0.5.0 beta.10 by sbaker · Pull Request #49 · Prompd/prompd-app

sbaker · 2026-06-22T03:21:41Z

No description provided.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Update licenses.json to reflect @prompd/app@0.5.0-beta.6 (previously beta.5). Keeps the public license manifest in sync with the package version change.

Introduce a disk-based package cache and UI to browse/use cached packages. Adds CacheIpcRegistration (cache:list, cache:readFile, cache:download, cache:delete, cache:getPath, cache:fileTree) to manage ~/.prompd/cache, with ZIP download, extraction, path-safety and file-tree building. Exposes cache APIs in preload and updates electron.d.ts types. Adds RegistrySearchBar for package discovery on the WelcomeView (instant suggestions + debounced search) and a full PackageExplorerPanel to browse workspace/global/cache packages with actions (open, copy, inherit, install, delete, view on hub). Wire the new panel into App.tsx (auto-expand after download, pass packageSource through execution flow) and register CacheIpc in main.js. Several UI tweaks: ActivityBar label updated and analytics sync location noted. New/modified files include CacheIpcRegistration.js, RegistrySearchBar.tsx, PackageExplorerPanel.tsx, preload/main/App/electron.d.ts updates and related wiring.

- Registry search bar: descriptions from registry, contextual placeholder, hint text, chevron affordance, offline state, keyboard hints, wider layout - Registry search overlay (Ctrl+Shift+D): search packages from anywhere with tabs open, focuses WelcomeView search when no tabs - Package install: fix global install failing due to workspace path validation, pass global flag through to CLI - /install command: add --global/-g flag support, remove workspace requirement for global installs - Bump version to 0.5.0-beta.7 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Reject absolute ZIP entry paths during cache extraction (P1) - Use path separator boundary check for cache delete validation (P2) - Fix stale openRegistrySearch closure in menu IPC listener (P2) - Remove broken UpdateBanner component Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Override file: symlink with npm version for CI TypeScript checks - Exclude WysiwygEditor, WysiwygToolbar, and tiptap extension from tsc (depends on @tiptap packages not yet in package.json) - Stop deleting package-lock.json in CI Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…vements Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Pin @tiptap packages to 3.19.0 (3.20.x ships without dist/) - Add ts-nocheck to WIP WysiwygEditor/Toolbar (API compat issues) - Restore clean tsconfig.json without excludes Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- New @prompd/test package: TestRunner, TestParser, TestDiscovery, evaluators (NLP, Script, Prmd), reporters (Console, JSON, JUnit) - .test.prmd sidecar convention with auto-discovery, parameterized test cases, and LLM-based evaluation - Test Explorer sidebar panel with expandable tree view, run all/no-llm actions - Test Results bottom panel with collapsible suite groups, expandable test cards, and assertion details - Provider/Model selector for test execution independent from editor - IPC bridge (TestIpcRegistration) for Electron main process test execution - Monaco IntelliSense: skip validation warnings for .test.prmd built-in vars (prompt, response, params) - Context menu "Create Test File" on .prmd files in file explorer - Flask icon in editor header only for .test.prmd files - Status bar test run summary - Update @prompd/cli to ^0.5.0-beta.9 across all packages (frontend, backend, scheduler, test) - Add ModelCapabilities system to CLI provider layer (useMaxCompletionTokens, noTemperature, noSystemMessage) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…st.prmd - Update @prompd/test to ^0.5.0-beta.9 from npm (was file: symlink) - Re-include node_modules/@prompd/test in electron-builder files (excluded by !**/test/** glob) - Hide execute button in editor header for .test.prmd files - Bump @prompd/test version to 0.5.0-beta.9 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Bump all package versions to 0.5.0-beta.10 - Test explorer, evaluator, and store updates for beta.10 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Update @prompd/cli to 0.5.0-beta.10 across frontend, backend, and test packages - Fix test file scaffold: add missing version field, fix comment syntax to HTML comments - Disable Design view for .test.prmd files (tiptap strips HTML comments) - Update prmd-test.svg icon border to match green theme - Fix typo: "defults" -> "defaults" in scaffold comments Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… checks - Thread AbortSignal from IPC into TestRunner via options.signal for proper cancellation - Preserve evaluate field in parser for NLP, Script, and Prmd assertions - Script evaluator: exit 0=pass, exit 1=fail, other=error (was treating all non-zero as fail) - Add min_words/max_words to parser NLP check allowlist Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…th fixes Add the server-side surface the browser agent harness talks to: - chatCompletions.js: OpenAI-compatible chat-completions gateway (thin Clerk- authed passthrough to the user's provider key) - tools.js + ToolsService.js: external agent tools (Tavily web search) with per-user encrypted keys and a Prompd-paid env fallback - mcp.js + McpProxyService.js: per-user remote MCP server registration and a stateless tools/list + tools/call proxy (server keys encrypted, never sent to the agent) - User.js: externalTools + mcpServers schemas and accessors; userId virtual (= clerkUserId) so consumers reading req.user.userId resolve correctly - pricing/ModelsDevSource.js + BasePricingFetcher.js: live models.dev catalog source for pricing/context/capabilities - server.js: wire the new routes; SSE-safe compression filter so streaming responses (text/event-stream) are not buffered - compilation.js / llmProviders.js / CompilationService.js: supporting changes - frontend licenses.json: regenerated Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…eway - chatCompletions: gate server-key usage by the accounts execution quota (402 quota_exceeded); BYO-key users stay unlimited; meter one execution only when the server key was used and OpenAI accepted the request. - Restrict forwarded models to gpt-4.1-mini / gpt-4o-mini. - Sync backend lockfile to @prompd/cli 0.5.0-beta.10 (npm ci was failing). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chatCompletions: with no own key, fall back to the server key gated by validateAiQuota (402 quota_exceeded) AND the free model allowlist (403 model_not_allowed), metered on success; own-key users stay unlimited and any-model. llm-providers: expose hasKey on /available so the client shows full catalogs for owned providers. pricing: throttle reseed-all (one run at a time, at most once per 60s) so the client refresh button can't hammer provider APIs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 693f5c18e9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-06-22T03:27:42Z

-    "@tiptap/pm": "^3.19.0",
-    "@tiptap/react": "^3.19.0",
-    "@tiptap/starter-kit": "^3.19.0",
+    "@prompd/test": "^0.5.0-beta.9",


Use the local beta.10 test package in the app

In the Electron app context, TestIpcRegistration loads @prompd/test from frontend/node_modules, and the lockfile currently resolves this dependency to the published 0.5.0-beta.9 tarball. That means the beta.10 implementation added under packages/test is built by the root script but is not what the frontend requires or packages, so the new Test Explorer can run against stale code. Point this at file:../packages/test like the other local packages, or bump and lock it to the beta.10 package that contains these APIs.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-06-22T03:27:42Z

+
+const addSchema = Joi.object({
+  label: Joi.string().min(1).max(80).required(),
+  url: Joi.string().uri({ scheme: ['http', 'https'] }).required(),


Block private MCP URLs before proxying

When this backend is deployed, any authenticated user can register an MCP server URL such as http://127.0.0.1:... or http://169.254.169.254/..., and the new /api/mcp/tools and /api/mcp/call handlers will POST to it from the server and return response details. This creates an SSRF path into the backend's internal network/metadata services; restrict MCP targets to HTTPS public hosts and reject localhost, link-local, and private IP ranges after DNS resolution.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-06-22T03:27:42Z

+    } else if (context && typeof context === 'object') {
+      compiled = (context as { compiledResult?: string }).compiledResult || '';
+      metadata = (context as { metadata?: Record<string, unknown> }).metadata || {};


Fail tests when compilation context has errors

For prompts where compileWithContext() records hasErrors()/errors but still returns a partial compiledResult, this path treats compilation as successful and proceeds to execute/evaluate it. That makes expect_error cases report failure and can mark invalid prompts as passing whenever the compiler produced any output; check the context diagnostics and throw before accepting compiledResult.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-06-22T03:27:42Z

+    const normalizedScript = path.normalize(resolvedPath);
+    const normalizedBase = path.normalize(this.testFileDir);
+    if (!normalizedScript.startsWith(normalizedBase)) {


Keep script assertions inside the test directory

The startsWith containment check accepts sibling paths that share the same prefix, e.g. with a test directory /repo/tests, run: ../tests-evil/check.js normalizes to /repo/tests-evil/check.js and still passes this guard. Since this evaluator intentionally rejects scripts outside the test tree, use path.relative() or append a path separator boundary before allowing the script to run.

Useful? React with 👍 / 👎.

sbaker and others added 20 commits March 12, 2026 19:35

Bump to 0.5.0-beta.6

74dba62

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Bump @prompd/app version in licenses.json

f1c7f34

Update licenses.json to reflect @prompd/app@0.5.0-beta.6 (previously beta.5). Keeps the public license manifest in sync with the package version change.

Bump to 0.5.0-beta.8, update @prompd/cli to ^0.5.0-beta.7

8982ad4

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add beta.8 feature work: intellisense, editor, workflow, and UI impro…

0c362da

…vements Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Fix CI: delete lockfile after overriding CLI dep for Linux rollup compat

1bf542f

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Fix CI: add --legacy-peer-deps for tiptap-markdown peer conflict

40c2bb9

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Bump to 0.5.0-beta.10: version bumps and test explorer improvements

14b5cfa

- Bump all package versions to 0.5.0-beta.10 - Test explorer, evaluator, and store updates for beta.10 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Merge main into 0.5.0-beta.10: resolve conflicts

5fc507d

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chatgpt-codex-connector Bot reviewed Jun 22, 2026

View reviewed changes

Merge branch 'main' into 0.5.0-beta.10

87b3a51

sbaker merged commit 7a69ec3 into main Jun 22, 2026
4 of 5 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

0.5.0 beta.10 - #49

0.5.0 beta.10#49
sbaker merged 21 commits into
mainfrom
0.5.0-beta.10

sbaker commented Jun 22, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

sbaker commented Jun 22, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant