Build an app builder with a database

const token = crypto.randomBytes(24).toString("hex");
const hash = crypto.createHash("sha256").update(token).digest("hex");

const inst = await (await fetch("https://api.agent37.com/v1/instances", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.AGENT37_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    template: "agent37-hermes",
    name: "apps-u_882",
    budget: { credit_micros: 2000000 },
    env: { APP_PUBLISH_TOKEN: token },
    metadata: { app: "app-builder", app_publish_token_sha256: hash },
  }),
})).json();

App context (from the app-builder app, not the user):
You are the building agent behind an app builder. Users ask you for small web apps
that keep data. Every app gets its own folder, its own port, and its own Postgres
database. For each new app:
1. Pick a short slug and work in ~/apps/<slug>. Pick a port from 8800 to 8899 that
   no other app uses (grep PORT= ~/apps/*/start.sh shows the ones taken).
2. Create the app's database:
   cd ~/apps/<slug> && npx -y neon@latest claim create --project-name <slug> --file .env
   This needs no account or token. It writes DATABASE_URL into ~/apps/<slug>/.env.
   Never share a database between apps, and never show a connection string to the user.
3. Build the app as a Node server in ~/apps/<slug>/server.js that listens on
   process.env.PORT, connects with the pg package and process.env.DATABASE_URL, and
   creates its tables at startup with CREATE TABLE IF NOT EXISTS.
4. Write ~/apps/<slug>/start.sh, exactly this with your slug and port, and run it:
   cd ~/apps/<slug>
   [ -f app.pid ] && kill "$(cat app.pid)" 2>/dev/null
   set -a; . ./.env; set +a
   PORT=<port> nohup node server.js >app.log 2>&1 &
   echo $! > app.pid
5. Append "sh ~/apps/<slug>/start.sh" to ~/.agent37/hooks/post-restart.sh if it is
   not already there.
6. Check that curl -s http://localhost:<port>/ answers, then publish it:
   curl -s -X POST https://your-app.com/api/publish \
     -H "Authorization: Bearer $APP_PUBLISH_TOKEN" \
     -H "Content-Type: application/json" \
     -d "{\"instance_id\":\"$AGENT37_INSTANCE_ID\",\"app\":\"<slug>\",\"port\":<port>}"
7. Give the user the "url" from the response. Tell them the link is public, and that
   the database is free and temporary until they claim it.
End of app context. The user message follows.

app.post("/api/publish", async (c) => {
  const token = (c.req.header("authorization") || "").replace(/^Bearer\s+/i, "");
  const { instance_id, app: slug, port } = await c.req.json();
  if (port < 8800 || port > 8899) return c.json({ error: "port_not_allowed" }, 400);

  const inst = await (await fetch(
    `https://api.agent37.com/v1/instances/${instance_id}`,
    { headers: { Authorization: `Bearer ${process.env.AGENT37_API_KEY}` } }
  )).json();
  const hash = crypto.createHash("sha256").update(token).digest("hex");
  if (inst.metadata?.app_publish_token_sha256 !== hash) {
    return c.json({ error: "forbidden" }, 403);
  }

  const created = await fetch(
    `https://api.agent37.com/v1/instances/${instance_id}/public-ports`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.AGENT37_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ port, label: `app:${slug}` }),
    }
  );
  if (created.ok) return c.json({ url: (await created.json()).url });
  // 409 public_port_exists: look the URL up with GET .../public-ports and return it,
  // so republishing is idempotent (see the website builder guide).
  return c.json({ error: "publish_failed" }, 502);
});

{
  "exit_code": 0,
  "stdout": "{\n  \"project_id\": \"cool-wave-50682049\",\n  \"state\": \"unclaimed\",\n  \"reconciled\": false,\n  \"project_expires_at\": \"2026-11-07T12:34:53.831Z\"\n}\n",
  "stderr": "",
  "truncated": false
}

{
  "project_id": "cool-wave-50682049",
  "user_code": "FMJ8-BDBM",
  "verification_url": "https://claimable.neon.tech/claim?user_code=FMJ8-BDBM",
  "expires_in_seconds": 900
}

// start.sh loads .env with sh, so accept only a plain postgres URL: no quotes, $,
// backticks, backslashes, or whitespace for the shell to act on.
const plain = /^postgres(ql)?:\/\/[^"'`$\\\s]+$/.test(newUrl) && Boolean(new URL(newUrl).hostname);
if (!plain) throw new Error("Paste the connection string exactly as Neon shows it.");

// Base64 carries the value into the command, and single quotes in .env keep sh from
// expanding anything when start.sh loads it.
const b64 = Buffer.from(newUrl).toString("base64");
const command =
  `cd ~/apps/guestbook && ` +
  `{ printf "DATABASE_URL='%s'\\n" "$(echo ${b64} | base64 -d)"; grep -v '^DATABASE_URL' .env; } > .env.new && ` +
  `mv .env.new .env && sh start.sh`;

await fetch("https://sandbox.agent37.app/v1/instances/ab12cd34ef/exec", {
  method: "POST",
  headers: { "X-Agent37-Key": process.env.AGENT37_API_KEY, "Content-Type": "application/json" },
  body: JSON.stringify({ command }),
});