chore: bump next to 16.2.6 for additional CVE fixes

Agent-Logs-Url: https://github.com/soconnor0919/hristudio/sessions/7450cc95-9c00-40dc-b652-fca3024486d9

Co-authored-by: soconnor0919 <44291434+soconnor0919@users.noreply.github.com>

bun.lock

@@ -56,12 +56,12 @@
         "cmdk": "^1.1.1",
         "date-fns": "^4.1.0",
         "driver.js": "^1.4.0",
-        "drizzle-orm": "^0.41.0",
+        "drizzle-orm": "^0.45.2",
         "html2pdf.js": "^0.14.0",
         "js-cookie": "^3.0.5",
         "lucide-react": "^0.536.0",
         "minio": "^8.0.6",
-        "next": "16.2.1",
+        "next": "16.2.6",
         "next-auth": "^5.0.0-beta.30",
         "next-themes": "^0.4.6",
         "postgres": "^3.4.8",
@@ -438,25 +438,25 @@
 
     "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@0.2.12", "", { "dependencies": { "@emnapi/core": "^1.4.3", "@emnapi/runtime": "^1.4.3", "@tybys/wasm-util": "^0.10.0" } }, "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ=="],
 
-    "@next/env": ["@next/env@16.2.1", "", {}, "sha512-n8P/HCkIWW+gVal2Z8XqXJ6aB3J0tuM29OcHpCsobWlChH/SITBs1DFBk/HajgrwDkqqBXPbuUuzgDvUekREPg=="],
+    "@next/env": ["@next/env@16.2.6", "", {}, "sha512-gd8HoHN4ufj73WmR3JmVolrpJR47ILK6LouP5xElPglaVxir6e1a7VzvTvDWkOoPXT9rkkTzyCxBu4yeZfZwcw=="],
 
     "@next/eslint-plugin-next": ["@next/eslint-plugin-next@16.2.1", "", { "dependencies": { "fast-glob": "3.3.1" } }, "sha512-r0epZGo24eT4g08jJlg2OEryBphXqO8aL18oajoTKLzHJ6jVr6P6FI58DLMug04MwD3j8Fj0YK0slyzneKVyzA=="],
 
-    "@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.2.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-BwZ8w8YTaSEr2HIuXLMLxIdElNMPvY9fLqb20LX9A9OMGtJilhHLbCL3ggyd0TwjmMcTxi0XXt+ur1vWUoxj2Q=="],
+    "@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.2.6", "", { "os": "darwin", "cpu": "arm64" }, "sha512-ZJGkkcNfYgrrMkqOdZ7zoLa1TOy0qpcMfk/z4Mh/FKUz40gVO+HNQWqmLxf67Z5WB64DRp0dhEbyHfel+6sJUg=="],
 
-    "@next/swc-darwin-x64": ["@next/swc-darwin-x64@16.2.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-/vrcE6iQSJq3uL3VGVHiXeaKbn8Es10DGTGRJnRZlkNQQk3kaNtAJg8Y6xuAlrx/6INKVjkfi5rY0iEXorZ6uA=="],
+    "@next/swc-darwin-x64": ["@next/swc-darwin-x64@16.2.6", "", { "os": "darwin", "cpu": "x64" }, "sha512-v/YLBHIY132Ced3puBJ7YJKw1lqsCrgcNo2aRJlCEyQrrCeRJlvGlnmxhPxNQI3KE3N1DN5r9TPNPvka3nq5RQ=="],
 
-    "@next/swc-linux-arm64-gnu": ["@next/swc-linux-arm64-gnu@16.2.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-uLn+0BK+C31LTVbQ/QU+UaVrV0rRSJQ8RfniQAHPghDdgE+SlroYqcmFnO5iNjNfVWCyKZHYrs3Nl0mUzWxbBw=="],
+    "@next/swc-linux-arm64-gnu": ["@next/swc-linux-arm64-gnu@16.2.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-RPOvqlYBbcQjkz9VQQDZ2T2bARIjXZV1KFlt+V2Mr6SW/e4I9fcKsaA0hdyf2FHoTlsV2xnBd5Y912rP/1Ce6w=="],
 
-    "@next/swc-linux-arm64-musl": ["@next/swc-linux-arm64-musl@16.2.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-ssKq6iMRnHdnycGp9hCuGnXJZ0YPr4/wNwrfE5DbmvEcgl9+yv97/Kq3TPVDfYome1SW5geciLB9aiEqKXQjlQ=="],
+    "@next/swc-linux-arm64-musl": ["@next/swc-linux-arm64-musl@16.2.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-URUTu1+dMkxJsPFgm+OeEvq9wf5sujw0EvgYy80TDGHTSLTnIHeqb0Eu8A3sC95IRgjejQL+kC4mw+4yPxiAXA=="],
 
-    "@next/swc-linux-x64-gnu": ["@next/swc-linux-x64-gnu@16.2.1", "", { "os": "linux", "cpu": "x64" }, "sha512-HQm7SrHRELJ30T1TSmT706IWovFFSRGxfgUkyWJZF/RKBMdbdRWJuFrcpDdE5vy9UXjFOx6L3mRdqH04Mmx0hg=="],
+    "@next/swc-linux-x64-gnu": ["@next/swc-linux-x64-gnu@16.2.6", "", { "os": "linux", "cpu": "x64" }, "sha512-DOj182mPV8G3UkrayLoREM5YEYI+Dk5wv7Ox9xl1fFibAELEsFD0lDPfHIeILlutMMfdyhlzYPELG3peuKaurw=="],
 
-    "@next/swc-linux-x64-musl": ["@next/swc-linux-x64-musl@16.2.1", "", { "os": "linux", "cpu": "x64" }, "sha512-aV2iUaC/5HGEpbBkE+4B8aHIudoOy5DYekAKOMSHoIYQ66y/wIVeaRx8MS2ZMdxe/HIXlMho4ubdZs/J8441Tg=="],
+    "@next/swc-linux-x64-musl": ["@next/swc-linux-x64-musl@16.2.6", "", { "os": "linux", "cpu": "x64" }, "sha512-HKQ5SP/V/ub73UvF7n/zeJlxk2kLmtL7Wzrg4WfmkjmNos5onJ2tKu7yZOPdL18A6Svfn3max29ym+ry7NkK4g=="],
 
-    "@next/swc-win32-arm64-msvc": ["@next/swc-win32-arm64-msvc@16.2.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-IXdNgiDHaSk0ZUJ+xp0OQTdTgnpx1RCfRTalhn3cjOP+IddTMINwA7DXZrwTmGDO8SUr5q2hdP/du4DcrB1GxA=="],
+    "@next/swc-win32-arm64-msvc": ["@next/swc-win32-arm64-msvc@16.2.6", "", { "os": "win32", "cpu": "arm64" }, "sha512-LZXpTlPyS5v7HhSmnvsLGP3iIYgYOBnc8r8ArlT55sGHV89bR2HlDdBjWQ+PY6SJMmk8TuVGFuxalnP3k/0Dwg=="],
 
-    "@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.2.1", "", { "os": "win32", "cpu": "x64" }, "sha512-qvU+3a39Hay+ieIztkGSbF7+mccbbg1Tk25hc4JDylf8IHjYmY/Zm64Qq1602yPyQqvie+vf5T/uPwNxDNIoeg=="],
+    "@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.2.6", "", { "os": "win32", "cpu": "x64" }, "sha512-F0+4i0h9J6C4eE3EAPWsoCk7UW/dbzOjyzxY0qnDUOYFu6FFmdZ6l97/XdV3/Nz3VYyO7UWjyEJUXkGqcoXfMA=="],
 
     "@noble/ciphers": ["@noble/ciphers@2.1.1", "", {}, "sha512-bysYuiVfhxNJuldNXlFEitTVdNnYUc+XNJZd7Qm2a5j1vZHgY+fazadNFWFaMK/2vye0JVlxV3gHmC0WDfAOQw=="],
 
@@ -1088,7 +1088,7 @@
 
     "callsites": ["callsites@3.1.0", "", {}, "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ=="],
 
-    "caniuse-lite": ["caniuse-lite@1.0.30001731", "", {}, "sha512-lDdp2/wrOmTRWuoB5DpfNkC0rJDU8DqRa6nYL6HK6sytw70QMopt/NIc/9SM7ylItlBWfACXk0tEn37UWM/+mg=="],
+    "caniuse-lite": ["caniuse-lite@1.0.30001780", "", {}, "sha512-llngX0E7nQci5BPJDqoZSbuZ5Bcs9F5db7EtgfwBerX9XGtkkiO4NwfDDIRzHTTwcYC8vC7bmeUEPGrKlR/TkQ=="],
 
     "canvg": ["canvg@3.0.11", "", { "dependencies": { "@babel/runtime": "^7.12.5", "@types/raf": "^3.4.0", "core-js": "^3.8.3", "raf": "^3.4.1", "regenerator-runtime": "^0.13.7", "rgbcolor": "^1.0.1", "stackblur-canvas": "^2.0.0", "svg-pathdata": "^6.0.3" } }, "sha512-5ON+q7jCTgMp9cjpu4Jo6XbvfYwSB2Ow3kzHKfIyJfaCAOHLbdKPQqGKgfED/R5B+3TFFfe8pegYA+b423SRyA=="],
 
@@ -1174,7 +1174,7 @@
 
     "drizzle-kit": ["drizzle-kit@0.30.6", "", { "dependencies": { "@drizzle-team/brocli": "^0.10.2", "@esbuild-kit/esm-loader": "^2.5.5", "esbuild": "^0.19.7", "esbuild-register": "^3.5.0", "gel": "^2.0.0" }, "bin": { "drizzle-kit": "bin.cjs" } }, "sha512-U4wWit0fyZuGuP7iNmRleQyK2V8wCuv57vf5l3MnG4z4fzNTjY/U13M8owyQ5RavqvqxBifWORaR3wIUzlN64g=="],
 
-    "drizzle-orm": ["drizzle-orm@0.41.0", "", { "peerDependencies": { "@aws-sdk/client-rds-data": ">=3", "@cloudflare/workers-types": ">=4", "@electric-sql/pglite": ">=0.2.0", "@libsql/client": ">=0.10.0", "@libsql/client-wasm": ">=0.10.0", "@neondatabase/serverless": ">=0.10.0", "@op-engineering/op-sqlite": ">=2", "@opentelemetry/api": "^1.4.1", "@planetscale/database": ">=1", "@prisma/client": "*", "@tidbcloud/serverless": "*", "@types/better-sqlite3": "*", "@types/pg": "*", "@types/sql.js": "*", "@vercel/postgres": ">=0.8.0", "@xata.io/client": "*", "better-sqlite3": ">=7", "bun-types": "*", "expo-sqlite": ">=14.0.0", "gel": ">=2", "knex": "*", "kysely": "*", "mysql2": ">=2", "pg": ">=8", "postgres": ">=3", "sql.js": ">=1", "sqlite3": ">=5" }, "optionalPeers": ["@aws-sdk/client-rds-data", "@cloudflare/workers-types", "@electric-sql/pglite", "@libsql/client", "@libsql/client-wasm", "@neondatabase/serverless", "@op-engineering/op-sqlite", "@opentelemetry/api", "@planetscale/database", "@prisma/client", "@tidbcloud/serverless", "@types/better-sqlite3", "@types/pg", "@types/sql.js", "@vercel/postgres", "@xata.io/client", "better-sqlite3", "bun-types", "expo-sqlite", "gel", "knex", "kysely", "mysql2", "pg", "postgres", "sql.js", "sqlite3"] }, "sha512-7A4ZxhHk9gdlXmTdPj/lREtP+3u8KvZ4yEN6MYVxBzZGex5Wtdc+CWSbu7btgF6TB0N+MNPrvW7RKBbxJchs/Q=="],
+    "drizzle-orm": ["drizzle-orm@0.45.2", "", { "peerDependencies": { "@aws-sdk/client-rds-data": ">=3", "@cloudflare/workers-types": ">=4", "@electric-sql/pglite": ">=0.2.0", "@libsql/client": ">=0.10.0", "@libsql/client-wasm": ">=0.10.0", "@neondatabase/serverless": ">=0.10.0", "@op-engineering/op-sqlite": ">=2", "@opentelemetry/api": "^1.4.1", "@planetscale/database": ">=1.13", "@prisma/client": "*", "@tidbcloud/serverless": "*", "@types/better-sqlite3": "*", "@types/pg": "*", "@types/sql.js": "*", "@upstash/redis": ">=1.34.7", "@vercel/postgres": ">=0.8.0", "@xata.io/client": "*", "better-sqlite3": ">=7", "bun-types": "*", "expo-sqlite": ">=14.0.0", "gel": ">=2", "knex": "*", "kysely": "*", "mysql2": ">=2", "pg": ">=8", "postgres": ">=3", "prisma": "*", "sql.js": ">=1", "sqlite3": ">=5" }, "optionalPeers": ["@aws-sdk/client-rds-data", "@cloudflare/workers-types", "@electric-sql/pglite", "@libsql/client", "@libsql/client-wasm", "@neondatabase/serverless", "@op-engineering/op-sqlite", "@opentelemetry/api", "@planetscale/database", "@prisma/client", "@tidbcloud/serverless", "@types/better-sqlite3", "@types/pg", "@types/sql.js", "@upstash/redis", "@vercel/postgres", "@xata.io/client", "better-sqlite3", "bun-types", "expo-sqlite", "gel", "knex", "kysely", "mysql2", "pg", "postgres", "prisma", "sql.js", "sqlite3"] }, "sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q=="],
 
     "dunder-proto": ["dunder-proto@1.0.1", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="],
 
@@ -1562,7 +1562,7 @@
 
     "natural-compare": ["natural-compare@1.4.0", "", {}, "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw=="],
 
-    "next": ["next@16.2.1", "", { "dependencies": { "@next/env": "16.2.1", "@swc/helpers": "0.5.15", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", "postcss": "8.4.31", "styled-jsx": "5.1.6" }, "optionalDependencies": { "@next/swc-darwin-arm64": "16.2.1", "@next/swc-darwin-x64": "16.2.1", "@next/swc-linux-arm64-gnu": "16.2.1", "@next/swc-linux-arm64-musl": "16.2.1", "@next/swc-linux-x64-gnu": "16.2.1", "@next/swc-linux-x64-musl": "16.2.1", "@next/swc-win32-arm64-msvc": "16.2.1", "@next/swc-win32-x64-msvc": "16.2.1", "sharp": "^0.34.5" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "sass": "^1.3.0" }, "optionalPeers": ["@opentelemetry/api", "@playwright/test", "babel-plugin-react-compiler", "sass"], "bin": { "next": "dist/bin/next" } }, "sha512-VaChzNL7o9rbfdt60HUj8tev4m6d7iC1igAy157526+cJlXOQu5LzsBXNT+xaJnTP/k+utSX5vMv7m0G+zKH+Q=="],
+    "next": ["next@16.2.6", "", { "dependencies": { "@next/env": "16.2.6", "@swc/helpers": "0.5.15", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", "postcss": "8.4.31", "styled-jsx": "5.1.6" }, "optionalDependencies": { "@next/swc-darwin-arm64": "16.2.6", "@next/swc-darwin-x64": "16.2.6", "@next/swc-linux-arm64-gnu": "16.2.6", "@next/swc-linux-arm64-musl": "16.2.6", "@next/swc-linux-x64-gnu": "16.2.6", "@next/swc-linux-x64-musl": "16.2.6", "@next/swc-win32-arm64-msvc": "16.2.6", "@next/swc-win32-x64-msvc": "16.2.6", "sharp": "^0.34.5" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "sass": "^1.3.0" }, "optionalPeers": ["@opentelemetry/api", "@playwright/test", "babel-plugin-react-compiler", "sass"], "bin": { "next": "dist/bin/next" } }, "sha512-qOVgKJg1+At15NpeUP+eJgCHvTCgXsogweq87Ri/Ix7PkqQHg4sdaXmSFqKlgaIXE4kW0g25LE68W87UANlHtw=="],
 
     "next-auth": ["next-auth@5.0.0-beta.30", "", { "dependencies": { "@auth/core": "0.41.0" }, "peerDependencies": { "@simplewebauthn/browser": "^9.0.1", "@simplewebauthn/server": "^9.0.2", "next": "^14.0.0-0 || ^15.0.0 || ^16.0.0", "nodemailer": "^7.0.7", "react": "^18.2.0 || ^19.0.0" }, "optionalPeers": ["@simplewebauthn/browser", "@simplewebauthn/server", "nodemailer"] }, "sha512-+c51gquM3F6nMVmoAusRJ7RIoY0K4Ts9HCCwyy/BRoe4mp3msZpOzYMyb5LAYc1wSo74PMQkGDcaghIO7W6Xjg=="],
 
@@ -2098,8 +2098,6 @@
 
     "@typescript-eslint/typescript-estree/semver": ["semver@7.7.3", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q=="],
 
-    "browserslist/caniuse-lite": ["caniuse-lite@1.0.30001780", "", {}, "sha512-llngX0E7nQci5BPJDqoZSbuZ5Bcs9F5db7EtgfwBerX9XGtkkiO4NwfDDIRzHTTwcYC8vC7bmeUEPGrKlR/TkQ=="],
-
     "cmdk/@radix-ui/react-dialog": ["@radix-ui/react-dialog@1.1.14", "", { "dependencies": { "@radix-ui/primitive": "1.1.2", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-dismissable-layer": "1.1.10", "@radix-ui/react-focus-guards": "1.1.2", "@radix-ui/react-focus-scope": "1.1.7", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-portal": "1.1.9", "@radix-ui/react-presence": "1.1.4", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-slot": "1.2.3", "@radix-ui/react-use-controllable-state": "1.2.2", "aria-hidden": "^1.2.4", "react-remove-scroll": "^2.6.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-+CpweKjqpzTmwRwcYECQcNYbI8V9VSQt0SNFKeEBLgfucbsLssU6Ppq7wUdNXEGb573bMjFhVjKVll8rmV6zMw=="],
 
     "cross-spawn/which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],

package.json

@@ -79,12 +79,12 @@
     "cmdk": "^1.1.1",
     "date-fns": "^4.1.0",
     "driver.js": "^1.4.0",
-    "drizzle-orm": "^0.41.0",
+    "drizzle-orm": "^0.45.2",
     "html2pdf.js": "^0.14.0",
     "js-cookie": "^3.0.5",
     "lucide-react": "^0.536.0",
     "minio": "^8.0.6",
-    "next": "16.2.1",
+    "next": "16.2.6",
     "next-auth": "^5.0.0-beta.30",
     "next-themes": "^0.4.6",
     "postgres": "^3.4.8",

src/app/api/robots/command/route.ts

@@ -21,27 +21,27 @@ export async function POST(request: NextRequest) {
     const body = await request.json();
     const { action, studyId, robotId, parameters } = body;
 
-    // Verify user has access to the study
-    const membership = await db.query.studyMembers.findFirst({
-      where: and(
-        eq(studyMembers.studyId, studyId),
-        eq(studyMembers.userId, session.user.id),
-      ),
-    });
-
-    if (!membership || !["owner", "researcher"].includes(membership.role)) {
-      return NextResponse.json(
-        { error: "Insufficient permissions" },
-        { status: 403 },
-      );
-    }
-
     const robotIp =
       process.env.NAO_ROBOT_IP || process.env.NAO_IP || "134.82.159.168";
     const password = process.env.NAO_PASSWORD || "robolab";
 
     switch (action) {
       case "initialize": {
+        // Requires study membership
+        const membership = await db.query.studyMembers.findFirst({
+          where: and(
+            eq(studyMembers.studyId, studyId),
+            eq(studyMembers.userId, session.user.id),
+          ),
+        });
+
+        if (!membership || !["owner", "researcher"].includes(membership.role)) {
+          return NextResponse.json(
+            { error: "Insufficient permissions" },
+            { status: 403 },
+          );
+        }
+
         console.log(`[Robots API] Initializing robot at ${robotIp}`);
 
         const disableAlCmd = `sshpass -p "${password}" ssh -o StrictHostKeyChecking=no "nao@${robotIp}" "python2 -c \\"import sys; sys.path.append('/opt/aldebaran/lib/python2.7/site-packages'); import naoqi; al = naoqi.ALProxy('ALAutonomousLife', '127.0.0.1', 9559); al.setState('disabled')\\""`;
@@ -58,6 +58,21 @@ export async function POST(request: NextRequest) {
       }
 
       case "executeSystemAction": {
+        // Requires study membership
+        const membership = await db.query.studyMembers.findFirst({
+          where: and(
+            eq(studyMembers.studyId, studyId),
+            eq(studyMembers.userId, session.user.id),
+          ),
+        });
+
+        if (!membership || !["owner", "researcher"].includes(membership.role)) {
+          return NextResponse.json(
+            { error: "Insufficient permissions" },
+            { status: 403 },
+          );
+        }
+
         const { id, parameters: actionParams } = parameters ?? {};
         console.log(`[Robots API] Executing system action ${id}`);
 
@@ -145,7 +160,9 @@ export async function POST(request: NextRequest) {
       }
 
       case "executeSSH": {
-        const { command } = parameters ?? {};
+        // Session auth is sufficient — no studyId needed
+        // command may be top-level in body or nested under parameters
+        const { command } = parameters ?? body;
         if (!command) {
           return NextResponse.json(
             { error: "Missing command parameter" },

src/components/experiments/designer/PropertiesPanel.tsx

@@ -835,6 +835,40 @@ export function PropertiesPanelBase({
                   </SelectContent>
                 </Select>
               </div>
+              <div>
+                <Label className="text-xs">After this step, go to</Label>
+                <p className="text-muted-foreground mb-1 text-[10px]">
+                  Override the next step (use to converge branch paths).
+                </p>
+                <Select
+                  value={(selectedStep.trigger.conditions as any)?.nextStepId ?? "__linear__"}
+                  onValueChange={(val) => {
+                    onStepUpdate(selectedStep.id, {
+                      trigger: {
+                        ...selectedStep.trigger,
+                        conditions: {
+                          ...(selectedStep.trigger.conditions as any),
+                          nextStepId: val === "__linear__" ? undefined : val,
+                        },
+                      },
+                    });
+                  }}
+                >
+                  <SelectTrigger className="mt-1 h-7 w-full text-xs">
+                    <SelectValue placeholder="Next step (default)" />
+                  </SelectTrigger>
+                  <SelectContent>
+                    <SelectItem value="__linear__">Next step (default)</SelectItem>
+                    {design.steps
+                      .filter((s) => s.id !== selectedStep.id)
+                      .map((s) => (
+                        <SelectItem key={s.id} value={s.id}>
+                          {s.name}
+                        </SelectItem>
+                      ))}
+                  </SelectContent>
+                </Select>
+              </div>
             </div>
           </div>
         </div>

src/components/trials/wizard/WizardInterface.tsx

@@ -430,8 +430,7 @@ export const WizardInterface = React.memo(function WizardInterface({
         order: step.order ?? index,
         actions:
           step.actions
-            ?.filter((a) => a.type !== "branch")
+            ?.map((action) => ({
-            .map((action) => ({
               id: action.id,
               name: action.name,
               description: action.description,
@@ -793,8 +792,11 @@ export const WizardInterface = React.memo(function WizardInterface({
       );
     }
 
-    // Default: Linear progression
+    // Default: Linear progression (skip steps marked as skipped by branching)
-    const nextIndex = currentStepIndex + 1;
+    let nextIndex = currentStepIndex + 1;
+    while (nextIndex < steps.length && skippedSteps.has(nextIndex)) {
+      nextIndex++;
+    }
     if (nextIndex < steps.length) {
       // Mark current step as complete
       setCompletedSteps((prev) => {
@@ -923,8 +925,8 @@ export const WizardInterface = React.memo(function WizardInterface({
       // Log action execution
       console.log("Executing action:", actionId, parameters);
 
-      // Handle branching logic (wizard_wait_for_response)
+      // Handle branching logic (wizard_wait_for_response / branch)
-      if (parameters?.value && parameters?.label) {
+      if (parameters?.label || parameters?.nextStepId) {
         setLastResponse(String(parameters.value));
 
         // If nextStepId is provided, jump immediately
@@ -943,6 +945,24 @@ export const WizardInterface = React.memo(function WizardInterface({
             console.log(
               `[WizardInterface] Choice-based jump to step ${targetIndex} (${nextId})`,
             );
+
+            // Mark other branch targets as skipped so linear progression bypasses them
+            const branchingStep = steps[currentStepIndex];
+            const allOptions =
+              (branchingStep?.conditions?.options as any[]) ?? [];
+            setSkippedSteps((prev) => {
+              const next = new Set(prev);
+              for (const opt of allOptions) {
+                if (opt.nextStepId && opt.nextStepId !== nextId) {
+                  const otherIdx = steps.findIndex(
+                    (s) => s.id === opt.nextStepId,
+                  );
+                  if (otherIdx !== -1) next.add(otherIdx);
+                }
+              }
+              return next;
+            });
+
             handleNextStep(targetIndex);
             return; // Exit after jump
           } else {

src/components/trials/wizard/panels/WizardActionItem.tsx

@@ -499,6 +499,7 @@ export function WizardActionItem({
                 // Manual/Wizard Actions (Leaf nodes)
                 !isContainer &&
                 action.type !== "wizard_wait_for_response" &&
+                !isBranch &&
                 !isCompleted && (
                   <Button
                     size="sm"
@@ -524,7 +525,7 @@ export function WizardActionItem({
               <div className="grid grid-cols-1 gap-2 pt-3 sm:grid-cols-2">
                 {(action.parameters.options as any[]).map((opt, optIdx) => {
                   const label = typeof opt === "string" ? opt : opt.label;
-                  const value = typeof opt === "string" ? opt : opt.value;
+                  const value = typeof opt === "string" ? opt : (opt.value ?? opt.label);
                   const nextStepId =
                     typeof opt === "object" ? opt.nextStepId : undefined;
 

src/server/api/routers/experiments.ts

@@ -675,8 +675,11 @@ export const experimentsRouter = createTRPCRouter({
           // Delete existing steps and actions for this experiment
           await ctx.db.delete(steps).where(eq(steps.experimentId, id));
 
+          // Map from designer temp step ID → new DB UUID (for branch nextStepId fix-up)
+          const stepIdMap = new Map<string, string>();
+
           // Create new steps and actions
-          for (const convertedStep of convertedSteps) {
+          for (const [i, convertedStep] of convertedSteps.entries()) {
             const [newStep] = await ctx.db
               .insert(steps)
               .values({
@@ -698,6 +701,10 @@ export const experimentsRouter = createTRPCRouter({
               });
             }
 
+            // Record temp ID → real UUID so branch nextStepId refs can be fixed up
+            const tempId = normalizedSteps[i]?.id;
+            if (tempId) stepIdMap.set(tempId, newStep.id);
+
             // Create actions for this step
             for (const convertedAction of convertedStep.actions) {
               await ctx.db.insert(actions).values({
@@ -724,6 +731,25 @@ export const experimentsRouter = createTRPCRouter({
               });
             }
           }
+
+          // Fix-up branch nextStepId: replace temp designer IDs with real DB UUIDs
+          // in both action parameters and step conditions
+          for (const [tempId, dbId] of stepIdMap) {
+            await ctx.db.execute(
+              sql`UPDATE ${actions}
+                  SET parameters = replace(parameters::text, ${tempId}, ${dbId})::jsonb
+                  WHERE step_id IN (
+                    SELECT id FROM ${steps} WHERE experiment_id = ${id}
+                  )
+                  AND parameters::text LIKE ${"%" + tempId + "%"}`,
+            );
+            await ctx.db.execute(
+              sql`UPDATE ${steps}
+                  SET conditions = replace(conditions::text, ${tempId}, ${dbId})::jsonb
+                  WHERE experiment_id = ${id}
+                  AND conditions::text LIKE ${"%" + tempId + "%"}`,
+            );
+          }
         } catch (error) {
           throw new TRPCError({
             code: "INTERNAL_SERVER_ERROR",

src/server/api/routers/trials.ts

@@ -593,7 +593,7 @@ export const trialsRouter = createTRPCRouter({
       });
 
       // Broadcast trial status update
-      await wsManager.broadcast(input.id, {
+      await wsManager.broadcastExternal(input.id, {
         type: "trial_status",
         data: {
           trial: trial[0],
@@ -655,7 +655,7 @@ export const trialsRouter = createTRPCRouter({
       });
 
       // Broadcast trial status update
-      await wsManager.broadcast(input.id, {
+      await wsManager.broadcastExternal(input.id, {
         type: "trial_status",
         data: {
           trial,
@@ -718,7 +718,7 @@ export const trialsRouter = createTRPCRouter({
       });
 
       // Broadcast trial status update
-      await wsManager.broadcast(input.id, {
+      await wsManager.broadcastExternal(input.id, {
         type: "trial_status",
         data: {
           trial: trial[0],
@@ -878,7 +878,7 @@ export const trialsRouter = createTRPCRouter({
         .returning();
 
       // Broadcast new event to all subscribers
-      await wsManager.broadcast(input.trialId, {
+      await wsManager.broadcastExternal(input.trialId, {
         type: "trial_event",
         data: {
           event,
@@ -922,7 +922,7 @@ export const trialsRouter = createTRPCRouter({
         .returning();
 
       // Broadcast intervention to all subscribers
-      await wsManager.broadcast(input.trialId, {
+      await wsManager.broadcastExternal(input.trialId, {
         type: "intervention_logged",
         data: {
           intervention,
@@ -986,7 +986,7 @@ export const trialsRouter = createTRPCRouter({
       }
 
       // Broadcast annotation to all subscribers
-      await wsManager.broadcast(input.trialId, {
+      await wsManager.broadcastExternal(input.trialId, {
         type: "annotation_added",
         data: {
           annotation,
@@ -1380,7 +1380,7 @@ export const trialsRouter = createTRPCRouter({
         .returning();
 
       // Broadcast robot action to all subscribers
-      await wsManager.broadcast(input.trialId, {
+      await wsManager.broadcastExternal(input.trialId, {
         type: "trial_action_executed",
         data: {
           action_type: `${input.pluginName}.${input.actionId}`,
@@ -1439,7 +1439,7 @@ export const trialsRouter = createTRPCRouter({
         .returning();
 
       // Broadcast robot action to all subscribers
-      await wsManager.broadcast(input.trialId, {
+      await wsManager.broadcastExternal(input.trialId, {
         type: "trial_action_executed",
         data: {
           action_type: `${input.pluginName}.${input.actionId}`,

src/server/services/robot-communication.ts

@@ -30,6 +30,7 @@ export interface RobotAction {
       type?: string;
       transformFn?: string;
       payload?: Record<string, unknown>;
+      sshCommand?: string;
     };
     ros2?: {
       topic?: string;
@@ -40,6 +41,7 @@ export interface RobotAction {
         type?: string;
         transformFn?: string;
         payload?: Record<string, unknown>;
+        sshCommand?: string;
       };
     };
   };

src/server/services/trial-execution.ts

@@ -441,10 +441,6 @@ export class TrialExecutionEngine {
       case "hristudio-core.loop":
         return await this.executeLoopAction(trialId, action);
 
-      case "branch":
-      case "hristudio-core.branch":
-        return await this.executeBranchAction(trialId, action);
-
       default:
         // Check if it's a robot action (contains plugin prefix)
         if (
@@ -799,8 +795,18 @@ export class TrialExecutionEngine {
     parameters: Record<string, unknown>,
     trialId: string,
   ): Promise<string> {
-    // Ensure robot communication service is available
+    // Plugin JSON uses a top-level "ros2" key; fall back to it if "implementation" is absent
-    if (!this.robotComm.getConnectionStatus()) {
+    const impl = actionDefinition.implementation ?? actionDefinition.ros2;
+
+    // Determine if this action uses SSH (animations or explicit sshCommand)
+    const sshCommand =
+      impl?.payloadMapping?.sshCommand ||
+      impl?.ros2?.payloadMapping?.sshCommand;
+    const isSSHAction =
+      actionDefinition.id?.startsWith("play_animation_") || !!sshCommand;
+
+    // SSH actions bypass ROS bridge — only connect for ROS-dependent actions
+    if (!isSSHAction && !this.robotComm.getConnectionStatus()) {
       try {
         await this.robotComm.connect();
       } catch (error) {
@@ -810,12 +816,12 @@ export class TrialExecutionEngine {
       }
     }
 
-    // Prepare robot action - use action.type which contains the namespaced format (plugin.actionId)
+    // Prepare robot action
     const robotAction: RobotAction = {
       pluginName: plugin.name,
-      actionId: action.type, // e.g., "nao6-ros2.play_animation_bow"
+      actionId: actionDefinition.id, // e.g., "play_animation_yes"
       parameters,
-      implementation: actionDefinition.implementation,
+      implementation: impl,
     };
 
     // Execute action through robot communication service

src/server/services/websocket-manager.ts

@@ -146,6 +146,24 @@ class WebSocketManager {
     );
   }
 
+  // Called from Next.js tRPC router — POSTs to the Bun ws-server process
+  // which holds the actual client connections.
+  async broadcastExternal(
+    trialId: string,
+    message: OutgoingMessage,
+  ): Promise<void> {
+    const wsPort = process.env.WS_PORT ?? "3001";
+    try {
+      await fetch(`http://localhost:${wsPort}/internal/broadcast`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ trialId, message }),
+      });
+    } catch (error) {
+      console.error(`[WS] Failed to broadcast externally for trial ${trialId}:`, error);
+    }
+  }
+
   async broadcastToAll(message: OutgoingMessage): Promise<void> {
     const messageStr = JSON.stringify(message);
     const disconnectedClients: string[] = [];

tsconfig.json

@@ -30,7 +30,7 @@
     ],
     "incremental": true,
     /* Path Aliases */
-    "baseUrl": ".",
+    // "baseUrl": ".",
     "paths": {
       "~/*": [
         "./src/*"

ws-server.ts

@@ -46,9 +46,22 @@ console.log(`Starting WebSocket server on port ${port}...`);
 
 serve<WSData>({
   port,
-  fetch(req, server) {
+  async fetch(req, server) {
     const url = new URL(req.url);
 
+    // Internal broadcast endpoint — called by Next.js tRPC router
+    if (url.pathname === "/internal/broadcast") {
+      if (req.method !== "POST") {
+        return new Response("Method not allowed", { status: 405 });
+      }
+      const { trialId, message } = (await req.json()) as {
+        trialId: string;
+        message: { type: string; data: Record<string, unknown> };
+      };
+      await wsManager.broadcast(trialId, message);
+      return new Response("OK", { status: 200 });
+    }
+
     if (url.pathname === "/api/websocket") {
       if (req.headers.get("upgrade") !== "websocket") {
         return new Response("WebSocket upgrade required", { status: 426 });
@@ -114,7 +127,7 @@ serve<WSData>({
         }),
       );
     },
-    message(ws: ServerWebSocket<WSData>, message) {
+    async message(ws: ServerWebSocket<WSData>, message) {
       const { clientId, trialId } = ws.data;
 
       try {
@@ -131,7 +144,7 @@ serve<WSData>({
             break;
 
           case "request_trial_status": {
-            const status = wsManager.getTrialStatusSync(trialId);
+            const status = await wsManager.getTrialStatus(trialId);
             ws.send(
               JSON.stringify({
                 type: "trial_status",
@@ -146,7 +159,7 @@ serve<WSData>({
           }
 
           case "request_trial_events": {
-            const events = wsManager.getTrialEventsSync(
+            const events = await wsManager.getTrialEvents(
               trialId,
               msg.data?.limit ?? 100,
             );