assistant-ui 0.0.126 → 0.0.128

package/src/lib/cloud-provision.ts

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import path from "node:path";
 import { readOptionalFile, writeCloudFile } from "./cloud-config";
+import { assertSafeProjectFile } from "./safe-project-file";
 import { validateCloudUrl } from "./cloud-auth";
 
 export type CloudProvisionRequest = {
@@ -28,6 +29,7 @@ export const resolveProvisionRequest = async (
   accessCode?: string,
 ): Promise<CloudProvisionRequest> => {
   const file = path.join(directory, ".assistant-ui", "provision.json");
+  assertSafeProjectFile(file, directory);
   const previous = await readOptionalFile(file);
   let request: CloudProvisionRequest;
   if (previous) {
@@ -42,6 +44,7 @@ export const resolveProvisionRequest = async (
     request = { ...input, idempotency_key: randomUUID() };
     await writeCloudFile(file, `${JSON.stringify(request, null, 2)}\n`, {
       exclusive: true,
+      projectRoot: directory,
     });
   }
   return { ...request, ...(accessCode ? { access_code: accessCode } : {}) };

package/src/lib/cloud-remote.test.ts

@@ -11,14 +11,19 @@ afterEach(() => {
   vi.unstubAllGlobals();
 });
 
-const harness = (reply: CloudCliResponse, token: string | null = "token") => {
+const harness = (
+  reply: CloudCliResponse,
+  token: string | null = "token",
+  extra: Partial<Parameters<typeof runCloudCommand>[1]> = {},
+) => {
   const output = { stdout: "", stderr: "" };
-  const send = vi.fn(async () => reply);
+  const send = vi.fn(async (..._args: unknown[]) => reply);
   return {
     output,
     send,
     run: (args: string[]) =>
       runCloudCommand(args, {
+        ...extra,
         cloudUrl: "https://cloud.example.com",
         accessToken: async () => token,
         stdout: (text) => {
@@ -136,7 +141,7 @@ describe("cloud remote commands", () => {
     expect(init.headers).toMatchObject({ Authorization: "Bearer tok" });
     expect(JSON.parse(init.body as string)).toMatchObject({
       command: "help 'a b'",
-      client: { name: "assistant-ui" },
+      client: { name: "assistant-ui", actions: ["print_url", "open_url"] },
     });
   });
 
@@ -153,4 +158,95 @@ describe("cloud remote commands", () => {
     )[1];
     expect(init.headers).not.toHaveProperty("Authorization");
   });
+
+  it("prints a print_url link on stderr and never opens it", async () => {
+    const openUrl = vi.fn();
+    const { run, output } = harness(
+      {
+        stdout: "Deleting needs a confirmation.\n",
+        exitCode: 0,
+        actions: [
+          {
+            type: "print_url",
+            url: "https://cloud.example.com/o/acme/settings",
+            label: "Confirm in the dashboard",
+          },
+        ],
+      },
+      "token",
+      { interactive: true, openUrl },
+    );
+    await expect(run(["projects", "delete", "web"])).resolves.toBe(0);
+    expect(output).toEqual({
+      stdout: "Deleting needs a confirmation.\n",
+      stderr:
+        "Confirm in the dashboard: https://cloud.example.com/o/acme/settings\n",
+    });
+    expect(openUrl).not.toHaveBeenCalled();
+  });
+
+  it("opens an open_url link only when interactive, without --no-open, on the same Cloud", async () => {
+    const reply = (url: string): CloudCliResponse => ({
+      exitCode: 0,
+      actions: [{ type: "open_url", url }],
+    });
+    const dashboard = "https://cloud.example.com/o/acme";
+    const cases: [boolean, boolean, string, boolean][] = [
+      [true, false, dashboard, true],
+      [true, true, dashboard, false],
+      [false, false, dashboard, false],
+      [true, false, "https://evil.example.org/", false],
+    ];
+    for (const [interactive, noOpen, url, opens] of cases) {
+      const openUrl = vi.fn();
+      const { run, output } = harness(reply(url), "token", {
+        interactive,
+        noOpen,
+        openUrl,
+      });
+      await expect(run(["x"])).resolves.toBe(0);
+      expect(output.stderr).toBe(`Open: ${url}\n`);
+      expect(openUrl).toHaveBeenCalledTimes(opens ? 1 : 0);
+    }
+  });
+
+  it("fails a malformed link action before printing", async () => {
+    for (const url of [undefined, 3, "javascript:alert(1)", "not a url"]) {
+      const { run, output } = harness({
+        stdout: "x\n",
+        exitCode: 0,
+        actions: [{ type: "open_url", url }],
+      });
+      await expect(run(["x"])).resolves.toBe(1);
+      expect(output.stdout).toBe("");
+      expect(output.stderr).toMatch(/malformed "open_url"/);
+    }
+  });
+
+  it("passes the directory's default org and project to the server", async () => {
+    const { run, send } = harness({ exitCode: 0 }, "token", {
+      defaults: async () => ({ org: "org_1", project: "proj_1" }),
+    });
+    await run(["projects", "show"]);
+    expect(send).toHaveBeenCalledWith(
+      "https://cloud.example.com",
+      ["projects", "show"],
+      "token",
+      { org: "org_1", project: "proj_1" },
+    );
+  });
+
+  it("sends defaults in the request body only when there are some", async () => {
+    const fetchMock = vi.fn(async () => Response.json({ exitCode: 0 }));
+    vi.stubGlobal("fetch", fetchMock);
+    await sendCloudCommand("https://cloud.example.com", ["x"], null, {
+      org: "org_1",
+    });
+    await sendCloudCommand("https://cloud.example.com", ["x"], null, {});
+    const bodies = fetchMock.mock.calls.map((call) =>
+      JSON.parse((call as unknown as [string, RequestInit])[1].body as string),
+    );
+    expect(bodies[0].defaults).toEqual({ org: "org_1" });
+    expect(bodies[1]).not.toHaveProperty("defaults");
+  });
 });

package/src/lib/cloud-remote.ts

@@ -4,6 +4,12 @@ export const CLOUD_CLI_RUN_PATH = "/api/cli/run";
 
 export type CloudCliAction = { type: string; [key: string]: unknown };
 
+/**
+ * The organization and project a command uses when it is given no --org or
+ * --project, read from the `.assistant-ui/cloud.json` that setup writes.
+ */
+export type CloudCliDefaults = { org?: string; project?: string };
+
 export type CloudCliResponse = {
   stdout?: string;
   stderr?: string;
@@ -62,6 +68,7 @@ export const sendCloudCommand = async (
   cloudUrl: string,
   args: readonly string[],
   accessToken: string | null,
+  defaults?: CloudCliDefaults | null,
 ): Promise<CloudCliResponse> => {
   const url = `${validateCloudUrl(cloudUrl)}${CLOUD_CLI_RUN_PATH}`;
   let response: Response;
@@ -78,7 +85,10 @@ export const sendCloudCommand = async (
           name: "assistant-ui",
           version: cliVersion,
           platform: `${process.platform}-${process.arch}`,
+          // The server sends only the actions listed here.
+          actions: Object.keys(ACTION_HANDLERS),
         },
+        ...(defaults && (defaults.org || defaults.project) ? { defaults } : {}),
       }),
       redirect: "error",
       signal: AbortSignal.timeout(60_000),
@@ -98,12 +108,62 @@ export const sendCloudCommand = async (
   return body;
 };
 
-// A response naming an action this client lacks fails before printing, so the
-// server can roll a new action out behind the client version it is sent.
-const ACTION_HANDLERS: Record<
-  string,
-  (action: CloudCliAction) => Promise<number>
-> = {};
+type ActionContext = {
+  cloudUrl: string;
+  /** False when the user passed --no-open or no one is at the terminal. */
+  open: boolean;
+  openUrl: (url: string) => void;
+  stderr: (text: string) => void;
+};
+
+type ActionHandler = {
+  /** Checks the action's fields; a malformed action fails before printing. */
+  valid(action: CloudCliAction): boolean;
+  run(action: CloudCliAction, context: ActionContext): Promise<number> | number;
+};
+
+const httpUrl = (value: unknown): URL | null => {
+  if (typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:" ? url : null;
+  } catch {
+    return null;
+  }
+};
+
+const urlAction = (action: CloudCliAction): boolean =>
+  !!httpUrl(action["url"]) &&
+  (action["label"] === undefined || typeof action["label"] === "string");
+
+const printUrl = (action: CloudCliAction, context: ActionContext): void => {
+  const label = (action["label"] as string | undefined) ?? "Open";
+  context.stderr(`${label}: ${action["url"] as string}\n`);
+};
+
+// The request lists these (`client.actions`) and the server sends no others;
+// a response naming one this client lacks still fails before printing.
+const ACTION_HANDLERS: Record<string, ActionHandler> = {
+  print_url: {
+    valid: urlAction,
+    run: (action, context) => {
+      printUrl(action, context);
+      return 0;
+    },
+  },
+  // Prints the link, then opens it in a browser when someone is at the
+  // terminal. Only links on the Cloud the command ran against are opened.
+  open_url: {
+    valid: urlAction,
+    run: (action, context) => {
+      printUrl(action, context);
+      const url = httpUrl(action["url"])!;
+      if (context.open && url.origin === new URL(context.cloudUrl).origin)
+        context.openUrl(url.href);
+      return 0;
+    },
+  },
+};
 
 export const runCloudCommand = async (
   args: readonly string[],
@@ -113,10 +173,20 @@ export const runCloudCommand = async (
     stdout: (text: string) => void;
     stderr: (text: string) => void;
     send?: typeof sendCloudCommand;
+    /** The default org/project for this directory, if setup configured one. */
+    defaults?: () => Promise<CloudCliDefaults | null>;
+    /** Whether someone is at the terminal to see a browser open. */
+    interactive?: boolean;
+    /** --no-open: print links without opening them. */
+    noOpen?: boolean;
+    openUrl?: (url: string) => void;
   },
 ): Promise<number> => {
   let response: CloudCliResponse;
   try {
+    const defaults = deps.defaults
+      ? await deps.defaults().catch(() => null)
+      : null;
     response = await (deps.send ?? sendCloudCommand)(
       deps.cloudUrl,
       args,
@@ -126,6 +196,7 @@ export const runCloudCommand = async (
         );
         return null;
       }),
+      ...(defaults ? [defaults] : []),
     );
   } catch (error) {
     deps.stderr(`${error instanceof Error ? error.message : String(error)}\n`);
@@ -140,10 +211,25 @@ export const runCloudCommand = async (
     );
     return 1;
   }
+  const malformed = response.actions?.find(
+    (action) => !ACTION_HANDLERS[action.type]!.valid(action),
+  );
+  if (malformed) {
+    deps.stderr(
+      `Unexpected response from the server (malformed "${malformed.type}" action).\n`,
+    );
+    return 1;
+  }
   if (response.stdout) deps.stdout(response.stdout);
   if (response.stderr) deps.stderr(response.stderr);
+  const context: ActionContext = {
+    cloudUrl: deps.cloudUrl,
+    open: !deps.noOpen && !!deps.interactive && !!deps.openUrl,
+    openUrl: deps.openUrl ?? (() => {}),
+    stderr: deps.stderr,
+  };
   for (const action of response.actions ?? []) {
-    const code = await ACTION_HANDLERS[action.type]!(action);
+    const code = await ACTION_HANDLERS[action.type]!.run(action, context);
     if (code !== 0) return code;
   }
   return response.exitCode;

package/src/lib/cloud-url.ts

@@ -1,3 +1,8 @@
+const isLoopbackHostname = (hostname: string): boolean =>
+  hostname === "localhost" ||
+  hostname === "[::1]" ||
+  /^127(?:\.\d{1,3}){3}$/.test(hostname);
+
 export const validateCloudUrl = (value: string): string => {
   const url = new URL(value);
   if (
@@ -6,10 +11,7 @@ export const validateCloudUrl = (value: string): string => {
     url.search ||
     url.hash ||
     (url.protocol !== "https:" &&
-      !(
-        url.protocol === "http:" &&
-        ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)
-      ))
+      !(url.protocol === "http:" && isLoopbackHostname(url.hostname)))
   ) {
     throw new Error(
       "Cloud, accounts and setup URLs must use HTTPS or HTTP localhost for development.",

package/src/lib/safe-project-file.ts

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import path from "node:path";
+
+export const assertSafeProjectFile = (file: string, projectRoot: string) => {
+  try {
+    if (fs.lstatSync(file).isSymbolicLink()) {
+      throw new Error(`${file} is a symbolic link`);
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+  }
+
+  const root = fs.realpathSync(projectRoot);
+  let parent = path.dirname(file);
+  const missing: string[] = [];
+  while (!fs.existsSync(parent)) {
+    const next = path.dirname(parent);
+    if (next === parent) break;
+    missing.unshift(path.basename(parent));
+    parent = next;
+  }
+  const resolvedParent = path.join(fs.realpathSync(parent), ...missing);
+  const relative = path.relative(root, resolvedParent);
+  if (
+    relative === ".." ||
+    relative.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relative)
+  ) {
+    throw new Error(`${file} has a parent directory outside the project`);
+  }
+};

package/templates/cloud-harness/components/assistant-ui/elements/thread.aui.tsx

@@ -409,7 +409,7 @@ const AssistantActionBar: FC = () => {
           className="aui-action-bar-more-content bg-popover/95 text-popover-foreground data-[state=open]:fade-in-0 data-[state=open]:zoom-in-95 data-[state=open]:animate-in data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=closed]:animate-out data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 min-w-[8rem] overflow-hidden rounded-xl border p-1.5 shadow-lg backdrop-blur-sm"
         >
           <ActionBarPrimitive.ExportMarkdown asChild>
-            <ActionBarMorePrimitive.Item className="aui-action-bar-more-item hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground flex cursor-pointer items-center gap-2 rounded-lg px-2.5 py-1.5 text-sm outline-none select-none">
+            <ActionBarMorePrimitive.Item className="aui-action-bar-more-item hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground flex items-center gap-2 rounded-lg px-2.5 py-1.5 text-sm outline-none select-none">
               <DownloadIcon className="size-4" />
               Export as Markdown
             </ActionBarMorePrimitive.Item>

package/templates/cloud-harness/components/assistant-ui/elements/tool-fallback.aui.tsx

@@ -141,15 +141,19 @@ function ToolFallbackDuration({
 function ToolFallbackTrigger({
   toolName,
   status,
+  isError,
   responseDeliveryStatus,
   className,
   ...props
 }: React.ComponentProps<typeof CollapsibleTrigger> & {
   toolName: string;
   status?: ToolCallMessagePartStatus;
+  isError?: ToolCallMessagePart["isError"];
   responseDeliveryStatus?: ToolCallMessagePart["responseDeliveryStatus"];
 }) {
-  const statusType = status?.type ?? "complete";
+  const reportedType = status?.type ?? "complete";
+  const statusType =
+    reportedType === "complete" && isError ? "incomplete" : reportedType;
   const isRunning = statusType === "running";
   const isCancelled =
     status?.type === "incomplete" && status.reason === "cancelled";
@@ -1198,6 +1202,7 @@ const ToolFallbackImpl: ToolCallMessagePartComponent = ({
   toolName,
   argsText,
   result,
+  isError,
   status,
   responseDeliveryStatus,
   addResult,
@@ -1251,6 +1256,7 @@ const ToolFallbackImpl: ToolCallMessagePartComponent = ({
       <ToolFallbackTrigger
         toolName={toolName}
         status={status}
+        isError={isError}
         responseDeliveryStatus={responseDeliveryStatus}
       />
       <ToolFallbackContent>

package/templates/cloud-harness/package.json

@@ -13,7 +13,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ai-sdk/openai": "^4.0.96",
+    "@ai-sdk/openai": "^4.0.102",
     "@assistant-ui/ai-sdk": "workspace:*",
     "@assistant-ui/core": "workspace:*",
     "@assistant-ui/react": "workspace:*",
@@ -22,20 +22,20 @@
     "@assistant-ui/store": "workspace:*",
     "@assistant-ui/tap": "workspace:*",
     "@base-ui/react": "^1.9.0",
-    "ai": "^7.0.143",
+    "ai": "^7.0.153",
     "assistant-cloud": "workspace:*",
     "class-variance-authority": "^0.7.1",
     "cn": "^0.5.0",
     "harness-sdk": "file:vendor/harness-sdk-0.3.1.tgz",
-    "lucide-react": "^1.59.0",
-    "next": "^16.4.2",
+    "lucide-react": "^1.61.0",
+    "next": "^16.4.5",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
     "remark-gfm": "^4.0.1",
     "statewire": "file:vendor/statewire-0.19.3.tgz",
     "tw-animate-css": "^1.4.0",
     "tw-shimmer": "^0.4.14",
-    "zustand": "^5.0.15"
+    "zustand": "^5.0.16"
   },
   "devDependencies": {
     "@assistant-ui/next": "workspace:*",
@@ -43,8 +43,8 @@
     "@types/node": "^26.6.5",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "oxfmt": "^0.73.0",
-    "oxlint": "^1.88.0",
+    "oxfmt": "^0.74.0",
+    "oxlint": "^1.89.0",
     "tailwindcss": "^4.3.3",
     "typescript": "^7.0.2"
   }