lint-fix

packages/components/src/utils.ts

@@ -1500,9 +1500,29 @@ export const executeJavaScriptCode = async (
 
             const sbx = await Sandbox.create({ apiKey: process.env.E2B_APIKEY, timeoutMs })
 
+            // Determine which libraries to install
+            const librariesToInstall = new Set<string>(libraries)
+
+            // Auto-detect required libraries from code
+            // Extract required modules from import/require statements
+            const importRegex = /(?:import\s+.*?\s+from\s+['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\))/g
+            let match
+            while ((match = importRegex.exec(code)) !== null) {
+                const moduleName = match[1] || match[2]
+                // Extract base module name (e.g., 'typeorm' from 'typeorm/something')
+                const baseModuleName = moduleName.split('/')[0]
+                librariesToInstall.add(baseModuleName)
+            }
+
             // Install libraries
-            for (const library of libraries) {
-                await sbx.commands.run(`npm install ${library}`)
+            for (const library of librariesToInstall) {
+                // Validate library name to prevent command injection.
+                const validPackageNameRegex = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/
+                if (validPackageNameRegex.test(library)) {
+                    await sbx.commands.run(`npm install ${library}`)
+                } else {
+                    console.warn(`[Sandbox] Skipping installation of invalid module: ${library}`)
+                }
             }
 
             // Separate imports from the rest of the code for proper ES6 module structure

packages/server/marketplaces/agentflowsv2/SQL Agent.json

@@ -284,7 +284,7 @@
                 "inputAnchors": [],
                 "inputs": {
                     "customFunctionInputVariables": "",
-                    "customFunctionJavascriptFunction": "const { DataSource } = require('typeorm');\n\nconst HOST = 'localhost';\nconst USER = 'testuser';\nconst PASSWORD = 'testpwd';\nconst DATABASE = 'abudhabi';\nconst PORT = 5555;\n\nlet sqlSchemaPrompt = '';\n\nconst AppDataSource = new DataSource({\n  type: 'postgres',\n  host: HOST,\n  port: PORT,\n  username: USER,\n  password: PASSWORD,\n  database: DATABASE,\n  synchronize: false,\n  logging: false,\n});\n\nasync function getSQLPrompt() {\n  try {\n    await AppDataSource.initialize();\n    const queryRunner = AppDataSource.createQueryRunner();\n\n    // Get all user-defined tables (excluding system tables)\n    const tablesResult = await queryRunner.query(`\n      SELECT table_name\n      FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_type = 'BASE TABLE'\n    `);\n\n    for (const tableRow of tablesResult) {\n      const tableName = tableRow.table_name;\n\n      const schemaInfo = await queryRunner.query(`\n        SELECT column_name, data_type, is_nullable\n        FROM information_schema.columns\n        WHERE table_name = '${tableName}'\n      `);\n\n      const createColumns = [];\n      const columnNames = [];\n\n      for (const column of schemaInfo) {\n        const name = column.column_name;\n        const type = column.data_type.toUpperCase();\n        const notNull = column.is_nullable === 'NO' ? 'NOT NULL' : '';\n        columnNames.push(name);\n        createColumns.push(`${name} ${type} ${notNull}`);\n      }\n\n      const sqlCreateTableQuery = `CREATE TABLE ${tableName} (${createColumns.join(', ')})`;\n      const sqlSelectTableQuery = `SELECT * FROM ${tableName} LIMIT 3`;\n\n      let allValues = [];\n      try {\n        const rows = await queryRunner.query(sqlSelectTableQuery);\n\n        allValues = rows.map(row =>\n          columnNames.map(col => row[col]).join(' ')\n        );\n      } catch (err) {\n        allValues.push('[ERROR FETCHING ROWS]');\n      }\n\n      sqlSchemaPrompt +=\n        sqlCreateTableQuery +\n        '\\n' +\n        sqlSelectTableQuery +\n        '\\n' +\n        columnNames.join(' ') +\n        '\\n' +\n        allValues.join('\\n') +\n        '\\n\\n';\n    }\n\n    await queryRunner.release();\n  } catch (err) {\n    console.error(err);\n    throw err;\n  }\n}\n\nasync function main() {\n  await getSQLPrompt();\n}\n\nawait main();\n\nreturn sqlSchemaPrompt;\n",
+                    "customFunctionJavascriptFunction": "const { DataSource } = require('typeorm');\nconst { Pool } = require('pg');\n\nconst HOST = 'localhost';\nconst USER = 'testuser';\nconst PASSWORD = 'testpwd';\nconst DATABASE = 'abudhabi';\nconst PORT = 5555;\n\nlet sqlSchemaPrompt = '';\n\nconst AppDataSource = new DataSource({\n  type: 'postgres',\n  host: HOST,\n  port: PORT,\n  username: USER,\n  password: PASSWORD,\n  database: DATABASE,\n  synchronize: false,\n  logging: false,\n});\n\nasync function getSQLPrompt() {\n  try {\n    await AppDataSource.initialize();\n    const queryRunner = AppDataSource.createQueryRunner();\n\n    // Get all user-defined tables (excluding system tables)\n    const tablesResult = await queryRunner.query(`\n      SELECT table_name\n      FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_type = 'BASE TABLE'\n    `);\n\n    for (const tableRow of tablesResult) {\n      const tableName = tableRow.table_name;\n\n      const schemaInfo = await queryRunner.query(`\n        SELECT column_name, data_type, is_nullable\n        FROM information_schema.columns\n        WHERE table_name = '${tableName}'\n      `);\n\n      const createColumns = [];\n      const columnNames = [];\n\n      for (const column of schemaInfo) {\n        const name = column.column_name;\n        const type = column.data_type.toUpperCase();\n        const notNull = column.is_nullable === 'NO' ? 'NOT NULL' : '';\n        columnNames.push(name);\n        createColumns.push(`${name} ${type} ${notNull}`);\n      }\n\n      const sqlCreateTableQuery = `CREATE TABLE ${tableName} (${createColumns.join(', ')})`;\n      const sqlSelectTableQuery = `SELECT * FROM ${tableName} LIMIT 3`;\n\n      let allValues = [];\n      try {\n        const rows = await queryRunner.query(sqlSelectTableQuery);\n\n        allValues = rows.map(row =>\n          columnNames.map(col => row[col]).join(' ')\n        );\n      } catch (err) {\n        allValues.push('[ERROR FETCHING ROWS]');\n      }\n\n      sqlSchemaPrompt +=\n        sqlCreateTableQuery +\n        '\\n' +\n        sqlSelectTableQuery +\n        '\\n' +\n        columnNames.join(' ') +\n        '\\n' +\n        allValues.join('\\n') +\n        '\\n\\n';\n    }\n\n    await queryRunner.release();\n  } catch (err) {\n    console.error(err);\n    throw err;\n  }\n}\n\nasync function main() {\n  await getSQLPrompt();\n}\n\nawait main();\n\nreturn sqlSchemaPrompt;\n",
                     "customFunctionUpdateState": ""
                 },
                 "outputAnchors": [
@@ -913,7 +913,7 @@
                             "variableValue": "<p><span class=\"variable\" data-type=\"mention\" data-id=\"$flow.state.sqlQuery\" data-label=\"$flow.state.sqlQuery\">{{ $flow.state.sqlQuery }}</span> </p>"
                         }
                     ],
-                    "customFunctionJavascriptFunction": "const { DataSource } = require('typeorm');\n\n// Configuration\nconst HOST = 'localhost';\nconst USER = 'testuser';\nconst PASSWORD = 'testpwd';\nconst DATABASE = 'abudhabi';\nconst PORT = 5555;\n\nconst sqlQuery = $sqlQuery;\n\nconst AppDataSource = new DataSource({\n  type: 'postgres',\n  host: HOST,\n  port: PORT,\n  username: USER,\n  password: PASSWORD,\n  database: DATABASE,\n  synchronize: false,\n  logging: false,\n});\n\nlet formattedResult = '';\n\nasync function runSQLQuery(query) {\n  try {\n    await AppDataSource.initialize();\n    const queryRunner = AppDataSource.createQueryRunner();\n\n    const rows = await queryRunner.query(query);\n    console.log('rows =', rows);\n\n    if (rows.length === 0) {\n      formattedResult = '[No results returned]';\n    } else {\n      const columnNames = Object.keys(rows[0]);\n      const header = columnNames.join(' ');\n      const values = rows.map(row =>\n        columnNames.map(col => row[col]).join(' ')\n      );\n\n      formattedResult = query + '\\n' + header + '\\n' + values.join('\\n');\n    }\n\n    await queryRunner.release();\n  } catch (err) {\n    console.error('[ERROR]', err);\n    formattedResult = `[Error executing query]: ${err}`;\n  }\n\n  return formattedResult;\n}\n\nasync function main() {\n  formattedResult = await runSQLQuery(sqlQuery);\n}\n\nawait main();\n\nreturn formattedResult;\n",
+                    "customFunctionJavascriptFunction": "const { DataSource } = require('typeorm');\nconst { Pool } = require('pg');\n\n// Configuration\nconst HOST = 'localhost';\nconst USER = 'testuser';\nconst PASSWORD = 'testpwd';\nconst DATABASE = 'abudhabi';\nconst PORT = 5555;\n\nconst sqlQuery = $sqlQuery;\n\nconst AppDataSource = new DataSource({\n  type: 'postgres',\n  host: HOST,\n  port: PORT,\n  username: USER,\n  password: PASSWORD,\n  database: DATABASE,\n  synchronize: false,\n  logging: false,\n});\n\nlet formattedResult = '';\n\nasync function runSQLQuery(query) {\n  try {\n    await AppDataSource.initialize();\n    const queryRunner = AppDataSource.createQueryRunner();\n\n    const rows = await queryRunner.query(query);\n    console.log('rows =', rows);\n\n    if (rows.length === 0) {\n      formattedResult = '[No results returned]';\n    } else {\n      const columnNames = Object.keys(rows[0]);\n      const header = columnNames.join(' ');\n      const values = rows.map(row =>\n        columnNames.map(col => row[col]).join(' ')\n      );\n\n      formattedResult = query + '\\n' + header + '\\n' + values.join('\\n');\n    }\n\n    await queryRunner.release();\n  } catch (err) {\n    console.error('[ERROR]', err);\n    formattedResult = `[Error executing query]: ${err}`;\n  }\n\n  return formattedResult;\n}\n\nasync function main() {\n  formattedResult = await runSQLQuery(sqlQuery);\n}\n\nawait main();\n\nreturn formattedResult;\n",
                     "customFunctionUpdateState": ""
                 },
                 "outputAnchors": [