veryfront 0.1.129 → 0.1.131

package/src/cli/auth/utils.ts

@@ -6,6 +6,7 @@
 
 import type { AuthMethod } from "./login.js";
 import type { ParsedArgs } from "../shared/types.js";
+import type { ProviderName } from "./provider-store.js";
 
 /**
  * Parse login method from CLI arguments
@@ -19,3 +20,12 @@ export function parseLoginMethod(
   if (args.token) return "token";
   return undefined;
 }
+
+/**
+ * Parse --provider flag from CLI arguments
+ */
+export function parseProvider(args: ParsedArgs): ProviderName | undefined {
+  const provider = args.provider as string | undefined;
+  if (provider === "anthropic" || provider === "openai") return provider;
+  return undefined;
+}

package/src/cli/commands/config/command-help.ts

@@ -0,0 +1,15 @@
+import type { CommandHelp } from "../../help/types.js";
+
+export const configHelp: CommandHelp = {
+  name: "config",
+  category: "project",
+  description: "Show effective project configuration",
+  usage: "veryfront config [options]",
+  options: [
+    { flag: "--json", description: "Output as JSON" },
+  ],
+  examples: [
+    "veryfront config",
+    "veryfront config --json",
+  ],
+};

package/src/cli/commands/config/handler.ts

@@ -0,0 +1,90 @@
+import type { ParsedArgs } from "../../shared/types.js";
+import { cliLogger } from "../../utils/index.js";
+import { getEnv } from "../../../src/platform/index.js";
+import { createSuccessEnvelope, isJsonMode, outputJson } from "../../shared/json-output.js";
+import { bold, dim } from "../../ui/colors.js";
+
+const ENV_OVERRIDES: Record<string, string> = {
+  projectSlug: "VERYFRONT_PROJECT_SLUG",
+  apiBaseUrl: "VERYFRONT_API_BASE_URL",
+  apiToken: "VERYFRONT_API_TOKEN",
+  nodeEnv: "NODE_ENV",
+  veryfrontEnv: "VERYFRONT_ENV",
+  debug: "VERYFRONT_DEBUG",
+};
+
+export async function detectConfigSource(
+  projectDir: string,
+): Promise<string | null> {
+  const { createFileSystem } = await import("../../../src/platform/index.js");
+  const { join } = await import("../../../src/platform/compat/path/index.js");
+  const fs = createFileSystem();
+
+  for (
+    const name of [
+      "veryfront.config.ts",
+      "veryfront.config.js",
+      "veryfront.json",
+    ]
+  ) {
+    if (await fs.exists(join(projectDir, name))) return name;
+  }
+  return null;
+}
+
+export function getEnvOverrides(): string[] {
+  const overrides: string[] = [];
+  for (const [field, envVar] of Object.entries(ENV_OVERRIDES)) {
+    if (getEnv(envVar)) overrides.push(`${field} (${envVar})`);
+  }
+  return overrides;
+}
+
+export async function handleConfigCommand(_args: ParsedArgs): Promise<void> {
+  const { getEnvironmentConfig } = await import("../../../src/config/index.js");
+  const { cwd } = await import("../../../src/platform/index.js");
+  const config = getEnvironmentConfig();
+
+  const projectDir = cwd();
+  const configSource = await detectConfigSource(projectDir);
+  const envOverrides = getEnvOverrides();
+
+  const configData = {
+    projectSlug: config.projectSlug ?? null,
+    nodeEnv: config.nodeEnv,
+    veryfrontEnv: config.veryfrontEnv || null,
+    apiBaseUrl: config.apiBaseUrl,
+    debug: config.debug,
+    ci: config.ci,
+    hasApiToken: !!config.apiToken,
+    configSource,
+    envOverrides,
+  };
+
+  if (isJsonMode()) {
+    await outputJson(createSuccessEnvelope("config", configData));
+    return;
+  }
+
+  cliLogger.info(`\n  ${bold("Project Configuration")}\n`);
+  cliLogger.info(
+    `  ${dim("Project slug:")}  ${configData.projectSlug ?? "(not set)"}`,
+  );
+  cliLogger.info(`  ${dim("Environment:")}   ${configData.nodeEnv}`);
+  cliLogger.info(
+    `  ${dim("VF Environment:")} ${configData.veryfrontEnv ?? "(not set)"}`,
+  );
+  cliLogger.info(`  ${dim("API endpoint:")}  ${configData.apiBaseUrl}`);
+  cliLogger.info(`  ${dim("Debug:")}         ${configData.debug}`);
+  cliLogger.info(`  ${dim("CI:")}            ${configData.ci}`);
+  cliLogger.info(
+    `  ${dim("Authenticated:")} ${configData.hasApiToken ? "yes" : "no"}`,
+  );
+  cliLogger.info(
+    `  ${dim("Config file:")}   ${configData.configSource ?? "(none)"}`,
+  );
+  if (envOverrides.length > 0) {
+    cliLogger.info(`  ${dim("Env overrides:")}  ${envOverrides.join(", ")}`);
+  }
+  cliLogger.info("");
+}

package/src/cli/commands/open/command-help.ts

@@ -0,0 +1,19 @@
+import type { CommandHelp } from "../../help/types.js";
+
+export const openHelp: CommandHelp = {
+  name: "open",
+  category: "project",
+  description: "Open project URLs in the browser",
+  usage: "veryfront open [options]",
+  options: [
+    { flag: "--env <name>", description: "Open a specific environment URL" },
+    { flag: "--studio", description: "Open Veryfront Studio" },
+    { flag: "--json", description: "Output URL as JSON instead of opening" },
+  ],
+  examples: [
+    "veryfront open",
+    "veryfront open --env staging",
+    "veryfront open --studio",
+    "veryfront open --json",
+  ],
+};

package/src/cli/commands/open/command.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+import { createArgParser } from "../../shared/args.js";
+
+export const OpenArgsSchema = z.object({
+  env: z.string().optional(),
+  studio: z.boolean().default(false),
+  projectSlug: z.string().optional(),
+});
+
+export type OpenOptions = z.infer<typeof OpenArgsSchema>;
+
+export const parseOpenArgs = createArgParser(OpenArgsSchema, {
+  env: { keys: ["env"], type: "string" },
+  studio: { keys: ["studio"], type: "boolean" },
+  projectSlug: { keys: ["project-slug", "project", "p"], type: "string" },
+});
+
+const DASHBOARD_BASE = "https://veryfront.com";
+
+export function buildUrl(projectSlug: string, options: OpenOptions): string {
+  if (options.studio) {
+    return `${DASHBOARD_BASE}/studio/${projectSlug}`;
+  }
+  if (options.env) {
+    return `${DASHBOARD_BASE}/projects/${projectSlug}/environments/${options.env}`;
+  }
+  return `${DASHBOARD_BASE}/projects/${projectSlug}`;
+}

package/src/cli/commands/open/handler.ts

@@ -0,0 +1,38 @@
+import type { ParsedArgs } from "../../shared/types.js";
+import { parseArgsOrThrow } from "../../shared/args.js";
+import { cliLogger, exitProcess } from "../../utils/index.js";
+import { createSuccessEnvelope, isJsonMode, outputJson } from "../../shared/json-output.js";
+import { buildUrl, parseOpenArgs } from "./command.js";
+
+export async function handleOpenCommand(args: ParsedArgs): Promise<void> {
+  const opts = parseArgsOrThrow(parseOpenArgs, "open", args);
+
+  let projectSlug = opts.projectSlug;
+  if (!projectSlug) {
+    const { cwd } = await import("../../../src/platform/index.js");
+    const { getEnvironmentConfig } = await import("../../../src/config/index.js");
+    const { readConfigFile } = await import("../../shared/config.js");
+    projectSlug = getEnvironmentConfig().projectSlug ??
+      (await readConfigFile(cwd()))?.projectSlug ??
+      undefined;
+  }
+
+  if (!projectSlug) {
+    cliLogger.error(
+      "No project found. Run from a project directory or use --project-slug",
+    );
+    exitProcess(1);
+    return;
+  }
+
+  const url = buildUrl(projectSlug, opts);
+
+  if (isJsonMode()) {
+    await outputJson(createSuccessEnvelope("open", { url }));
+    return;
+  }
+
+  const { openBrowser } = await import("../../auth/browser.js");
+  await openBrowser(url);
+  console.log(`  Opening ${url}`);
+}

package/src/cli/help/command-definitions.ts

@@ -42,6 +42,8 @@ import { schemaHelp } from "../commands/schema/command-help.js";
 import { testHelp } from "../commands/test/command-help.js";
 import { lintHelp } from "../commands/lint/command-help.js";
 import { skillsHelp } from "../commands/skills/command-help.js";
+import { configHelp } from "../commands/config/command-help.js";
+import { openHelp } from "../commands/open/command-help.js";
 import { completionsHelp } from "../commands/completions/command-help.js";
 
 /**
@@ -84,5 +86,7 @@ export const COMMANDS: CommandRegistry = {
   test: testHelp,
   lint: lintHelp,
   skills: skillsHelp,
+  config: configHelp,
+  open: openHelp,
   completions: completionsHelp,
 };

package/src/cli/router.ts

@@ -40,6 +40,8 @@ import { handleSchemaCommand } from "./commands/schema/handler.js";
 import { handleTestCommand } from "./commands/test/handler.js";
 import { handleLintCommand } from "./commands/lint/handler.js";
 import { handleSkillsCommand } from "./commands/skills/handler.js";
+import { handleConfigCommand } from "./commands/config/handler.js";
+import { handleOpenCommand } from "./commands/open/handler.js";
 import { handleCompletionsCommand } from "./commands/completions/handler.js";
 import { login, logout, whoami } from "./auth/index.js";
 import { parseLoginMethod } from "./auth/utils.js";
@@ -84,9 +86,32 @@ const commands: Record<string, (args: ParsedArgs) => Promise<void>> = {
   "deploy": handleDeployCommand,
   "up": handleUpCommand,
   "login": async (args) => {
+    const { parseProvider } = await import("./auth/utils.js");
+    const provider = parseProvider(args);
+    if (provider === "anthropic") {
+      const { loginAnthropic } = await import("./auth/providers/anthropic.js");
+      await loginAnthropic();
+      return;
+    }
+    if (provider === "openai") {
+      const { loginOpenAI } = await import("./auth/providers/openai.js");
+      await loginOpenAI(args["base-url"] as string | undefined);
+      return;
+    }
     await login(parseLoginMethod(args));
   },
-  "logout": async () => {
+  "logout": async (args) => {
+    const { parseProvider } = await import("./auth/utils.js");
+    const provider = parseProvider(args);
+    if (provider) {
+      const { deleteProviderToken } = await import(
+        "./auth/provider-store.js"
+      );
+      await deleteProviderToken(provider);
+      const { logSuccess } = await import("./utils/index.js");
+      logSuccess(`${provider} API key removed`);
+      return;
+    }
     await logout();
   },
   "whoami": async () => {
@@ -105,6 +130,8 @@ const commands: Record<string, (args: ParsedArgs) => Promise<void>> = {
   "test": handleTestCommand,
   "lint": handleLintCommand,
   "skills": handleSkillsCommand,
+  "config": handleConfigCommand,
+  "open": handleOpenCommand,
   "completions": handleCompletionsCommand,
 };
 

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.129",
+  "version": "0.1.131",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [

package/src/src/channels/control-plane.ts

@@ -233,14 +233,14 @@ function resolveAgentSkills(agent: Agent): RuntimeAgentSkill[] {
     .sort((left, right) => left.name.localeCompare(right.name));
 }
 
-function getRuntimeAgentMetadata(agent: Agent): RuntimeAgent {
+function getRuntimeAgentMetadata(id: string, agent: Agent): RuntimeAgent {
   const rawConfig = agent.config as unknown as Record<string, unknown>;
 
   return RuntimeAgentSchema.parse({
-    id: agent.id,
+    id,
     name: typeof rawConfig.name === "string" && rawConfig.name.trim().length > 0
       ? rawConfig.name
-      : agent.id,
+      : id,
     description: typeof rawConfig.description === "string" ? rawConfig.description : null,
     model: agent.config.model ?? null,
     version: typeof rawConfig.version === "string" ? rawConfig.version : null,
@@ -255,9 +255,9 @@ export async function listRuntimeAgents(
   await deps.ensureProjectDiscovery(ctx);
 
   const agents = deps.getAllAgentIds()
-    .map((id) => deps.getAgent(id))
-    .filter((agent): agent is Agent => Boolean(agent))
-    .map(getRuntimeAgentMetadata)
+    .map((id) => ({ id, agent: deps.getAgent(id) }))
+    .filter((entry): entry is { id: string; agent: Agent } => Boolean(entry.agent))
+    .map(({ id, agent }) => getRuntimeAgentMetadata(id, agent))
     .sort((left, right) => left.name.localeCompare(right.name));
 
   return RuntimeAgentListResponseSchema.parse({ agents });

package/src/src/discovery/handlers/agent-handler.ts

@@ -4,6 +4,7 @@
 
 import type { Agent } from "../../agent/index.js";
 import { registerAgent } from "../../agent/index.js";
+import { agentRegistry } from "../../agent/composition/index.js";
 import type { DiscoveryHandler } from "../types.js";
 import { filenameToId, trackAgentPath } from "../discovery-utils.js";
 
@@ -11,8 +12,16 @@ export const agentHandler: DiscoveryHandler<Agent> = {
   typeName: "agent",
   validate: (item): item is Agent =>
     item !== null && typeof item === "object" && typeof (item as Agent).generate === "function",
-  getId: (agent, file) => agent.id || filenameToId(file),
+  getId: (agent, file) => {
+    const configuredId = agent.config.id;
+    return typeof configuredId === "string" && configuredId.trim().length > 0
+      ? configuredId
+      : filenameToId(file);
+  },
   register: (id, agent, file) => {
+    if (agent.id !== id) {
+      agentRegistry.delete(agent.id);
+    }
     registerAgent(id, agent);
     trackAgentPath(id, file);
     return agent;

package/src/src/platform/compat/framework-source-resolver.ts

@@ -1,9 +1,10 @@
 import { join } from "./path/index.js";
 import type { FileInfo } from "../adapters/base.js";
 import { createFileSystem } from "./fs.js";
-import { getFrameworkRootFromMeta } from "./vfs-paths.js";
+import { getFrameworkRoot, getFrameworkRootFromMeta } from "./vfs-paths.js";
 
 export const FRAMEWORK_ROOT = getFrameworkRootFromMeta(import.meta.url);
+export const FRAMEWORK_SRC_DIR = join(FRAMEWORK_ROOT, "src");
 export const FRAMEWORK_EMBEDDED_SRC_DIR = join(FRAMEWORK_ROOT, "dist", "framework-src");
 
 export const DEFAULT_FRAMEWORK_SOURCE_EXTENSIONS = [
@@ -37,6 +38,12 @@ export interface ResolveFrameworkSourcePathOptions {
   includeIndexFallback?: boolean;
 }
 
+export interface ResolveRelativeFrameworkSourceImportOptions {
+  fileSystem?: FrameworkSourceFileSystem;
+  exists?: (path: string) => Promise<boolean>;
+  extensions?: readonly string[];
+}
+
 export function getFrameworkSourceLookupDirs(extraLookupDirs: string[] = []): string[] {
   const seen = new Set<string>();
   const ordered = [
@@ -52,6 +59,48 @@ export function getFrameworkSourceLookupDirs(extraLookupDirs: string[] = []): st
   });
 }
 
+export function isFrameworkSourcePath(path: string): boolean {
+  return path.startsWith(`${FRAMEWORK_SRC_DIR}/`) ||
+    path.startsWith(`${FRAMEWORK_EMBEDDED_SRC_DIR}/`);
+}
+
+function expandFrameworkCandidatePaths(candidatePath: string): string[] {
+  const candidates = [candidatePath];
+  const candidateRoot = getFrameworkRoot(candidatePath);
+  const candidateSrcDir = candidateRoot ? join(candidateRoot, "src") : FRAMEWORK_SRC_DIR;
+  const candidateEmbeddedDir = candidateRoot
+    ? join(candidateRoot, "dist", "framework-src")
+    : FRAMEWORK_EMBEDDED_SRC_DIR;
+
+  if (candidatePath.startsWith(`${candidateSrcDir}/`)) {
+    const relativePath = candidatePath.slice(candidateSrcDir.length + 1);
+    candidates.push(join(candidateEmbeddedDir, relativePath));
+  }
+
+  return [...new Set(candidates)];
+}
+
+async function findExistingFrameworkCandidate(
+  candidatePath: string,
+  options: ResolveRelativeFrameworkSourceImportOptions = {},
+): Promise<string | null> {
+  const fs = options.fileSystem ?? createFileSystem();
+  const exists = options.exists ?? (async (path: string) => {
+    try {
+      const stat = await fs.stat(path);
+      return stat.isFile;
+    } catch {
+      return false;
+    }
+  });
+
+  for (const candidate of expandFrameworkCandidatePaths(candidatePath)) {
+    if (await exists(candidate)) return candidate;
+  }
+
+  return null;
+}
+
 export async function resolveFrameworkSourcePath(
   relativePathWithoutExt: string,
   options: ResolveFrameworkSourcePathOptions = {},
@@ -87,3 +136,54 @@ export async function resolveFrameworkSourcePath(
 
   return null;
 }
+
+export async function resolveRelativeFrameworkSourceImport(
+  specifier: string,
+  fromSourcePath: string,
+  options: ResolveRelativeFrameworkSourceImportOptions = {},
+): Promise<string | null> {
+  const extensions = options.extensions ?? DEFAULT_FRAMEWORK_SOURCE_EXTENSIONS;
+  const fromDir = fromSourcePath.substring(0, fromSourcePath.lastIndexOf("/"));
+  const parts = fromDir.split("/").filter(Boolean);
+  const importParts = specifier.split("/").filter(Boolean);
+
+  for (const part of importParts) {
+    if (part === "..") {
+      parts.pop();
+    } else if (part !== ".") {
+      parts.push(part);
+    }
+  }
+
+  const basePath = "/" + parts.join("/");
+
+  if (/\.(tsx?|jsx?|mjs)$/.test(specifier)) {
+    const explicitCandidates = [basePath, `${basePath}.src`];
+
+    if (basePath.endsWith(".js") || basePath.endsWith(".mjs")) {
+      const stem = basePath.replace(/\.(?:m?js)$/, "");
+      for (const ext of [".ts", ".tsx", ".jsx", ".js", ".mjs"]) {
+        explicitCandidates.push(`${stem}${ext}.src`, `${stem}${ext}`);
+      }
+    }
+
+    for (const candidate of explicitCandidates) {
+      const resolved = await findExistingFrameworkCandidate(candidate, options);
+      if (resolved) return resolved;
+    }
+
+    return null;
+  }
+
+  for (const ext of extensions) {
+    const candidate = await findExistingFrameworkCandidate(basePath + ext, options);
+    if (candidate) return candidate;
+  }
+
+  for (const ext of extensions) {
+    const candidate = await findExistingFrameworkCandidate(join(basePath, "index" + ext), options);
+    if (candidate) return candidate;
+  }
+
+  return null;
+}

package/src/src/server/handlers/preview/markdown-html-generator.ts

@@ -11,6 +11,7 @@ import * as dntShim from "../../../../_dnt.shims.js";
 
 
 import { escapeHtml } from "../../../utils/html-escape.js";
+import { buildNonceAttribute } from "../../../html/html-escape.js";
 
 /** Options for generating markdown preview HTML. */
 interface MarkdownHtmlOptions {
@@ -28,6 +29,8 @@ interface MarkdownHtmlOptions {
   projectId: string;
   /** File path of the markdown file. */
   filePath: string;
+  /** CSP nonce for inline scripts. */
+  nonce?: string;
 }
 
 /**
@@ -60,9 +63,11 @@ function buildStudioScript(
   url: URL,
   projectId: string,
   filePath: string,
+  nonce?: string,
 ): string {
   const studioEmbed = url.searchParams.get("studio_embed") === "true";
   if (!studioEmbed) return "";
+  const nonceAttr = buildNonceAttribute(nonce);
 
   const rawQueryProjectId = url.searchParams.get("vf_project_id")?.trim() || "";
   // Validate query param before using it in bridge config.
@@ -79,8 +84,8 @@ function buildStudioScript(
 
   // Escape </script> sequences to prevent XSS breakout from inline JSON
   const safeJson = JSON.stringify(bridgeConfig).replace(/</g, "\\u003c");
-  return `<script>window.__VF_BRIDGE_CONFIG__=${safeJson};</script>
-  <script type="module" src="/_veryfront/studio-bridge.js"></script>`;
+  return `<script${nonceAttr}>window.__VF_BRIDGE_CONFIG__=${safeJson};</script>
+  <script type="module" src="/_veryfront/studio-bridge.js"${nonceAttr}></script>`;
 }
 
 /**
@@ -91,11 +96,12 @@ function buildStudioScript(
  * studio bridge integration.
  */
 export function generateMarkdownHtml(options: MarkdownHtmlOptions): string {
-  const { rawHtml, title, description, request, url, projectId, filePath } = options;
+  const { rawHtml, title, description, request, url, projectId, filePath, nonce } = options;
 
   const theme = detectTheme(request, url);
-  const studioScript = buildStudioScript(url, projectId, filePath);
+  const studioScript = buildStudioScript(url, projectId, filePath, nonce);
   const themeAttrs = theme ? ` data-theme="${theme}" style="color-scheme: ${theme};"` : "";
+  const nonceAttr = buildNonceAttribute(nonce);
 
   return `<!DOCTYPE html>
 <html lang="en"${themeAttrs}>
@@ -117,7 +123,7 @@ export function generateMarkdownHtml(options: MarkdownHtmlOptions): string {
 
   ${studioScript}
 
-  <script type="module">
+  <script type="module"${nonceAttr}>
     import mermaid from 'https://esm.sh/mermaid@11.4.1?pin=v135';
 
     function getMermaidTheme() {
@@ -177,7 +183,7 @@ export function generateMarkdownHtml(options: MarkdownHtmlOptions): string {
   </script>
 
   <!-- Preview HMR -->
-  <script src="/_veryfront/preview-hmr.js"></script>
+  <script src="/_veryfront/preview-hmr.js"${nonceAttr}></script>
 </body>
 </html>`;
 }

package/src/src/server/handlers/preview/markdown-preview.handler.ts

@@ -154,6 +154,7 @@ export class MarkdownPreviewHandler extends BaseHandler {
         "server",
       );
 
+      const responseBuilder = this.createResponseBuilder(ctx);
       const html = generateMarkdownHtml({
         rawHtml: bundle.rawHtml || "",
         title: frontmatter.title != null ? String(frontmatter.title) : filePath,
@@ -162,18 +163,20 @@ export class MarkdownPreviewHandler extends BaseHandler {
         url,
         projectId: ctx.projectSlug || ctx.projectId || "markdown-preview",
         filePath,
+        nonce: responseBuilder.nonce,
       });
 
-      const responseBuilder = this.createResponseBuilder(ctx)
+      responseBuilder
         .withCache("no-cache")
-        .withContentType("text/html; charset=utf-8", html, HTTP_OK);
+        .withSecurity(ctx.securityConfig ?? undefined, req);
+      const response = responseBuilder.withContentType("text/html; charset=utf-8", html, HTTP_OK);
 
       logger.debug("Serving markdown preview", {
         filePath,
         htmlLength: html.length,
       });
 
-      return this.respond(responseBuilder);
+      return this.respond(response);
     } catch (error) {
       logger.error("Error rendering markdown", {
         filePath,

package/src/src/server/handlers/request/api/project-discovery.ts

@@ -16,6 +16,23 @@ const logger = serverLogger.component("api-wrapper");
  */
 const discoveredProjects = new Map<string, Promise<void>>();
 
+function buildDiscoveryConfig(ctx: HandlerContext) {
+  const ai = ctx.config?.ai;
+  const skillDiscoveryEnabled = ai?.skills?.discovery?.enabled ?? true;
+
+  return {
+    baseDir: ctx.projectDir,
+    toolDirs: ai?.tools?.discovery?.paths ?? ["tools"],
+    agentDirs: ai?.agents?.discovery?.paths ?? ["agents"],
+    skillDirs: skillDiscoveryEnabled ? (ai?.skills?.discovery?.paths ?? ["skills"]) : [],
+    resourceDirs: ["resources"],
+    promptDirs: ["prompts"],
+    workflowDirs: ["workflows"],
+    fsAdapter: ctx.adapter.fs,
+    verbose: false,
+  };
+}
+
 /** Build a discovery cache key that incorporates the release/version. */
 function discoveryKey(ctx: HandlerContext): string {
   const cacheContext = tryGetCacheKeyContext();
@@ -74,11 +91,7 @@ export async function ensureProjectDiscovery(ctx: HandlerContext): Promise<void>
     agentRegistry.clear();
     toolRegistry.clear();
 
-    const result = await discoverAll({
-      baseDir: ctx.projectDir,
-      fsAdapter: ctx.adapter.fs,
-      verbose: false,
-    });
+    const result = await discoverAll(buildDiscoveryConfig(ctx));
 
     const logData = {
       projectSlug: ctx.projectSlug,

package/src/src/server/handlers/request/api/security-headers.ts

@@ -31,10 +31,19 @@ export function getSecurityHeader(
 }
 
 export function applySecurityHeaders(headers: dntShim.Headers, ctx: HandlerContext, req?: dntShim.Request): void {
+  applySecurityHeadersWithNonce(headers, ctx, generateNonce(), req);
+}
+
+export function applySecurityHeadersWithNonce(
+  headers: dntShim.Headers,
+  ctx: HandlerContext,
+  nonce: string,
+  req?: dntShim.Request,
+): void {
   coreApplySecurityHeaders(
     headers,
     isDev(ctx),
-    generateNonce(),
+    nonce,
     ctx.cspUserHeader ?? null,
     ctx.securityConfig,
     ctx.adapter,