veryfront 0.1.1006 → 0.1.1007

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.1006",
+    "version": "0.1.1007",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": {

package/esm/src/internal-agents/run-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/run-stream.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,YAAY,IAAI,OAAO,EAC5B,KAAK,aAAa,EAEnB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EACV,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAAmB,KAAK,IAAI,EAAgB,MAAM,kBAAkB,CAAC;AAU5E,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsCxD,MAAM,WAAW,+BAA+B;IAC9C,cAAc,EAAE,sBAAsB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,cAAc,CAAC,EAAE,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IACnE,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,CACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAClC;QACH,MAAM,EAAE,CACN,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;YACV,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;SAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;KAC1C,CAAC;CACH;AAoCD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,oBAAoB,EAC3B,cAAc,EAAE,sBAAsB,EACtC,2BAA2B,CAAC,EAAE,MAAM,EAAE,EACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;;cAsFrD;AAyOD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CAoVnB"}
+{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/run-stream.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,YAAY,IAAI,OAAO,EAC5B,KAAK,aAAa,EAEnB,MAAM,mBAAmB,CAAC;AAW3B,OAAO,KAAK,EACV,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAEL,KAAK,IAAI,EAGV,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsCxD,MAAM,WAAW,+BAA+B;IAC9C,cAAc,EAAE,sBAAsB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,cAAc,CAAC,EAAE,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;IACnE,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,CACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAClC;QACH,MAAM,EAAE,CACN,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;YACV,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;SAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;KAC1C,CAAC;CACH;AAoCD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,oBAAoB,EAC3B,cAAc,EAAE,sBAAsB,EACtC,2BAA2B,CAAC,EAAE,MAAM,EAAE,EACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;;cAsFrD;AAwSD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CAyWnB"}

package/esm/src/internal-agents/run-stream.js

@@ -2,6 +2,7 @@ import * as dntShim from "../../_dnt.shims.js";
 import { AgentRuntime, } from "../agent/index.js";
 import { normalizeAgUiRuntimeMessages } from "../agent/ag-ui/runtime-support.js";
 import { compactForStep, estimateOverhead } from "../chat/message-prep.js";
+import { getRuntimeRemoteToolSources, } from "../agent/runtime/mcp-server-tool-sources.js";
 import { convertAgentRuntimeMessagesToProviderMessages, convertProviderMessagesToAgentRuntimeMessages, } from "../agent/runtime/message-adapter.js";
 import { createAgentServiceSandboxTools } from "../sandbox/index.js";
 import { tryResolve } from "../extensions/contracts.js";
@@ -9,7 +10,7 @@ import { importFirstPartyExtensionModule } from "../extensions/first-party-impor
 import { SandboxShellToolsProviderName, } from "../extensions/sandbox/index.js";
 import { resolveHostedRuntimeAllowedToolNames } from "../agent/hosted/runtime-essential-tools.js";
 import { SKILL_TOOL_IDS } from "../skill/types.js";
-import { isToolVisibleTo, toolRegistry } from "../tool/index.js";
+import { isToolVisibleTo, toolRegistry, } from "../tool/index.js";
 import { defineSchema, lazySchema } from "../schemas/index.js";
 import { createStreamTransformState, finalizeRunEvents, formatAgUiEvent, mapRuntimeEventToAgUi, parseSseJsonEvents, } from "./ag-ui-sse.js";
 import { AgentRunCancelledError } from "./session-manager.js";
@@ -238,11 +239,22 @@ function getRuntimeToolAllowlist(forwardedProps) {
  * Intersects the merged run tool set with the restrictive tool allowlist.
  * Skill runtime/delegation tools are preserved for skill-enabled agents,
  * mirroring the hosted chat runtime's allowlist semantics.
+ *
+ * The allowlist bounds this run's direct tool surface only: preserved skill
+ * delegation tools (`invoke_agent`) can spawn child runs whose tool assembly
+ * derives from the child agent's own config and is not capped by this run's
+ * allowlist. Strict schedules must exclude delegation via agent config.
  */
 function applyRuntimeToolAllowlist(mergedTools, toolAllowlist, agent) {
-    if (!toolAllowlist || !mergedTools || mergedTools === true) {
+    if (!toolAllowlist || !mergedTools) {
         return mergedTools;
     }
+    if (mergedTools === true) {
+        // buildMergedTools always expands `tools: true` into a concrete record,
+        // so this is unreachable; if that invariant ever breaks, fail closed
+        // rather than silently skipping enforcement.
+        return {};
+    }
     const availableSkillIds = agent.config.skills === true
         ? ["*"]
         : Array.isArray(agent.config.skills)
@@ -287,6 +299,48 @@ function getForwardedIntegrationToolDefinitions(forwardedProps) {
         parameters: def.inputSchema ?? def.parameters ?? { type: "object", properties: {} },
     }));
 }
+function getRemoteToolDiscoveryContext(input) {
+    return {
+        agentId: input.agent.id,
+        runId: input.runInput.runId,
+        ...(input.deps.projectAgentSandbox?.authToken
+            ? { authToken: input.deps.projectAgentSandbox.authToken }
+            : {}),
+        ...(input.deps.projectAgentSandbox?.projectId
+            ? { projectId: input.deps.projectAgentSandbox.projectId }
+            : {}),
+        ...(input.runInput.parentRunId ? { parentRunId: input.runInput.parentRunId } : {}),
+        ...(input.runInput.state !== undefined ? { state: input.runInput.state } : {}),
+        context: input.runInput.context,
+        forwardedProps: input.runInput.forwardedProps,
+    };
+}
+async function getDeclaredRemoteSourceToolNames(input) {
+    const sources = getRuntimeRemoteToolSources(input.agent.config);
+    if (!sources?.length) {
+        return [];
+    }
+    const context = getRemoteToolDiscoveryContext(input);
+    const toolNames = new Set();
+    for (const source of sources) {
+        try {
+            for (const definition of await source.listTools(context)) {
+                if (typeof definition.name === "string" && definition.name.length > 0) {
+                    toolNames.add(definition.name);
+                }
+            }
+        }
+        catch (error) {
+            logger.warn("Failed to inspect remote tool source for restrictive allowlist fallback", {
+                runId: input.runInput.runId,
+                agentId: input.agent.id,
+                sourceId: source.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return [...toolNames];
+}
 function compactRuntimeMessagesForStream(messages, mergedTools) {
     const toolCount = mergedTools && mergedTools !== true ? Object.keys(mergedTools).length : 0;
     return convertProviderMessagesToAgentRuntimeMessages(compactForStep(convertAgentRuntimeMessagesToProviderMessages(messages), estimateOverhead("", toolCount)));
@@ -309,31 +363,46 @@ export async function createRuntimeAgentStreamResponse(input, agent, deps) {
     const grantedRemoteToolNames = forwardedAllowedRemoteToolNames === undefined
         ? undefined
         : mergeRemoteToolNames(sourceAllowedRemoteToolNames, forwardedAllowedRemoteToolNames);
+    const runtimeToolAllowlist = getRuntimeToolAllowlist(input.forwardedProps);
+    if (runtimeToolAllowlist === null && forwardedAllowedRemoteToolNames !== undefined) {
+        logger.debug("runtimeOverrides.allowedTools is additive on internal runs; use runtimeOverrides.toolAllowlist to restrict the run tool surface", { runId: input.runId, agentId: agent.id });
+    }
+    const forwardedIntegrationToolDefs = getForwardedIntegrationToolDefinitions(input.forwardedProps);
+    const availableForwardedToolNames = forwardedIntegrationToolDefs?.map((tool) => tool.name);
     // A restrictive toolAllowlist caps remote exposure too: it intersects the
     // tightest existing remote filter (forwarded grants, else the agent source's
-    // own __vfAllowedRemoteTools), and with neither present it becomes the
-    // remote filter directly. It can only narrow what the agent's sources
-    // already expose, never add.
-    const runtimeToolAllowlist = getRuntimeToolAllowlist(input.forwardedProps);
+    // own __vfAllowedRemoteTools). With neither present, discover the agent's
+    // declared remote-source surface and intersect with that. A bare allowlist
+    // entry can narrow actual remote sources, but never becomes an implicit
+    // project-scoped integration grant (#2768).
     const sourceRemoteFilterBase = Object.hasOwn(agent.config, "__vfAllowedRemoteTools")
         ? sourceAllowedRemoteToolNames
         : undefined;
+    const remoteFallbackBase = runtimeToolAllowlist !== null &&
+        grantedRemoteToolNames === undefined &&
+        sourceRemoteFilterBase === undefined
+        ? await getDeclaredRemoteSourceToolNames({ agent, runInput: input, deps })
+        : undefined;
     const allowedRemoteToolNames = runtimeToolAllowlist === null
         ? grantedRemoteToolNames
-        : (grantedRemoteToolNames ?? sourceRemoteFilterBase ?? [...runtimeToolAllowlist]).filter((toolName) => runtimeToolAllowlist.has(toolName));
-    const forwardedIntegrationToolDefs = getForwardedIntegrationToolDefinitions(input.forwardedProps);
-    const availableForwardedToolNames = forwardedIntegrationToolDefs?.map((tool) => tool.name);
+        : (grantedRemoteToolNames ?? sourceRemoteFilterBase ?? remoteFallbackBase ?? []).filter((toolName) => runtimeToolAllowlist.has(toolName));
     const sandboxTools = await buildProjectAgentSandboxTools({ agent, deps });
     const availableLocalTools = {
         ...(deps.localTools ?? {}),
         ...(sandboxTools.tools ?? {}),
     };
     const mergedTools = applyRuntimeToolAllowlist(buildMergedTools(agent, input, deps.sessionManager, availableForwardedToolNames, Object.keys(availableLocalTools).length > 0 ? availableLocalTools : undefined), runtimeToolAllowlist, agent);
+    // Provider-native tools (e.g. web_search) are provider-side and bypass the
+    // merged tool record, so cap them against the allowlist explicitly.
+    const cappedProviderTools = runtimeToolAllowlist !== null && Array.isArray(agent.config.providerTools)
+        ? agent.config.providerTools.filter((toolName) => typeof toolName === "string" && runtimeToolAllowlist.has(toolName))
+        : undefined;
     const runtimeAgent = {
         ...agent,
         config: {
             ...agent.config,
             tools: mergedTools,
+            ...(cappedProviderTools !== undefined ? { providerTools: cappedProviderTools } : {}),
             ...(allowedRemoteToolNames !== undefined
                 ? { __vfAllowedRemoteTools: allowedRemoteToolNames }
                 : {}),

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1006";
+export declare const VERSION = "0.1.1007";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1006";
+export const VERSION = "0.1.1007";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1006",
+  "version": "0.1.1007",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",