Studio: embeddable per-product agent (schema, train, chat, actions, embed) - #175
Merged
Conversation
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
syncWebsite used redirect: "follow", so the SSRF guard only checked the initial URL. A public page could 302 to an internal host (cloud metadata, localhost) and be followed, pulling secrets into stored content. Now every redirect hop is re-validated against the guard via manual redirects.
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
A "use server" file may only export async server actions, so the sync revalidateStudioPaths helper broke the build. Moved it to a plain server-only module (revalidate.ts) and updated imports.
Co-authored-by: Cursor <cursoragent@cursor.com>
…s instantly The Train page awaited getOrCreateProduct + listContent + listActions before rendering anything, so the whole page (including the preview) blocked on three DB round-trips. Now only the product is awaited up front; the content and actions lists stream in via Suspense with skeletons, so the shell, add-content cards, and the live preview appear right away. Inlined the old TrainContentPanel into the page and removed it.
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Studio — an embeddable, per-product agent. A product trains an agent on its content, connects actions it can run, and drops one script tag onto its own site. The agent answers from that content and can run the product's actions, confirm-gated.
This is Stage 1 (current rails: server card + classic payments). The non-custodial Soroban policy wallet is a later track; everything here is built to extend into it.
What's included
packages/database):products,product_content,product_actions(+ enums, relations, migration0016). One agent per account.apps/dashboard): a single-agent section with Train / Test / Deploy / Inbox / Settings sidebar items./api/widget/[publicKey]/chat): grounded in the product's enabled content, CORS, per-key rate limit,?preview=1for drafts. Returns{ reply, action }; chat only proposes actions.public/embed.js(Shadow DOM, XSS-safe rendering, calls only the Tael base) + a public brandingconfigendpoint (returns only name/greeting/brandColor/logoUrl).Security
syncWebsitere-validates every redirect hop against the SSRF guard (no 302-to-internal-host).Notes
0016is already applied to the shared database, so prod has the tables.revalidateStudioPathslives in a plain server module (a"use server"file may only export async actions).Testing
pnpm typecheckgreen across the repo; changed files pass eslint + prettier.