veryfront 0.1.159 → 0.1.161

package/esm/src/mcp/server.js

@@ -1,4 +1,3 @@
-import * as dntShim from "../../_dnt.shims.js";
 import { getMCPRegistry } from "./registry.js";
 import { executeTool } from "../tool/index.js";
 import { zodToJsonSchema } from "../tool/schema/index.js";
@@ -7,15 +6,12 @@ import { promptRegistry } from "../prompt/index.js";
 import { createError, toError } from "../errors/veryfront-error.js";
 import { withSpan } from "../observability/tracing/otlp-setup.js";
 import { VERSION } from "../utils/version.js";
-import { validateContentType } from "../security/input-validation/limits.js";
-import { VeryfrontError } from "../security/input-validation/errors.js";
 import { logger as baseLogger } from "../utils/index.js";
+import { createMCPHTTPHandler } from "./http-transport.js";
 import { SessionManager } from "./session.js";
 import { TaskStore } from "./task-store.js";
 const logger = baseLogger.component("mcp-server");
-const MAX_REQUEST_BODY_SIZE = 1_048_576; // 1 MB
 const MAX_CONTEXT_HEADER_LENGTH = 255;
-const JSON_CONTENT_TYPE = "application/json";
 const END_USER_ID_PATTERN = /^[a-zA-Z0-9._@-]+$/;
 const PROJECT_ID_PATTERN = /^[a-zA-Z0-9._-]+$/;
 class JsonRpcError extends Error {
@@ -46,18 +42,6 @@ function toParamsRecord(params) {
         return {};
     return params;
 }
-function createJSONResponse(body, init) {
-    const headers = new dntShim.Headers(init?.headers);
-    headers.set("Content-Type", JSON_CONTENT_TYPE);
-    return new dntShim.Response(JSON.stringify(body), { ...init, headers });
-}
-function createJSONRPCErrorResponse(status, code, message) {
-    return createJSONResponse({
-        jsonrpc: "2.0",
-        id: null,
-        error: { code, message },
-    }, { status });
-}
 function readAllowedHeader(request, headerName, pattern) {
     const value = request.headers.get(headerName);
     if (!value || value.length > MAX_CONTEXT_HEADER_LENGTH || !pattern.test(value)) {
@@ -485,96 +469,19 @@ export class MCPServer {
         return Promise.all(this.pendingTasks.values()).then(() => { });
     }
     createHTTPHandler() {
-        return async (request) => {
-            const requestOrigin = request.headers.get("Origin");
-            // CORS preflight
-            if (request.method === "OPTIONS") {
-                return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders(requestOrigin) });
-            }
-            // Origin validation (DNS rebinding protection)
-            if (requestOrigin && this.config.cors?.enabled && this.config.cors.origins?.length) {
-                if (!this.config.cors.origins.includes(requestOrigin)) {
-                    return createJSONRPCErrorResponse(403, -32600, "Forbidden: Origin not allowed");
-                }
-            }
-            // Auth check (applies to all methods including DELETE)
-            if (this.config.auth?.type && this.config.auth.type !== "none") {
-                const authorized = await this.validateAuth(request);
-                if (!authorized)
-                    return new dntShim.Response("Unauthorized", { status: 401 });
-            }
-            // DELETE = terminate session
-            if (request.method === "DELETE") {
-                const sessionId = request.headers.get("MCP-Session-Id");
-                if (sessionId) {
-                    this.sessionManager.terminate(sessionId);
-                    this.sessionCapabilities.delete(sessionId);
-                }
-                return new dntShim.Response(null, { status: 200, headers: this.getCORSHeaders(requestOrigin) });
-            }
-            // Only POST allowed for JSON-RPC messages
-            if (request.method !== "POST") {
-                return new dntShim.Response("Method Not Allowed", { status: 405 });
-            }
-            // Enforce request body size limit (fast path via Content-Length header)
-            const contentLength = request.headers.get("content-length");
-            if (contentLength && Number(contentLength) > MAX_REQUEST_BODY_SIZE) {
-                return createJSONRPCErrorResponse(413, -32600, "Request body too large");
-            }
-            try {
-                validateContentType(request, JSON_CONTENT_TYPE);
-            }
-            catch (error) {
-                const message = error instanceof VeryfrontError ? error.message : "Invalid Content-Type";
-                return createJSONRPCErrorResponse(400, -32700, message);
-            }
-            let rpcRequest;
-            try {
-                const bodyText = await request.text();
-                if (bodyText.length > MAX_REQUEST_BODY_SIZE) {
-                    return createJSONRPCErrorResponse(413, -32600, "Request body too large");
-                }
-                rpcRequest = JSON.parse(bodyText);
-            }
-            catch (_) {
-                // expected: malformed JSON in request body
-                return createJSONRPCErrorResponse(400, -32700, "Parse error");
-            }
-            // Session management: initialize creates session, everything else requires it
-            const responseHeaders = {
-                ...this.getCORSHeaders(requestOrigin),
-            };
-            if (rpcRequest.method === "initialize") {
-                const context = this.extractRequestContext(request);
-                const rpcResponse = await this.handleRequest(rpcRequest, context);
-                const clientCaps = toParamsRecord(rpcRequest.params).capabilities ??
-                    {};
-                const sessionId = this.sessionManager.create();
-                this.sessionCapabilities.set(sessionId, clientCaps);
-                responseHeaders["MCP-Session-Id"] = sessionId;
-                return createJSONResponse(rpcResponse, { headers: responseHeaders });
-            }
-            // Post-init: require session ID when sessions are active
-            if (this.sessionManager.size > 0) {
-                const sessionId = request.headers.get("MCP-Session-Id");
-                if (!sessionId) {
-                    return createJSONRPCErrorResponse(400, -32600, "Missing MCP-Session-Id header");
-                }
-                if (!this.sessionManager.isValid(sessionId)) {
-                    return createJSONRPCErrorResponse(404, -32600, "Session not found or expired");
-                }
-            }
-            // Notifications have no id member — return 202 Accepted
-            // Note: id:0 is a valid request ID per JSON-RPC 2.0, so check for undefined
-            if (rpcRequest.id === undefined) {
-                const context = this.extractRequestContext(request);
-                await this.handleRequest(rpcRequest, context);
-                return new dntShim.Response(null, { status: 202, headers: responseHeaders });
-            }
-            const context = this.extractRequestContext(request);
-            const rpcResponse = await this.handleRequest(rpcRequest, context);
-            return createJSONResponse(rpcResponse, { headers: responseHeaders });
-        };
+        return createMCPHTTPHandler({
+            authEnabled: Boolean(this.config.auth?.type && this.config.auth.type !== "none"),
+            getCORSHeaders: (requestOrigin) => this.getCORSHeaders(requestOrigin),
+            validateAuth: (request) => this.validateAuth(request),
+            handleRequest: (request, context) => this.handleRequest(request, context),
+            extractRequestContext: (request) => this.extractRequestContext(request),
+            isOriginAllowed: (requestOrigin) => !requestOrigin ||
+                !this.config.cors?.enabled ||
+                !this.config.cors.origins?.length ||
+                this.config.cors.origins.includes(requestOrigin),
+            sessionCapabilities: this.sessionCapabilities,
+            sessionManager: this.sessionManager,
+        });
     }
     extractRequestContext(request) {
         const context = {};

package/esm/src/platform/adapters/fs/veryfront/stat-operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stat-operations.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/fs/veryfront/stat-operations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AA2B/D,qBAAa,cAAe,SAAQ,uBAAuB;IACzD,OAAO,CAAC,SAAS,CAAyC;IAC1D,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,aAAa,CAA8B;IAEnD,OAAO,CAAC,sBAAsB,CAA6B;IAC3D,OAAO,CAAC,qBAAqB,CAA8B;IAE3D,OAAO,CAAC,WAAW,CAAkC;IAErD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAGrC;IAEH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;YAiHvB,gBAAgB;YAwChB,UAAU;IAkDxB,UAAU,IAAI,IAAI;IAMlB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;YAIpC,cAAc;IAqE5B,OAAO,CAAC,0BAA0B;IA6BlC,OAAO,CAAC,qBAAqB;YAQf,sBAAsB;YAyEtB,iBAAiB;IASzB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWtC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAwK1F"}
+{"version":3,"file":"stat-operations.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/fs/veryfront/stat-operations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AA2B/D,qBAAa,cAAe,SAAQ,uBAAuB;IACzD,OAAO,CAAC,SAAS,CAAyC;IAC1D,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,aAAa,CAA8B;IAEnD,OAAO,CAAC,sBAAsB,CAA6B;IAC3D,OAAO,CAAC,qBAAqB,CAA8B;IAE3D,OAAO,CAAC,WAAW,CAAkC;IAErD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAGrC;IAEH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;YAiHvB,gBAAgB;YAwChB,UAAU;IAkDxB,UAAU,IAAI,IAAI;IAMlB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;YAIpC,cAAc;IAqE5B,OAAO,CAAC,0BAA0B;IAgClC,OAAO,CAAC,qBAAqB;YAQf,sBAAsB;YA8EtB,iBAAiB;IASzB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWtC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAkI1F"}

package/esm/src/platform/adapters/fs/veryfront/stat-operations.js

@@ -255,7 +255,7 @@ export class StatOperations extends VeryfrontOperationsBase {
         this.cache.set(cacheKey, files);
         return files;
     }
-    buildResolveSearchPatterns(normalizedPath, options) {
+    buildResolveSearchPatterns(normalizedPath, options, knownExtensionFallback = "exact") {
         const patterns = new Set();
         const pathWithoutExt = stripKnownExtension(normalizedPath, EXTENSION_PRIORITY);
         const allowPagesPrefix = options?.allowPagesPrefix !== false;
@@ -264,7 +264,7 @@ export class StatOperations extends VeryfrontOperationsBase {
                 patterns.add(pattern);
         };
         if (EXTENSION_PRIORITY.some((ext) => normalizedPath.endsWith(ext))) {
-            addPattern(normalizedPath);
+            addPattern(knownExtensionFallback === "wildcard" ? `${pathWithoutExt}.*` : normalizedPath);
             return [...patterns];
         }
         addPattern(`${pathWithoutExt}.*`);
@@ -282,7 +282,7 @@ export class StatOperations extends VeryfrontOperationsBase {
             path: normalizeIndexedFilePath(match).normalizedPath,
         }));
     }
-    async tryResolveViaApiSearch(normalizedPath, options) {
+    async tryResolveViaApiSearch(normalizedPath, options, knownExtensionFallback = "exact") {
         if (isFrameworkSourcePath(normalizedPath)) {
             logger.debug("Skipping API search for framework path", { normalizedPath });
             return null;
@@ -291,7 +291,7 @@ export class StatOperations extends VeryfrontOperationsBase {
             logger.warn("API search circuit breaker open, skipping", { normalizedPath });
             return undefined;
         }
-        const patterns = this.buildResolveSearchPatterns(normalizedPath, options);
+        const patterns = this.buildResolveSearchPatterns(normalizedPath, options, knownExtensionFallback);
         let sawSuccessfulSearch = false;
         for (const pattern of patterns) {
             try {
@@ -459,49 +459,17 @@ export class StatOperations extends VeryfrontOperationsBase {
             logger.debug("Skipping API search for framework path", { normalizedPath });
             return null;
         }
-        // NOTE: Removed optimization that skipped API search for paths with extensions.
-        // This was causing layout files and other project files to not be found when
-        // they were missing from the file index (due to cache issues, incomplete fetch, etc.).
-        // The API pattern search is the fallback to ensure files can still be found.
-        if (!this.apiSearchCircuitBreaker.canSearch()) {
-            logger.warn("API search circuit breaker open, skipping", { normalizedPath });
-            return null;
-        }
-        const searchPattern = `${pathWithoutExt}.*`;
-        logger.debug("Searching for file via API", {
-            pattern: searchPattern,
-            normalizedPath,
-        });
-        try {
-            const matches = await this.client.searchFiles(searchPattern);
-            this.apiSearchCircuitBreaker.recordSuccess();
-            logger.debug("API search result", {
-                pattern: searchPattern,
-                matchCount: matches.length,
-                matches: matches.map((m) => m.path).slice(0, 5),
-            });
-            const sortedMatches = sortPathsByExtensionPriority(matches, EXTENSION_PRIORITY);
-            const first = sortedMatches[0];
-            if (first) {
-                logger.debug("resolveFile found via API search", { path: first.path });
-                this.cache.set(cacheKey, first.path);
-                return first.path;
-            }
+        // NOTE: Keep the post-index API fallback aligned with the pre-index helper for extensionless
+        // paths, while preserving the older wildcard sibling-extension lookup for known-extension
+        // paths. Incomplete file-list snapshots otherwise hide valid files until the cache refreshes.
+        const apiResolved = await this.tryResolveViaApiSearch(normalizedPath, options, "wildcard");
+        if (typeof apiResolved === "string") {
+            this.cache.set(cacheKey, apiResolved);
+            return apiResolved;
         }
-        catch (error) {
-            const result = this.apiSearchCircuitBreaker.recordFailure();
-            if (result.tripped) {
-                logger.warn("API search circuit breaker tripped", {
-                    failures: result.failures,
-                });
-            }
-            logger.error("API pattern search failed", { pattern: searchPattern, error });
+        if (apiResolved === null) {
+            this.cache.set(cacheKey, NOT_FOUND_SENTINEL);
         }
-        logger.debug("resolveFile not found after API search", {
-            normalizedPath,
-            pathWithoutExt,
-        });
-        this.cache.set(cacheKey, NOT_FOUND_SENTINEL);
         return null;
     }
 }

package/esm/src/utils/version-constant.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.1.159";
+export declare const VERSION = "0.1.161";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,3 +1,3 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
-export const VERSION = "0.1.159";
+export const VERSION = "0.1.161";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.159",
+  "version": "0.1.161",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.159",
+  "version": "0.1.161",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [

package/src/src/agent/index.ts

@@ -97,7 +97,13 @@ export type {
   MessagePart,
   ModelProvider,
   ModelString,
+  ModelTransportRequest,
+  ModelTransportResolver,
   ResolvedAgentConfig,
+  ResolvedModelTransport,
+  ResolvedRuntimeState,
+  RuntimeStateRequest,
+  RuntimeStateResolver,
   StreamToolCall,
   ToolCall,
   ToolCallPart,

package/src/src/agent/runtime/index.ts

@@ -10,6 +10,8 @@
  *
  * @module ai/agent/runtime
  */
+import * as dntShim from "../../../_dnt.shims.js";
+
 
 import {
   type AgentConfig,
@@ -19,6 +21,7 @@ import {
   getTextFromParts,
   type Message,
   type MessagePart,
+  type ResolvedRuntimeState,
   type ToolCall,
   type ToolResultPart,
 } from "../types.js";
@@ -264,6 +267,19 @@ function getRuntimeAllowedRemoteTools(config: AgentConfig): string[] | undefined
   return raw.every((toolName) => typeof toolName === "string") ? raw : [];
 }
 
+type ResolvedModelTransport = {
+  requestedModel: string;
+  resolvedModelString: string;
+  languageModel: ModelRuntime;
+  headers?: dntShim.HeadersInit;
+  providerOptions?: Record<string, unknown>;
+};
+
+type RuntimeStepState = {
+  systemPrompt: string;
+  context?: Record<string, unknown>;
+};
+
 export class AgentRuntime {
   private id: string;
   private config: AgentConfig;
@@ -279,6 +295,52 @@ export class AgentRuntime {
     this.memory = createMemory<Message>(memoryConfig);
   }
 
+  private async resolveModelTransport(
+    context: Record<string, unknown> | undefined,
+    modelOverride: string | undefined,
+    mode: "generate" | "stream",
+  ): Promise<ResolvedModelTransport> {
+    const requestedModel = resolveConfiguredAgentModel(modelOverride || this.config.model);
+    const resolvedModelString = resolveRuntimeModel(modelOverride || this.config.model);
+    const transport = await this.config.resolveModelTransport?.({
+      agentId: this.id,
+      requestedModel,
+      resolvedModel: resolvedModelString,
+      context,
+      mode,
+    });
+
+    return {
+      requestedModel,
+      resolvedModelString,
+      languageModel: transport?.model ?? resolveModel(resolvedModelString),
+      headers: transport?.headers,
+      providerOptions: transport?.providerOptions,
+    };
+  }
+
+  private async resolveRuntimeState(
+    messages: Message[],
+    context: Record<string, unknown> | undefined,
+    mode: "generate" | "stream",
+    step: number,
+    systemPrompt: string,
+  ): Promise<RuntimeStepState> {
+    const refreshed: ResolvedRuntimeState | undefined = await this.config.resolveRuntimeState?.({
+      agentId: this.id,
+      mode,
+      step,
+      system: systemPrompt,
+      messages: [...messages],
+      context,
+    });
+
+    return {
+      systemPrompt: refreshed?.system ?? systemPrompt,
+      context: refreshed?.context ?? context,
+    };
+  }
+
   /**
    * Generate a response (non-streaming)
    */
@@ -288,8 +350,9 @@ export class AgentRuntime {
     modelOverride?: string,
     maxOutputTokensOverride?: number,
   ): Promise<AgentResponse> {
-    const requestedModel = resolveConfiguredAgentModel(modelOverride || this.config.model);
-    const resolvedModelString = resolveRuntimeModel(modelOverride || this.config.model);
+    const transport = await this.resolveModelTransport(context, modelOverride, "generate");
+    const requestedModel = transport.requestedModel;
+    const resolvedModelString = transport.resolvedModelString;
     if (resolvedModelString !== requestedModel) {
       logger.info(
         `⚡ Using runtime model "${resolvedModelString}" instead of "${requestedModel}".`,
@@ -326,9 +389,12 @@ export class AgentRuntime {
             {
               agentId: this.id,
               projectId: tryGetCacheKeyContext()?.projectId,
-              ...context,
             },
+            context,
             resolvedModelString,
+            transport.languageModel,
+            transport.headers,
+            transport.providerOptions,
             maxOutputTokensOverride,
           ),
       );
@@ -351,8 +417,9 @@ export class AgentRuntime {
     maxOutputTokensOverride?: number,
     abortSignal?: AbortSignal,
   ): Promise<ReadableStream<Uint8Array>> {
-    const requestedModel = resolveConfiguredAgentModel(modelOverride || this.config.model);
-    const resolvedModelString = resolveRuntimeModel(modelOverride || this.config.model);
+    const transport = await this.resolveModelTransport(context, modelOverride, "stream");
+    const requestedModel = transport.requestedModel;
+    const resolvedModelString = transport.resolvedModelString;
     if (resolvedModelString !== requestedModel) {
       logger.info(
         `⚡ Using runtime model "${resolvedModelString}" instead of "${requestedModel}".`,
@@ -389,7 +456,7 @@ export class AgentRuntime {
     // Resolve model BEFORE creating the ReadableStream — if this throws
     // (e.g., no_ai_available), the error propagates to the caller who can
     // return a proper error response (503) instead of a 200 with an error event.
-    const languageModel = resolveModel(resolvedModelString);
+    const languageModel = transport.languageModel;
 
     // Determine inference mode from the resolved model object (not the string),
     // because resolveModel may internally fall back from cloud to local.
@@ -433,8 +500,11 @@ export class AgentRuntime {
             callbacks,
             textPartId,
             toolContext,
+            context,
             resolvedModelString,
             languageModel,
+            transport.headers,
+            transport.providerOptions,
             maxOutputTokensOverride,
             streamAbortSignal,
           );
@@ -474,15 +544,19 @@ export class AgentRuntime {
   private async executeAgentLoop(
     systemPrompt: string,
     messages: Message[],
-    toolContext?: ToolExecutionContext,
+    toolContextBase?: ToolExecutionContext,
+    runtimeContext?: Record<string, unknown>,
     modelString?: string,
+    resolvedModel?: ModelRuntime,
+    headers?: dntShim.HeadersInit,
+    providerOptions?: Record<string, unknown>,
     maxOutputTokensOverride?: number,
   ): Promise<AgentResponse> {
     return withSpan("agent.execution_loop", async (loopSpan) => {
       const { maxAgentSteps } = getPlatformCapabilities();
       const maxSteps = this.computeMaxSteps(maxAgentSteps);
       const effectiveModel = resolveRuntimeModel(modelString || this.config.model);
-      const languageModel = resolveModel(effectiveModel);
+      const languageModel = resolvedModel ?? resolveModel(effectiveModel);
 
       const toolCalls: ToolCall[] = [];
       const currentMessages = [...messages];
@@ -502,11 +576,24 @@ export class AgentRuntime {
       // Request-scoped skill policy (not class-level mutable state)
       let activeSkillPolicy: string[] | undefined;
       const allowedRemoteToolNames = getRuntimeAllowedRemoteTools(this.config);
+      let currentSystemPrompt = systemPrompt;
+      let currentRuntimeContext = runtimeContext;
 
       for (let step = 0; step < maxSteps; step++) {
         this.status = "thinking";
         addSpanEvent(loopSpan, "step_start", { step });
 
+        const runtimeState = await this.resolveRuntimeState(
+          currentMessages,
+          currentRuntimeContext,
+          "generate",
+          step,
+          currentSystemPrompt,
+        );
+        currentSystemPrompt = runtimeState.systemPrompt;
+        currentRuntimeContext = runtimeState.context;
+        const toolContext = { ...toolContextBase, ...currentRuntimeContext };
+
         let tools = isLocal ? [] : await getAvailableTools(this.config.tools, {
           includeSkillTools: Boolean(this.config.skills),
           allowedRemoteToolNames,
@@ -526,7 +613,7 @@ export class AgentRuntime {
           });
           return generateText({
             model: languageModel,
-            system: systemPrompt,
+            system: currentSystemPrompt,
             messages: convertToModelMessages(currentMessages),
             tools: convertToolsToRuntimeTools(tools, {
               model: effectiveModel,
@@ -535,6 +622,8 @@ export class AgentRuntime {
             experimental_repairToolCall: repairToolCall,
             maxOutputTokens: this.resolveMaxOutputTokens(maxOutputTokensOverride),
             temperature: DEFAULT_TEMPERATURE,
+            ...(headers ? { headers } : {}),
+            ...(providerOptions ? { providerOptions } : {}),
           });
         });
 
@@ -764,9 +853,12 @@ export class AgentRuntime {
       onFinish?: (response: AgentResponse) => void;
     },
     textPartId?: string,
-    toolContext?: Record<string, unknown>,
+    toolContextBase?: Record<string, unknown>,
+    runtimeContext?: Record<string, unknown>,
     modelString?: string,
     resolvedModel?: ModelRuntime,
+    headers?: dntShim.HeadersInit,
+    providerOptions?: Record<string, unknown>,
     maxOutputTokensOverride?: number,
     abortSignal?: AbortSignal,
   ): Promise<AgentResponse> {
@@ -795,12 +887,25 @@ export class AgentRuntime {
     let finalFinishReason: string | undefined;
     let latestAssistantText = "";
     const allowedRemoteToolNames = getRuntimeAllowedRemoteTools(this.config);
+    let currentSystemPrompt = systemPrompt;
+    let currentRuntimeContext = runtimeContext;
 
     for (let step = 0; step < maxSteps; step++) {
       throwIfAborted(abortSignal);
       sendSSE(controller, encoder, { type: "step-start" });
       const currentStepToolResults = new Map<string, ToolResultPart>();
 
+      const runtimeState = await this.resolveRuntimeState(
+        currentMessages,
+        currentRuntimeContext,
+        "stream",
+        step,
+        currentSystemPrompt,
+      );
+      currentSystemPrompt = runtimeState.systemPrompt;
+      currentRuntimeContext = runtimeState.context;
+      const toolContext = { ...toolContextBase, ...currentRuntimeContext };
+
       let tools = isLocalStreaming ? [] : await getAvailableTools(this.config.tools, {
         includeSkillTools: Boolean(this.config.skills),
         allowedRemoteToolNames,
@@ -815,7 +920,7 @@ export class AgentRuntime {
 
       const result = streamText({
         model: languageModel,
-        system: systemPrompt,
+        system: currentSystemPrompt,
         messages: convertToModelMessages(currentMessages),
         tools: convertToolsToRuntimeTools(tools, {
           model: effectiveModel,
@@ -824,6 +929,8 @@ export class AgentRuntime {
         experimental_repairToolCall: repairToolCall,
         maxOutputTokens: this.resolveMaxOutputTokens(maxOutputTokensOverride),
         temperature: DEFAULT_TEMPERATURE,
+        ...(headers ? { headers } : {}),
+        ...(providerOptions ? { providerOptions } : {}),
         abortSignal,
       });
 

package/src/src/agent/types.ts

@@ -4,6 +4,7 @@
 import * as dntShim from "../../_dnt.shims.js";
 
 
+import type { ModelRuntime } from "../provider/types.js";
 import type { RemoteToolSource, Tool } from "../tool/index.js";
 import { INVALID_ARGUMENT } from "../errors/error-registry.js";
 import type { Memory } from "./memory/memory-interface.js";
@@ -91,6 +92,16 @@ export interface AgentConfig {
   };
   /** Restrict runtime model overrides to these "provider/model" strings. */
   allowedModels?: ModelString[];
+  /**
+   * Optional request-aware hook for overriding the resolved model runtime and
+   * provider transport options on a per-call basis.
+   */
+  resolveModelTransport?: ModelTransportResolver;
+  /**
+   * Optional step-boundary hook for refreshing the runtime system prompt and
+   * host-owned context during a long-lived run.
+   */
+  resolveRuntimeState?: RuntimeStateResolver;
   /**
    * Enable skills for this agent.
    * - true: include all discovered skills from skills/ directory
@@ -108,6 +119,42 @@ export interface AgentConfig {
 
 export type ResolvedAgentConfig = AgentConfig & { model: ModelString };
 
+export interface ModelTransportRequest {
+  agentId: string;
+  requestedModel: ModelString;
+  resolvedModel: ModelString;
+  context?: Record<string, unknown>;
+  mode: "generate" | "stream";
+}
+
+export interface ResolvedModelTransport {
+  model?: ModelRuntime;
+  headers?: dntShim.HeadersInit;
+  providerOptions?: Record<string, unknown>;
+}
+
+export type ModelTransportResolver = (
+  request: ModelTransportRequest,
+) => ResolvedModelTransport | Promise<ResolvedModelTransport>;
+
+export interface RuntimeStateRequest {
+  agentId: string;
+  mode: "generate" | "stream";
+  step: number;
+  system: string;
+  messages: Message[];
+  context?: Record<string, unknown>;
+}
+
+export interface ResolvedRuntimeState {
+  system?: string;
+  context?: Record<string, unknown>;
+}
+
+export type RuntimeStateResolver = (
+  request: RuntimeStateRequest,
+) => ResolvedRuntimeState | undefined | Promise<ResolvedRuntimeState | undefined>;
+
 // Import for use in AgentMiddleware
 import type { AgentContext, AgentResponse } from "./schemas/index.js";