@yeaft/webchat-agent 1.0.444 → 1.0.446

package/Dockerfile

@@ -4,7 +4,8 @@ ARG BUILD_VERSION=dev
 ENV NODE_ENV=production \
     HOME=/home/yeaft \
     YEAFT_DIR=/home/yeaft/.yeaft \
-    WORK_DIR=/workspace
+    WORK_DIR=/workspace \
+    YEAFT_AGENT_RUNTIME=container_agent
 
 RUN apt-get update \
   && apt-get install -y --no-install-recommends ca-certificates git openssh-client tini \
@@ -16,7 +17,9 @@ RUN apt-get update \
 WORKDIR /app
 COPY package.json package-lock.json ./
 COPY agent/package.json ./agent/
-RUN npm ci --workspace=agent --omit=dev
+RUN npm_config_cache=/tmp/yeaft-npm-cache npm ci --workspace=agent --omit=dev \
+  && rm -rf /tmp/yeaft-npm-cache \
+  && install -d -m 0700 -o yeaft -g yeaft /home/yeaft/.npm
 COPY --chown=yeaft:yeaft agent ./agent
 RUN node -e "const fs=require('fs'); const p='agent/package.json'; const j=JSON.parse(fs.readFileSync(p)); j.version=process.argv[1].replace(/^v/, ''); fs.writeFileSync(p, JSON.stringify(j, null, 2) + '\\n')" "$BUILD_VERSION" \
   && chmod 0755 agent/container-entrypoint.sh

package/cli.js

@@ -38,9 +38,12 @@ import {
   warnDeprecatedInstanceArg,
 } from './service/config.js';
 import {
+  buildContainerImageUpgradeMessage,
   buildUpgradeInstallCommand,
   buildUpgradeMetadataUrl,
   buildUpgradeVersionCommand,
+  CONTAINER_IMAGE_UPGRADE_REASON,
+  isContainerAgentRuntime,
   createWindowsUpgradeRun,
   launchWindowsUpgradeScript,
   prepareWindowsUpgradeRunner,
@@ -545,6 +548,7 @@ function parseAndStart(args) {
 }
 
 async function checkForUpdates() {
+  if (isContainerAgentRuntime()) return;
   try {
     const res = await fetch(buildUpgradeMetadataUrl(pkg.name));
     if (!res.ok) return;
@@ -562,6 +566,11 @@ async function checkForUpdates() {
 async function upgrade(args = []) {
   warnDeprecatedInstanceArg(args);
   const instanceId = resolveServiceInstanceId(args, process.env, { management: true });
+  if (isContainerAgentRuntime()) {
+    console.error(`${CONTAINER_IMAGE_UPGRADE_REASON}: ${buildContainerImageUpgradeMessage(pkg.version)}`);
+    process.exitCode = 1;
+    return;
+  }
   console.log(`Current version: ${pkg.version}`);
   console.log('Checking for updates...');
 

package/connection/message-router.js

@@ -30,7 +30,7 @@ import { getLlmConfig, updateLlmConfig, getYeaftSettings, updateYeaftSettings, g
 import { loadConfig } from '../yeaft/config.js';
 import { discoverLlmModels } from '../llm-model-discovery.js';
 import { fetchModelsDev } from '../yeaft/llm/models-dev.js';
-import { handleYeaftSessionSend, handleYeaftAskUserAnswer, handleYeaftSubAgentPrompt, handleYeaftTaskCancel, handleYeaftModeSwitch, handleYeaftModelSwitch, resetYeaftSession, refreshLiveSessionConfig, handleYeaftLoadHistory, handleYeaftLoadHistoryOutline, handleYeaftSearchHistory, handleYeaftLoadHistoryWindow, handleYeaftLoadMoreHistory, handleYeaftAbortThread, handleYeaftAbortAll, handleYeaftAbortTurn, handleYeaftVpSubscribe, handleYeaftVpCreate, handleYeaftVpUpdate, handleYeaftVpDelete, handleYeaftVpRead, handleYeaftListSessions, handleYeaftProjectContextSync, handleYeaftProjectMutation, handleYeaftCreateSession, handleYeaftRenameSession, handleYeaftUpdateSession, handleYeaftUpdateSessionConfig, handleYeaftArchiveSession, handleYeaftDeleteSession, handleYeaftSessionAddMember, handleYeaftSessionRemoveMember, handleYeaftSessionSetDefaultVp, handleYeaftScanWorkdirSessions, handleYeaftRestoreSession, handleYeaftDreamTrigger, handleYeaftFetchToolStats, handleYeaftFetchDebugHistory, handleYeaftMcpList, handleYeaftMcpAdd, handleYeaftMcpRemove, handleYeaftMcpReload, handleYeaftPluginCatalog, broadcastLanguageChange, broadcastYeaftSessionSnapshotEager, broadcastYeaftVpSnapshotEager, preloadYeaftSkillSlashCommands } from '../yeaft/web-bridge.js';
+import { handleYeaftSessionSend, handleYeaftAskUserAnswer, handleYeaftSubAgentPrompt, handleYeaftTaskCancel, handleYeaftModeSwitch, handleYeaftModelSwitch, resetYeaftSession, refreshLiveSessionConfig, handleYeaftLoadHistory, handleYeaftLoadHistoryOutline, handleYeaftSearchHistory, handleYeaftLoadHistoryWindow, handleYeaftLoadMoreHistory, handleYeaftAbortThread, handleYeaftAbortAll, handleYeaftAbortTurn, handleYeaftVpSubscribe, handleYeaftVpCreate, handleYeaftVpUpdate, handleYeaftVpDelete, handleYeaftVpRead, handleYeaftListSessions, handleYeaftProjectContextSync, handleYeaftProjectMutation, handleYeaftCreateSession, handleYeaftRenameSession, handleYeaftUpdateSession, handleYeaftUpdateSessionConfig, handleYeaftArchiveSession, handleYeaftDeleteSession, handleYeaftSessionAddMember, handleYeaftSessionRemoveMember, handleYeaftSessionSetDefaultVp, handleYeaftScanWorkdirSessions, handleYeaftRestoreSession, handleYeaftDreamTrigger, handleYeaftFetchToolStats, handleYeaftFetchDebugHistory, handleYeaftMcpList, handleYeaftMcpAdd, handleYeaftMcpRemove, handleYeaftMcpReload, handleYeaftPluginCatalog, handleYeaftManagedSkill, broadcastLanguageChange, broadcastYeaftSessionSnapshotEager, broadcastYeaftVpSnapshotEager, preloadYeaftSkillSlashCommands } from '../yeaft/web-bridge.js';
 import { startYeaftStatusRefresh, forceRefreshYeaftStatus } from '../yeaft/status-cache.js';
 import { handleWorkCenterRequest } from '../yeaft/work-center/bridge.js';
 import { handleBrowserRuntimeMessage } from '../browser-runtime/messages.js';
@@ -639,6 +639,10 @@ export async function handleMessage(msg) {
       handleYeaftPluginCatalog(msg);
       break;
 
+    case 'yeaft_managed_skill':
+      handleYeaftManagedSkill(msg);
+      break;
+
     case 'yeaft_vp_create':
     case 'unify_vp_create':
       handleYeaftVpCreate(msg);

package/connection/upgrade.js

@@ -8,6 +8,10 @@ import { getConfigDir, getServiceName, getPm2AppName, getLaunchdPlistPath, DEFAU
 import {
   buildUpgradeInstallCommand,
   buildUpgradeMetadataArgs,
+  buildContainerImageUpgradeMessage,
+  CONTAINER_AGENT_CAPABILITY,
+  CONTAINER_IMAGE_UPGRADE_REASON,
+  isContainerAgentRuntime,
   createWindowsUpgradeRun,
   launchWindowsUpgradeScript,
   prepareWindowsUpgradeRunner,
@@ -175,6 +179,20 @@ function compareCmp(cur, cmp) {
 }
 
 export async function handleUpgradeAgent() {
+  if (isContainerAgentRuntime() || ctx.agentCapabilities?.includes(CONTAINER_AGENT_CAPABILITY)) {
+    const version = ctx.agentVersion || null;
+    const error = buildContainerImageUpgradeMessage(version);
+    console.warn(`[Agent] Upgrade rejected (${CONTAINER_IMAGE_UPGRADE_REASON}): ${error}`);
+    await sendToServer({
+      type: 'upgrade_agent_ack',
+      success: false,
+      reason: CONTAINER_IMAGE_UPGRADE_REASON,
+      error,
+      version,
+    });
+    return;
+  }
+
   console.log('[Agent] Upgrade requested, checking for updates...');
   try {
     const pkgName = ctx.pkgName || '@yeaft/webchat-agent';

package/container-manager.js

@@ -122,6 +122,7 @@ export function buildCreateArgs({
     '--mount', `type=bind,src=${resolve(secretFile)},dst=/run/yeaft-host-secret,readonly`,
     '--env', `SERVER_URL=${serverUrl}`,
     '--env', `AGENT_NAME=${agentName}`,
+    '--env', 'YEAFT_AGENT_RUNTIME=container_agent',
     '--env', 'AGENT_SECRET_FILE=/run/yeaft-host-secret',
     '--env', 'YEAFT_DIR=/home/yeaft/.yeaft',
     '--env', 'WORK_DIR=/workspace',

package/index.js

@@ -6,8 +6,6 @@ import { homedir } from 'os';
 import { createAssetOutbox } from './yeaft/asset-outbox.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, chmodSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
-import { exec } from 'child_process';
-import { promisify } from 'util';
 import { fileURLToPath } from 'url';
 import ctx from './context.js';
 import {
@@ -22,7 +20,9 @@ import {
 import { loadNodePty } from './terminal.js';
 import { connect } from './connection.js';
 import { loadMcpServers } from './mcp.js';
-import { SAFE_REMOTE_UPGRADE_CAPABILITY } from './upgrade-command.js';
+import {
+  getAgentUpgradeCapability,
+} from './upgrade-command.js';
 import { loadConfig as loadYeaftConfig } from './yeaft/config.js';
 import { initYeaftDir } from './yeaft/init.js';
 import { updateBrowserRuntimeSettings } from './yeaft/config-api.js';
@@ -33,14 +33,12 @@ import {
   runAfterManagedCliRuntimeCleanup,
   summarizeManagedCliResults,
 } from './yeaft/managed-cli.js';
-
-const execAsync = promisify(exec);
-
-// Startup maintenance is non-interactive. Without windowsHide, each exec()
-// creates a visible cmd.exe window on Windows before the Agent connects.
-function execHiddenAsync(command, options = {}) {
-  return execAsync(command, { ...options, windowsHide: true });
-}
+import {
+  execHiddenFileAsync,
+  resolveNpmInvocation,
+  shouldRunPeriodicCheck,
+  writePeriodicCheckMarker,
+} from './startup-maintenance.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -177,7 +175,8 @@ async function detectCapabilities() {
   // agent build can speak plaintext WS frames. New servers see this and
   // flip `agent.encryptOutbound = false`, stopping outbound encryption
   // to this peer. Old servers ignore the unknown capability token.
-  const capabilities = ['background_tasks', 'file_editor', 'ping_session', 'plaintext-ok', 'workbench_session_routes', SAFE_REMOTE_UPGRADE_CAPABILITY, 'work_center', 'work_center_message_v2', 'session_history_search', 'session_history_outline', 'session_history_window_prefetch', 'file_reference_resolution', 'yeaft_plugins'];
+  const capabilities = ['background_tasks', 'file_editor', 'ping_session', 'plaintext-ok', 'workbench_session_routes', 'work_center', 'work_center_message_v2', 'session_history_search', 'session_history_outline', 'session_history_window_prefetch', 'file_reference_resolution', 'yeaft_plugins', 'yeaft_managed_skills'];
+  capabilities.push(getAgentUpgradeCapability());
   if (process.platform === 'linux') capabilities.push('work_item_attachments');
   const pty = await loadNodePty();
   if (pty) capabilities.push('terminal');
@@ -199,7 +198,8 @@ async function ensureDependencies() {
   if (!existsSync(nodeModulesPath)) {
     console.log('[Startup] node_modules not found, running npm install...');
     try {
-      await execHiddenAsync('npm install', { cwd: agentDir, timeout: 120000 });
+      const npm = resolveNpmInvocation();
+      await execHiddenFileAsync(npm.command, [...npm.argsPrefix, 'install'], { cwd: agentDir, timeout: 120000 });
       console.log('[Startup] npm install completed');
     } catch (e) {
       console.warn('[Startup] npm install failed:', e.message);
@@ -222,6 +222,7 @@ async function ensureYeaftSkills() {
   const installedFile = join(pluginsDir, 'installed_plugins.json');
   const settingsFile = join(claudeDir, 'settings.json');
   const cacheDir = join(pluginsDir, 'cache', MARKETPLACE_NAME, PLUGIN_NAME, PLUGIN_VERSION);
+  const updateCheckMarker = join(pluginsDir, '.yeaft-skills-update-check.json');
 
   try {
     // --- Layer 1: Clone or update the marketplace repo ---
@@ -230,38 +231,49 @@ async function ensureYeaftSkills() {
     if (!existsSync(installDir)) {
       console.log('[Startup] yeaft-skills not found, installing as marketplace plugin...');
       mkdirSync(marketplacesDir, { recursive: true });
-      await execHiddenAsync(`git clone ${REPO_URL} "${installDir}"`, { timeout: 60000 });
+      await execHiddenFileAsync('git', ['clone', REPO_URL, installDir], { timeout: 60000 });
+      writePeriodicCheckMarker(updateCheckMarker);
       needsCacheUpdate = true;
       console.log('[Startup] yeaft-skills installed');
     } else {
-      console.log('[Startup] yeaft-skills found, checking for updates...');
-      // Record HEAD before pull to detect changes
-      let headBefore = '';
-      try {
-        const { stdout: h } = await execHiddenAsync('git rev-parse HEAD', { cwd: installDir, timeout: 5000 });
-        headBefore = h.trim();
-      } catch { /* ignore */ }
-      const { stdout } = await execHiddenAsync('git pull --ff-only', {
-        cwd: installDir,
-        timeout: 30000
-      });
-      if (stdout.includes('Already up to date')) {
-        console.log('[Startup] yeaft-skills is up to date');
-      } else {
-        needsCacheUpdate = true;
-        console.log('[Startup] yeaft-skills updated');
-      }
-      // Double-check: compare HEAD after pull
-      if (!needsCacheUpdate && headBefore) {
+      if (shouldRunPeriodicCheck(updateCheckMarker)) {
+        console.log('[Startup] yeaft-skills found, checking for updates...');
+        // Record HEAD before pull to detect changes
+        let headBefore = '';
         try {
-          const { stdout: h2 } = await execHiddenAsync('git rev-parse HEAD', { cwd: installDir, timeout: 5000 });
-          if (h2.trim() !== headBefore) needsCacheUpdate = true;
+          const { stdout: h } = await execHiddenFileAsync('git', ['rev-parse', 'HEAD'], { cwd: installDir, timeout: 5000 });
+          headBefore = h.trim();
         } catch { /* ignore */ }
+        try {
+          const { stdout } = await execHiddenFileAsync('git', ['pull', '--ff-only'], {
+            cwd: installDir,
+            timeout: 30000
+          });
+          if (stdout.includes('Already up to date')) {
+            console.log('[Startup] yeaft-skills is up to date');
+          } else {
+            needsCacheUpdate = true;
+            console.log('[Startup] yeaft-skills updated');
+          }
+          writePeriodicCheckMarker(updateCheckMarker);
+        } catch (e) {
+          writePeriodicCheckMarker(updateCheckMarker);
+          console.warn('[Startup] yeaft-skills update check failed; using cached checkout:', e.message);
+        }
+        // Double-check: compare HEAD after pull
+        if (!needsCacheUpdate && headBefore) {
+          try {
+            const { stdout: h2 } = await execHiddenFileAsync('git', ['rev-parse', 'HEAD'], { cwd: installDir, timeout: 5000 });
+            if (h2.trim() !== headBefore) needsCacheUpdate = true;
+          } catch { /* ignore */ }
+        }
+      } else {
+        console.log('[Startup] yeaft-skills update check skipped; recently checked');
       }
     }
     // Get current commit SHA for installed_plugins.json
     try {
-      const { stdout: sha } = await execHiddenAsync('git rev-parse HEAD', { cwd: installDir, timeout: 5000 });
+      const { stdout: sha } = await execHiddenFileAsync('git', ['rev-parse', 'HEAD'], { cwd: installDir, timeout: 5000 });
       gitSha = sha.trim();
     } catch { /* non-critical */ }
 

package/local-runtime/agent/container-manager.js

@@ -122,6 +122,7 @@ export function buildCreateArgs({
     '--mount', `type=bind,src=${resolve(secretFile)},dst=/run/yeaft-host-secret,readonly`,
     '--env', `SERVER_URL=${serverUrl}`,
     '--env', `AGENT_NAME=${agentName}`,
+    '--env', 'YEAFT_AGENT_RUNTIME=container_agent',
     '--env', 'AGENT_SECRET_FILE=/run/yeaft-host-secret',
     '--env', 'YEAFT_DIR=/home/yeaft/.yeaft',
     '--env', 'WORK_DIR=/workspace',

package/local-runtime/server/handlers/agent-output.js

@@ -882,6 +882,23 @@ export async function handleAgentOutput(agentId, agent, msg) {
       break;
     }
 
+    case 'yeaft_managed_skill_result': {
+      const targetClient = msg._requestClientId ? webClients.get(msg._requestClientId) : null;
+      if (targetClient?.authenticated && (CONFIG.skipAuth || targetClient.userId === agent.ownerId)) {
+        await sendToWebClient(targetClient, {
+          type: 'yeaft_managed_skill_result',
+          agentId,
+          requestId: msg.requestId || null,
+          scope: msg.scope || null,
+          sessionId: msg.sessionId || null,
+          result: msg.result || null,
+          catalog: msg.catalog || { tools: [], skills: [], skillSources: [], mcpServers: [] },
+          error: msg.error || null,
+        });
+      }
+      break;
+    }
+
     case 'yeaft_tool_stats':
       // 2026-05-13: relay tool-call counters from the agent to the web
       // client that requested them. Whitelist `snapshot`/`registered`/

package/local-runtime/server/handlers/client-conversation.js

@@ -31,6 +31,10 @@ import {
   agentSupportsYeaftPlugins,
   YEAFT_PLUGINS_UNSUPPORTED_ERROR,
 } from '../yeaft-plugin-capability.js';
+import {
+  agentSupportsYeaftManagedSkills,
+  YEAFT_MANAGED_SKILLS_UNSUPPORTED_ERROR,
+} from '../yeaft-managed-skill-capability.js';
 
 
 function isRetiredCollabSessionId(id) {
@@ -56,6 +60,14 @@ function emptyYeaftPluginCatalog(error = null) {
   };
 }
 
+function emptyYeaftManagedSkillResult(error = null) {
+  return {
+    type: 'yeaft_managed_skill_result',
+    catalog: { tools: [], skills: [], skillSources: [], mcpServers: [] },
+    ...(error ? { error } : {}),
+  };
+}
+
 async function sendVpSnapshotError(client, msg, error) {
   await sendToWebClient(client, {
     type: 'yeaft_output',
@@ -1650,6 +1662,15 @@ export async function handleClientConversation(clientId, client, msg, checkAgent
           });
           return true;
         }
+        if (relayType === 'yeaft_managed_skill'
+            && !agentSupportsYeaftManagedSkills(agents.get(relayAgentId))) {
+          await sendToWebClient(client, {
+            ...emptyYeaftManagedSkillResult(YEAFT_MANAGED_SKILLS_UNSUPPORTED_ERROR),
+            agentId: relayAgentId,
+            requestId: msg.requestId || null,
+          });
+          return true;
+        }
         const relayAgent = agents.get(relayAgentId);
         if (!relayAgent || relayAgent.ws?.readyState !== 1) {
           if (relayType === 'yeaft_fetch_tool_stats') {
@@ -1676,7 +1697,9 @@ export async function handleClientConversation(clientId, client, msg, checkAgent
         // Direct catalog replies are request-scoped. Carry the browser client
         // identity through the Agent so another owner tab cannot accidentally
         // consume a response for this picker request.
-        if (relayType === 'yeaft_plugin_catalog') rest._requestClientId = clientId;
+        if (relayType === 'yeaft_plugin_catalog' || relayType === 'yeaft_managed_skill') {
+          rest._requestClientId = clientId;
+        }
         if (rest.type === 'yeaft_session_send' || rest.type === 'yeaft_session_chat') {
           trackUserTurn(client.userId, Buffer.byteLength(JSON.stringify(msg)));
           const sessionId = typeof rest.sessionId === 'string' ? rest.sessionId.trim() : '';

package/local-runtime/server/handlers/client-misc.js

@@ -13,6 +13,8 @@ import {
 // may receive remote upgrade commands. Version thresholds are insufficient:
 // builds without this capability may still inherit the installed package cwd.
 export const SAFE_REMOTE_UPGRADE_CAPABILITY = 'remote_upgrade_safe';
+export const CONTAINER_AGENT_CAPABILITY = 'container_agent';
+export const CONTAINER_IMAGE_UPGRADE_REASON = 'container_image_upgrade_required';
 export { YEAFT_PLUGINS_CAPABILITY, YEAFT_PLUGINS_UNSUPPORTED_ERROR };
 
 async function rejectUnsupportedYeaftPlugins(client, msg, agentId) {
@@ -59,6 +61,19 @@ export async function handleClientMisc(clientId, client, msg, checkAgentAccess)
       if (!upgradeAgentId) break;
       if (!await checkAgentAccess(upgradeAgentId)) break;
       const upgradeAgent = agents.get(upgradeAgentId);
+      if (Array.isArray(upgradeAgent?.capabilities)
+          && upgradeAgent.capabilities.includes(CONTAINER_AGENT_CAPABILITY)) {
+        await sendToWebClient(client, {
+          type: 'upgrade_agent_ack',
+          agentId: upgradeAgentId,
+          success: false,
+          reason: CONTAINER_IMAGE_UPGRADE_REASON,
+          version: upgradeAgent?.version || null,
+          requiredCapability: CONTAINER_AGENT_CAPABILITY,
+          error: 'Container Agent is managed as a Docker image. Pull the configured image and recreate the same container through the Server/Sandbox lifecycle while keeping its persistent volumes and host-side agent-secret file.',
+        });
+        break;
+      }
       if (requiresManualUpgradeBridge(upgradeAgent?.capabilities, upgradeAgent?.platform)) {
         await sendToWebClient(client, {
           type: 'upgrade_agent_ack',

package/local-runtime/server/yeaft-managed-skill-capability.js

@@ -0,0 +1,11 @@
+import { YEAFT_PLUGINS_CAPABILITY } from './yeaft-plugin-capability.js';
+
+export const YEAFT_MANAGED_SKILLS_CAPABILITY = 'yeaft_managed_skills';
+export const YEAFT_MANAGED_SKILLS_UNSUPPORTED_ERROR = 'The selected Agent does not support Skill management; upgrade and restart the Agent';
+
+export function agentSupportsYeaftManagedSkills(agent) {
+  if (agent?.capabilityMetadataProvided !== true) return false;
+  const capabilities = Array.isArray(agent.capabilities) ? agent.capabilities : [];
+  return capabilities.includes(YEAFT_PLUGINS_CAPABILITY)
+    && capabilities.includes(YEAFT_MANAGED_SKILLS_CAPABILITY);
+}

package/local-runtime/version.json

@@ -1 +1 @@
-{"version":"1.0.444"}
+{"version":"1.0.446"}