ({ src }) => {
 };
 
 const AttachmentUI: FC = () => {
-  const aui = useAui();
-  const isComposer = aui.attachment.source !== "message";
-  const src = useAttachmentSrc();
-
-  const isImage = useAuiState((s) => s.attachment.type === "image");
-  const name = useAuiState((s) => s.attachment.name);
-  const typeLabel = useAuiState((s) => {
-    const type = s.attachment.type;
-    switch (type) {
-      case "image":
-        return "Image";
-      case "document":
-        return "Document";
-      case "file":
-        return "File";
-      default:
-        return type;
-    }
-  });
-
-  // An attachment on a submission is still being prepared, whether or not the
-  // adapter reports progress while it uploads.
-  const uploadState = useAuiState((s) =>
-    s.attachment.status.type === "incomplete" &&
-    s.attachment.status.reason === "error"
-      ? "error"
-      : s.attachment.status.type === "running" ||
-          (s.optional.message?.submission !== undefined &&
-            s.attachment.status.type !== "complete")
-        ? "uploading"
-        : undefined,
-  );
-  const isUploading = uploadState === "uploading";
-  const isError = uploadState === "error";
-
-  const errorMessage = useAuiState((s) =>
-    s.attachment.status.type === "incomplete" &&
-    s.attachment.status.reason === "error"
-      ? (s.attachment.status.message ?? "Upload failed")
-      : undefined,
-  );
+  const {
+    isComposer,
+    src,
+    isImage,
+    name,
+    typeLabel,
+    isUploading,
+    isError,
+    errorMessage,
+  } = useAttachmentState();
 
   return (
     <TooltipProvider>

package/templates/cloud-harness/components/assistant-ui/elements/thread.aui.tsx

@@ -409,7 +409,7 @@ const AssistantActionBar: FC = () => {
           className="aui-action-bar-more-content bg-popover/95 text-popover-foreground data-[state=open]:fade-in-0 data-[state=open]:zoom-in-95 data-[state=open]:animate-in data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=closed]:animate-out data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 min-w-[8rem] overflow-hidden rounded-xl border p-1.5 shadow-lg backdrop-blur-sm"
         >
           <ActionBarPrimitive.ExportMarkdown asChild>
-            <ActionBarMorePrimitive.Item className="aui-action-bar-more-item hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground flex cursor-pointer items-center gap-2 rounded-lg px-2.5 py-1.5 text-sm outline-none select-none">
+            <ActionBarMorePrimitive.Item className="aui-action-bar-more-item hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground flex items-center gap-2 rounded-lg px-2.5 py-1.5 text-sm outline-none select-none">
               <DownloadIcon className="size-4" />
               Export as Markdown
             </ActionBarMorePrimitive.Item>

package/templates/cloud-harness/package.json

@@ -13,7 +13,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ai-sdk/openai": "^4.0.86",
+    "@ai-sdk/openai": "^4.0.102",
     "@assistant-ui/ai-sdk": "workspace:*",
     "@assistant-ui/core": "workspace:*",
     "@assistant-ui/react": "workspace:*",
@@ -21,30 +21,30 @@
     "@assistant-ui/react-markdown": "workspace:*",
     "@assistant-ui/store": "workspace:*",
     "@assistant-ui/tap": "workspace:*",
-    "@base-ui/react": "^1.8.0",
-    "ai": "^7.0.130",
+    "@base-ui/react": "^1.9.0",
+    "ai": "^7.0.153",
     "assistant-cloud": "workspace:*",
     "class-variance-authority": "^0.7.1",
-    "cn": "^0.4.0",
+    "cn": "^0.5.0",
     "harness-sdk": "file:vendor/harness-sdk-0.3.1.tgz",
-    "lucide-react": "^1.52.0",
-    "next": "^16.4.1",
-    "react": "^19.3.0",
-    "react-dom": "^19.3.0",
+    "lucide-react": "^1.61.0",
+    "next": "^16.4.3",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "remark-gfm": "^4.0.1",
     "statewire": "file:vendor/statewire-0.19.3.tgz",
     "tw-animate-css": "^1.4.0",
     "tw-shimmer": "^0.4.14",
-    "zustand": "^5.0.15"
+    "zustand": "^5.0.16"
   },
   "devDependencies": {
     "@assistant-ui/next": "workspace:*",
     "@tailwindcss/postcss": "^4.3.3",
-    "@types/node": "^26.6.4",
+    "@types/node": "^26.6.5",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "oxfmt": "^0.72.0",
-    "oxlint": "^1.87.0",
+    "oxfmt": "^0.74.0",
+    "oxlint": "^1.89.0",
     "tailwindcss": "^4.3.3",
     "typescript": "^7.0.2"
   }

package/templates/cloud-harness/.gitignore

@@ -1,42 +0,0 @@
-# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
-
-# dependencies
-/node_modules
-/.pnp
-.pnp.*
-.yarn/*
-!.yarn/patches
-!.yarn/plugins
-!.yarn/releases
-!.yarn/versions
-
-# testing
-/coverage
-
-# next.js
-/.next/
-/out/
-
-# production
-/build
-
-# misc
-.DS_Store
-*.pem
-
-# debug
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-.pnpm-debug.log*
-
-# env files (can opt-in for committing if needed)
-.env*
-!.env.example
-
-# vercel
-.vercel
-
-# typescript
-*.tsbuildinfo
-next-env.d.ts