newo 3.7.2 → 3.7.4

package/dist/sync/json-attr-utils.js

@@ -8,7 +8,7 @@
  * `value_type: json`. The API may return the `value` field as either a
  * STRING containing JSON or as an already-parsed OBJECT.
  *
- * Without normalization, two bugs leak through:
+ * Without normalization, several bugs leak through:
  *
  * 1. When the API returns the value as an OBJECT, `yaml.dump` serializes
  *    it as a YAML structure (mappings/sequences). Pushing back then sends
@@ -21,10 +21,25 @@
  *    string vs object representations it triggers spurious pushes that
  *    overwrite the canvas with the wrong shape (Builder shows blank).
  *
- * The fix is conservative: for `value_type: json` only, always coerce the
- * value to a STRING when persisting and when pushing, and use canonical
- * JSON for comparisons. String-typed values in the wild are left
- * untouched, so no churn for the majority of attributes.
+ * 3. (Bug 3.7.2-a) Canvas JSON strings with structural newlines (real
+ *    U+000A between tokens) can be emitted by yaml.dump as double-quoted
+ *    scalars with `\n` escape sequences. patchYamlToPyyaml then converts
+ *    those to single-quoted YAML scalars, where `\n` is treated as two
+ *    literal chars (backslash + n). On push the platform stores those
+ *    literal chars and the Builder calls JSON.parse, which fails on
+ *    backslash-n as structural whitespace.
+ *
+ * 4. (Bug 3.7.2-b) Canvas body text contains Markdown with `\_`
+ *    (backslash + underscore). `\_` is not a valid JSON escape sequence
+ *    per RFC 8259 (valid ones: " \ / b f n r t uXXXX). Chrome V8's
+ *    JSON.parse is strict: it throws SyntaxError on `\_`, silently
+ *    blanking the Builder.
+ *
+ * The fix for (3) and (4): for `value_type: json` string values, strip
+ * invalid escape sequences then compact via JSON.parse + JSON.stringify.
+ * Compaction removes structural newlines and re-serializes all string
+ * values with only valid JSON escapes, producing a single-line string
+ * that round-trips through YAML without corruption.
  */
 /**
  * True if the attribute is a JSON-typed attribute (case- and
@@ -37,24 +52,84 @@ export function isJsonValueType(valueType) {
     const lower = valueType.toLowerCase();
     return lower === 'json' || lower.endsWith('.json');
 }
+/**
+ * Fix invalid JSON escape sequences inside JSON string values.
+ *
+ * Per RFC 8259, valid escape sequences inside a JSON string are:
+ *   \" \\ \/ \b \f \n \r \t \uXXXX
+ * Anything else (e.g. `\_` `\.` from Markdown) is invalid and causes
+ * JSON.parse to throw. Fix: drop the backslash (e.g. `\_` → `_`).
+ *
+ * Only modifies characters inside JSON string values (tracks quote
+ * context). Structural characters outside strings are untouched.
+ */
+export function fixInvalidJsonEscapes(s) {
+    const VALID_ESCAPES = new Set(['"', '\\', '/', 'b', 'f', 'n', 'r', 't', 'u']);
+    const result = [];
+    let inString = false;
+    let i = 0;
+    while (i < s.length) {
+        const c = s[i];
+        if (inString) {
+            if (c === '\\' && i + 1 < s.length) {
+                const next = s[i + 1];
+                if (VALID_ESCAPES.has(next)) {
+                    result.push(c, next);
+                }
+                else {
+                    result.push(next); // drop the backslash — \_ → _, etc.
+                }
+                i += 2;
+                continue;
+            }
+            else if (c === '"') {
+                inString = false;
+                result.push(c);
+            }
+            else {
+                result.push(c);
+            }
+        }
+        else {
+            if (c === '"') {
+                inString = true;
+                result.push(c);
+            }
+            else {
+                result.push(c);
+            }
+        }
+        i++;
+    }
+    return result.join('');
+}
 /**
  * Coerce a JSON-typed attribute's value to a STRING suitable for storage
  * in attributes.yaml and for sending to the platform.
  *
  * - `null` / `undefined` → `''`
  * - object → compact JSON string (`JSON.stringify(value)`)
- * - string → returned as-is (we trust the platform's existing format)
+ * - string → fix invalid escapes (e.g. `\_` → `_`), then compact via
+ *            JSON.parse + JSON.stringify. If parsing still fails after
+ *            fixing escapes, return the fixed string as-is.
  * - other → `String(value)`
  *
- * We deliberately do NOT re-format string values, even when they look
- * like JSON. Many existing canvases are stored pretty-printed and
- * reformatting would create huge spurious diffs in users' repos.
+ * Compacting removes structural newlines and guarantees a single-line
+ * string that yaml.dump serializes without escape-sequence corruption in
+ * the patchYamlToPyyaml pass. See module-level comment for full context.
  */
 export function normalizeJsonValueForStorage(value) {
     if (value == null)
         return '';
-    if (typeof value === 'string')
-        return value;
+    if (typeof value === 'string') {
+        const fixed = fixInvalidJsonEscapes(value);
+        try {
+            return JSON.stringify(JSON.parse(fixed));
+        }
+        catch {
+            return fixed;
+        }
+    }
     if (typeof value === 'object') {
         try {
             return JSON.stringify(value);
@@ -69,20 +144,12 @@ export function normalizeJsonValueForStorage(value) {
  * Canonical comparison for JSON-typed attribute values.
  *
  * Returns the canonical form (compact JSON if parseable, otherwise the
- * raw string). Use this on both sides of a comparison so that pretty- vs
- * compact-printed JSON does not register as a change, and so that an
+ * fixed string). Use this on both sides of a comparison so that pretty-
+ * vs compact-printed JSON does not register as a change, and so that an
  * object on one side equals its stringified form on the other side.
  */
 export function canonicalJsonValue(value) {
-    const stringified = normalizeJsonValueForStorage(value);
-    if (stringified === '')
-        return '';
-    try {
-        return JSON.stringify(JSON.parse(stringified));
-    }
-    catch {
-        return stringified;
-    }
+    return normalizeJsonValueForStorage(value);
 }
 /**
  * True if two JSON-typed attribute values are semantically equal.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "newo",
-  "version": "3.7.2",
+  "version": "3.7.4",
   "description": "NEWO CLI: Professional command-line tool with modular architecture for NEWO AI Agent development. Features account migration, integration management, webhook automation, AKB knowledge base, project attributes, sandbox testing, IDN-based file management, real-time progress tracking, intelligent sync operations, and comprehensive multi-customer support.",
   "type": "module",
   "bin": {

package/src/domain/strategies/sync/V2ProjectSyncStrategy.ts

@@ -46,6 +46,8 @@ import {
   listFlowSkills,
   listFlowEvents,
   listFlowStates,
+  createSkill,
+  createSkillParameter,
   updateSkill,
   publishFlow,
   getProjectAttributes,
@@ -70,6 +72,7 @@ import { sha256, saveHashes, loadHashes } from '../../../hash.js';
 import {
   v2ImportVersionPath,
   v2ProjectYamlPath,
+  v2AgentDir,
   v2AgentYamlPath,
   v2FlowYamlPath,
   v2SkillScriptPath,
@@ -89,10 +92,10 @@ import {
   generateV2FlowYaml,
   generateV2ProjectYaml,
   generateV2AgentYaml,
+  parseV2FlowYaml,
   buildV2InlineSkill,
   buildV2FlowEvent,
   buildV2StateField,
-  parseV2FlowYaml,
   type V2InlineSkill,
   type V2FlowEvent,
   type V2StateField,
@@ -100,6 +103,7 @@ import {
 import { isContentDifferent } from '../../../sync/skill-files.js';
 import yaml from 'js-yaml';
 import { patchYamlToPyyaml } from '../../../format/yaml-patch.js';
+import type { RunnerType, SkillParameter } from '../../../types.js';
 
 /**
  * V2ProjectSyncStrategy - same API, newo_v2 file layout
@@ -655,9 +659,17 @@ export class V2ProjectSyncStrategy implements ISyncStrategy<ProjectMeta, LocalPr
     }
 
     const mapData = await fs.readJson(mapFile) as ProjectMap;
+    const metadataSync = await this.syncV2FlowYamlDefinitions(client, customer, mapData, newHashes);
+    result.created += metadataSync.created;
+    result.updated += metadataSync.updated;
+    result.errors.push(...metadataSync.errors);
 
     for (const change of changes) {
       try {
+        if (metadataSync.syncedPaths.has(change.path)) {
+          continue;
+        }
+
         if (change.operation === 'modified') {
           // V2 flow YAML: newo_customers/{cust}/{proj}/agents/{agent}/flows/{flow}/{flow}.yaml
           // The flow YAML carries title, events, and state_fields inline, so
@@ -682,6 +694,10 @@ export class V2ProjectSyncStrategy implements ISyncStrategy<ProjectMeta, LocalPr
       }
     }
 
+    if (metadataSync.created > 0 || metadataSync.updated > 0) {
+      await writeFileSafe(mapFile, JSON.stringify(mapData, null, 2));
+    }
+
     await saveHashes(newHashes, customer.idn);
 
     if (result.created > 0 || result.updated > 0) {
@@ -800,6 +816,321 @@ export class V2ProjectSyncStrategy implements ISyncStrategy<ProjectMeta, LocalPr
     return total;
   }
 
+  /**
+   * Reconcile inline skill definitions from V2 flow YAML before pushing scripts.
+   *
+   * V2 keeps skill metadata (model, runner_type, parameters) in the flow YAML,
+   * not in a separate skill metadata file. The map only contains the remote IDs
+   * from a previous pull, so new local skills must be created before their
+   * callers can be published.
+   */
+  private async syncV2FlowYamlDefinitions(
+    client: AxiosInstance,
+    customer: CustomerConfig,
+    mapData: ProjectMap,
+    newHashes: HashStore
+  ): Promise<{ created: number; updated: number; syncedPaths: Set<string>; errors: string[] }> {
+    let created = 0;
+    let updated = 0;
+    const syncedPaths = new Set<string>();
+    const errors: string[] = [];
+
+    for (const [projectIdn, projectData] of Object.entries(mapData.projects)) {
+      for (const [agentIdn, agentData] of Object.entries(projectData.agents)) {
+        for (const [flowIdn, flowData] of Object.entries(agentData.flows)) {
+          const flowYamlPath = v2FlowYamlPath(customer.idn, projectIdn, agentIdn, flowIdn);
+          if (!(await fs.pathExists(flowYamlPath))) {
+            continue;
+          }
+
+          let flowDef;
+          try {
+            flowDef = await parseV2FlowYaml(flowYamlPath);
+          } catch (error) {
+            this.logger.warn(
+              `[newo_v2] Failed to parse flow YAML ${flowYamlPath}: ${error instanceof Error ? error.message : String(error)}`
+            );
+            continue;
+          }
+
+          for (const skill of flowDef.skills || []) {
+            const skillLocator = `${projectIdn}/${agentIdn}/${flowIdn}/${skill.idn}`;
+            // Per-skill failure isolation: one broken skill must not abort the
+            // push of every other project/flow in the workspace.
+            try {
+              const runnerType = this.normalizeRunnerType(skill.runner_type);
+              const scriptPath = await this.resolveV2FlowSkillScriptPath(
+                customer.idn,
+                projectIdn,
+                agentIdn,
+                flowIdn,
+                skill.idn,
+                runnerType,
+                skill.prompt_script
+              );
+
+              if (!(await fs.pathExists(scriptPath))) {
+                errors.push(
+                  `[newo_v2] Missing script for skill ${skillLocator}: ${scriptPath}`
+                );
+                continue;
+              }
+
+              const content = await fs.readFile(scriptPath, 'utf8');
+              const localMetadata = this.buildV2SkillMetadataFromYaml(skill, flowDef, runnerType, flowData.skills[skill.idn]);
+              const existingSkill = flowData.skills[skill.idn];
+
+              if (!existingSkill) {
+                this.assertSkillModelResolved(localMetadata, skillLocator);
+                try {
+                  const createdSkill = await createSkill(client, flowData.id, {
+                    idn: localMetadata.idn,
+                    title: localMetadata.title,
+                    prompt_script: content,
+                    runner_type: localMetadata.runner_type,
+                    model: localMetadata.model,
+                    parameters: localMetadata.parameters,
+                    path: localMetadata.path || ''
+                  });
+
+                  // The create endpoint ignores inline `parameters` (verified
+                  // against the live platform) — create them explicitly.
+                  await this.createMissingSkillParameters(
+                    client,
+                    { ...localMetadata, id: createdSkill.id, parameters: [] },
+                    localMetadata
+                  );
+
+                  flowData.skills[skill.idn] = {
+                    ...localMetadata,
+                    id: createdSkill.id
+                  };
+                  newHashes[scriptPath] = sha256(content);
+                  syncedPaths.add(scriptPath);
+                  created++;
+                  this.logger.info(`[newo_v2] Created skill: ${flowIdn}/${skill.idn}`);
+                } catch (error) {
+                  if (!this.isAlreadyExistsApiError(error)) {
+                    throw error;
+                  }
+
+                  const remoteSkills = await listFlowSkills(client, flowData.id);
+                  const remoteSkill = remoteSkills.find(s => s.idn === skill.idn);
+                  if (!remoteSkill) {
+                    throw error;
+                  }
+
+                  const remoteMetadata: SkillMetadata = {
+                    id: remoteSkill.id,
+                    idn: remoteSkill.idn,
+                    title: remoteSkill.title,
+                    runner_type: remoteSkill.runner_type,
+                    model: remoteSkill.model,
+                    parameters: this.normalizeParameters(remoteSkill.parameters),
+                    path: remoteSkill.path
+                  };
+                  await this.createMissingSkillParameters(client, remoteMetadata, localMetadata);
+                  await updateSkill(client, {
+                    id: remoteSkill.id,
+                    title: localMetadata.title,
+                    idn: localMetadata.idn,
+                    prompt_script: content,
+                    runner_type: localMetadata.runner_type,
+                    model: localMetadata.model,
+                    parameters: localMetadata.parameters,
+                    path: remoteSkill.path || localMetadata.path
+                  });
+
+                  flowData.skills[skill.idn] = {
+                    ...localMetadata,
+                    id: remoteSkill.id,
+                    path: remoteSkill.path || localMetadata.path
+                  };
+                  newHashes[scriptPath] = sha256(content);
+                  syncedPaths.add(scriptPath);
+                  updated++;
+                  this.logger.info(`[newo_v2] Reused existing skill: ${flowIdn}/${skill.idn}`);
+                }
+                continue;
+              }
+
+              const createdParameters = await this.createMissingSkillParameters(client, existingSkill, localMetadata);
+
+              if (createdParameters > 0 || this.skillMetadataDiffers(existingSkill, localMetadata)) {
+                this.assertSkillModelResolved(localMetadata, skillLocator);
+                await updateSkill(client, {
+                  id: existingSkill.id,
+                  title: localMetadata.title,
+                  idn: localMetadata.idn,
+                  prompt_script: content,
+                  runner_type: localMetadata.runner_type,
+                  model: localMetadata.model,
+                  parameters: localMetadata.parameters,
+                  path: localMetadata.path
+                });
+
+                flowData.skills[skill.idn] = {
+                  ...localMetadata,
+                  id: existingSkill.id
+                };
+                newHashes[scriptPath] = sha256(content);
+                syncedPaths.add(scriptPath);
+                updated++;
+                this.logger.info(`[newo_v2] Updated skill metadata: ${flowIdn}/${skill.idn}`);
+              }
+            } catch (error) {
+              errors.push(
+                `Failed to sync skill ${skillLocator}: ${error instanceof Error ? error.message : String(error)}`
+              );
+            }
+          }
+        }
+      }
+    }
+
+    return { created, updated, syncedPaths, errors };
+  }
+
+  private async createMissingSkillParameters(
+    client: AxiosInstance,
+    existing: SkillMetadata,
+    local: SkillMetadata
+  ): Promise<number> {
+    const existingNames = new Set(this.normalizeParameters(existing.parameters).map(p => p.name));
+    let created = 0;
+
+    for (const parameter of local.parameters) {
+      if (existingNames.has(parameter.name)) {
+        continue;
+      }
+
+      try {
+        await createSkillParameter(client, existing.id, {
+          name: parameter.name,
+          default_value: parameter.default_value ?? ''
+        });
+        created++;
+        this.logger.info(`[newo_v2] Created skill parameter: ${local.idn}/${parameter.name}`);
+      } catch (error) {
+        if (!this.isAlreadyExistsApiError(error)) {
+          throw error;
+        }
+      }
+      existingNames.add(parameter.name);
+    }
+
+    return created;
+  }
+
+  /**
+   * Detect "resource already exists" API errors.
+   *
+   * Matches only on the precise phrases the platform actually returns
+   * ("already exists", "duplicate key"). Loose substrings like "exist"
+   * would otherwise sweep up unrelated "does not exist" / "doesn't exist"
+   * errors and trigger an incorrect reuse fallback.
+   */
+  private isAlreadyExistsApiError(error: unknown): boolean {
+    const response = (error as { response?: { status?: number; data?: unknown } } | null | undefined)?.response;
+    const status = response?.status;
+    if (status !== 400 && status !== 409 && status !== 422) {
+      return false;
+    }
+
+    const haystack = JSON.stringify(
+      response?.data ?? (error instanceof Error ? error.message : String(error))
+    ).toLowerCase();
+
+    return haystack.includes('already exists') || haystack.includes('duplicate key');
+  }
+
+  private normalizeRunnerType(runnerType: string | undefined): RunnerType {
+    return runnerType === 'nsl' ? 'nsl' : 'guidance';
+  }
+
+  private normalizeParameters(parameters: readonly SkillParameter[] | undefined): SkillParameter[] {
+    return (parameters || []).map(p => ({
+      name: p.name,
+      default_value: p.default_value ?? ''
+    }));
+  }
+
+  /**
+   * Fail fast if no model could be resolved for a V2 skill.
+   *
+   * `buildV2SkillMetadataFromYaml` falls back to empty strings when neither
+   * the skill nor the flow declare a model. The platform rejects empty
+   * model_idn/provider_idn at creation/update time, but the error it returns
+   * is generic — we surface a clearer message before issuing the request.
+   */
+  private assertSkillModelResolved(metadata: SkillMetadata, locator: string): void {
+    if (!metadata.model.model_idn || !metadata.model.provider_idn) {
+      throw new Error(
+        `[newo_v2] Cannot resolve model for skill ${locator}: ` +
+        `model_idn="${metadata.model.model_idn}", provider_idn="${metadata.model.provider_idn}". ` +
+        `Set either skill.model.* or flow default_model_idn/default_provider_idn in the flow YAML.`
+      );
+    }
+  }
+
+  private buildV2SkillMetadataFromYaml(
+    skill: V2InlineSkill,
+    flowDef: Awaited<ReturnType<typeof parseV2FlowYaml>>,
+    runnerType: RunnerType,
+    existing?: SkillMetadata
+  ): SkillMetadata {
+    return {
+      id: existing?.id || '',
+      idn: skill.idn,
+      title: skill.title || '',
+      runner_type: runnerType,
+      model: {
+        model_idn: skill.model?.model_idn || flowDef.default_model_idn || '',
+        provider_idn: skill.model?.provider_idn || flowDef.default_provider_idn || ''
+      },
+      parameters: this.normalizeParameters(skill.parameters),
+      path: existing?.path || ''
+    };
+  }
+
+  private skillMetadataDiffers(existing: SkillMetadata, local: SkillMetadata): boolean {
+    // Compare model/parameters field-by-field, never via JSON.stringify of the
+    // raw objects: the map stores model keys in platform API order
+    // (provider_idn first) while YAML-built metadata uses model_idn first, and
+    // a key-order-sensitive comparison flags every skill as changed.
+    const paramsKey = (params: readonly SkillParameter[] | undefined): string =>
+      JSON.stringify(
+        this.normalizeParameters(params).sort((a, b) => a.name.localeCompare(b.name))
+      );
+
+    return (
+      existing.title !== local.title ||
+      existing.runner_type !== local.runner_type ||
+      existing.model.model_idn !== local.model.model_idn ||
+      existing.model.provider_idn !== local.model.provider_idn ||
+      paramsKey(existing.parameters) !== paramsKey(local.parameters)
+    );
+  }
+
+  private async resolveV2FlowSkillScriptPath(
+    customerIdn: string,
+    projectIdn: string,
+    agentIdn: string,
+    flowIdn: string,
+    skillIdn: string,
+    runnerType: RunnerType,
+    promptScript?: string
+  ): Promise<string> {
+    if (promptScript) {
+      const fromPromptScript = `${v2AgentDir(customerIdn, projectIdn, agentIdn)}/${promptScript}`;
+      if (await fs.pathExists(fromPromptScript)) {
+        return fromPromptScript;
+      }
+    }
+
+    return v2SkillScriptPath(customerIdn, projectIdn, agentIdn, flowIdn, skillIdn, runnerType);
+  }
+
   /**
    * Push a V2 skill update
    *
@@ -949,11 +1280,30 @@ export class V2ProjectSyncStrategy implements ISyncStrategy<ProjectMeta, LocalPr
         }
 
         for (const [flowIdn, flowData] of Object.entries(agentData.flows)) {
-          for (const [skillIdn, skillMeta] of Object.entries(flowData.skills)) {
-            const scriptPath = v2SkillScriptPath(
-              customer.idn, projectIdn, agentIdn, flowIdn, skillIdn,
-              skillMeta.runner_type
-            );
+          const flowYamlSkills = await this.loadLocalV2FlowSkills(customer.idn, projectIdn, agentIdn, flowIdn);
+          const skillIdns = new Set([
+            ...Object.keys(flowData.skills),
+            ...flowYamlSkills.keys()
+          ]);
+
+          for (const skillIdn of skillIdns) {
+            const yamlSkill = flowYamlSkills.get(skillIdn);
+            const skillMeta = flowData.skills[skillIdn];
+            const runnerType = this.normalizeRunnerType(yamlSkill?.runner_type || skillMeta?.runner_type);
+            const scriptPath = yamlSkill
+              ? await this.resolveV2FlowSkillScriptPath(
+                customer.idn,
+                projectIdn,
+                agentIdn,
+                flowIdn,
+                skillIdn,
+                runnerType,
+                yamlSkill.prompt_script
+              )
+              : v2SkillScriptPath(
+                customer.idn, projectIdn, agentIdn, flowIdn, skillIdn,
+                runnerType
+              );
 
             if (await fs.pathExists(scriptPath)) {
               const content = await fs.readFile(scriptPath, 'utf8');
@@ -1002,6 +1352,25 @@ export class V2ProjectSyncStrategy implements ISyncStrategy<ProjectMeta, LocalPr
     return changes;
   }
 
+  private async loadLocalV2FlowSkills(
+    customerIdn: string,
+    projectIdn: string,
+    agentIdn: string,
+    flowIdn: string
+  ): Promise<Map<string, V2InlineSkill>> {
+    const flowYamlPath = v2FlowYamlPath(customerIdn, projectIdn, agentIdn, flowIdn);
+    if (!(await fs.pathExists(flowYamlPath))) {
+      return new Map();
+    }
+
+    try {
+      const flowDef = await parseV2FlowYaml(flowYamlPath);
+      return new Map((flowDef.skills || []).map(skill => [skill.idn, skill]));
+    } catch {
+      return new Map();
+    }
+  }
+
   async validate(customer: CustomerConfig, _items: LocalProjectData[]): Promise<ValidationResult> {
     const errors: ValidationError[] = [];
 
@@ -1020,7 +1389,61 @@ export class V2ProjectSyncStrategy implements ISyncStrategy<ProjectMeta, LocalPr
     for (const [projectIdn, projectData] of Object.entries(mapData.projects)) {
       for (const [agentIdn, agentData] of Object.entries(projectData.agents)) {
         for (const [flowIdn, flowData] of Object.entries(agentData.flows)) {
+          const flowYamlPath = v2FlowYamlPath(customer.idn, projectIdn, agentIdn, flowIdn);
+          let localYamlSkills: Map<string, V2InlineSkill> | undefined;
+          if (await fs.pathExists(flowYamlPath)) {
+            try {
+              const flowDef = await parseV2FlowYaml(flowYamlPath);
+              localYamlSkills = new Map((flowDef.skills || []).map(s => [s.idn, s]));
+              const skillIdns = new Set([
+                ...Object.keys(flowData.skills),
+                ...localYamlSkills.keys()
+              ]);
+
+              for (const skillIdn of skillIdns) {
+                const localYamlSkill = localYamlSkills.get(skillIdn);
+                const skillMeta = flowData.skills[skillIdn];
+
+                if (!localYamlSkill) {
+                  errors.push({
+                    field: `skill.${skillIdn}`,
+                    message: `Skill exists in project map but is missing from flow YAML: ${flowYamlPath}`,
+                    path: flowYamlPath
+                  });
+                  continue;
+                }
+
+                const runnerType = this.normalizeRunnerType(
+                  localYamlSkill.runner_type || skillMeta?.runner_type
+                );
+                const scriptPath = await this.resolveV2FlowSkillScriptPath(
+                  customer.idn,
+                  projectIdn,
+                  agentIdn,
+                  flowIdn,
+                  skillIdn,
+                  runnerType,
+                  localYamlSkill.prompt_script
+                );
+
+                if (!(await fs.pathExists(scriptPath))) {
+                  errors.push({
+                    field: `skill.${localYamlSkill.idn}`,
+                    message: `Script file not found: ${scriptPath}`,
+                    path: scriptPath
+                  });
+                }
+              }
+            } catch {
+              localYamlSkills = undefined;
+            }
+          }
+
           for (const [skillIdn, skillMeta] of Object.entries(flowData.skills)) {
+            if (localYamlSkills) {
+              continue;
+            }
+
             const scriptPath = v2SkillScriptPath(
               customer.idn, projectIdn, agentIdn, flowIdn, skillIdn,
               skillMeta.runner_type