veryfront 0.1.48 → 0.1.49

package/src/src/agent/react/use-chat/use-chat.ts

@@ -77,6 +77,7 @@ export function useChat(options: UseChatOptions): UseChatResult {
   const [data, setData] = useState<unknown>(null);
   const [model, setModel] = useState<string | undefined>(options.model);
   const [inferenceMode, setInferenceMode] = useState<InferenceMode>("cloud");
+  const [activeModel, setActiveModel] = useState<string | undefined>(undefined);
   const [browserStatus, setBrowserStatus] = useState<BrowserInferenceStatus | null>(null);
   const abortControllerRef = useRef<AbortController | null>(null);
   const requestIdRef = useRef(0);
@@ -253,9 +254,6 @@ export function useChat(options: UseChatOptions): UseChatResult {
           try {
             const body = await response.json();
             if (body.code === "NO_AI_AVAILABLE") {
-              if (body.systemPrompt) {
-                systemPromptRef.current = body.systemPrompt;
-              }
               setInferenceMode("browser");
               setBrowserStatus("idle");
               await doBrowserInference(allMessages);
@@ -282,12 +280,15 @@ export function useChat(options: UseChatOptions): UseChatResult {
         const streamingMessageId = generateClientId("msg");
         let hasAddedStreamingMessage = false;
         const currentMessageIdRef = { current: streamingMessageId };
+        // Mutable local — updated by onData before onMessage/onUpdate use it.
+        let serverModel: string | undefined = model;
+        setActiveModel(undefined);
 
         await handleStreamingResponse(response.body, {
           onMessage: (assistantMessage) => {
             const withMeta = {
               ...assistantMessage,
-              metadata: { ...assistantMessage.metadata, model },
+              metadata: { ...assistantMessage.metadata, model: serverModel },
             };
             setMessages((prev) => {
               if (!hasAddedStreamingMessage) return [...prev, withMeta];
@@ -302,15 +303,19 @@ export function useChat(options: UseChatOptions): UseChatResult {
           },
           onData: (eventData) => {
             setData(eventData);
-            // Detect inference mode from server metadata
+            // Detect inference mode and resolved model from server metadata
             if (
               eventData &&
               typeof eventData === "object" &&
               "inferenceMode" in eventData
             ) {
-              const mode = (eventData as { inferenceMode: string }).inferenceMode;
-              if (mode === "server-local" || mode === "cloud") {
-                setInferenceMode(mode);
+              const d = eventData as { inferenceMode: string; model?: string };
+              if (d.inferenceMode === "server-local" || d.inferenceMode === "cloud") {
+                setInferenceMode(d.inferenceMode);
+              }
+              if (d.model) {
+                serverModel = d.model;
+                setActiveModel(d.model);
               }
             }
           },
@@ -331,7 +336,7 @@ export function useChat(options: UseChatOptions): UseChatResult {
               hasAddedStreamingMessage = true;
               setMessages((
                 prev,
-              ) => [...prev, { id, role: "assistant", parts, metadata: { model } }]);
+              ) => [...prev, { id, role: "assistant", parts, metadata: { model: serverModel } }]);
               return;
             }
 
@@ -549,6 +554,7 @@ export function useChat(options: UseChatOptions): UseChatResult {
     isLoading,
     error,
     model,
+    activeModel,
     inferenceMode,
     browserStatus,
     setInput,

package/src/src/agent/runtime/index.ts

@@ -21,7 +21,7 @@ import {
   type MessagePart,
   type ToolCall,
 } from "../types.js";
-import { ensureModelReady, resolveModel } from "../../provider/index.js";
+import { ensureModelReady, findAvailableCloudModel, resolveModel } from "../../provider/index.js";
 import { executeTool } from "../../tool/index.js";
 import { generateId } from "../../utils/id.js";
 import { detectPlatform, getPlatformCapabilities } from "../../platform/core-platform.js";
@@ -56,28 +56,117 @@ import { DEFAULT_MAX_TOKENS, DEFAULT_TEMPERATURE } from "./constants.js";
 import { generateMessageId, sendSSE } from "./sse-utils.js";
 import { getAvailableTools, isDynamicTool, parseToolArgs } from "./tool-helpers.js";
 import { accumulateUsage, getMaxSteps, normalizeInput } from "./input-utils.js";
+import {
+  filterToolsForSkill,
+  isToolAllowedBySkill,
+  validateAllowedToolPatterns,
+} from "../../skill/allowed-tools.js";
 
 const logger = serverLogger.component("agent");
+const LOAD_SKILL_TOOL_ID = "load-skill";
+
+function getSkillActivationRequiredError(toolName: string): string {
+  return `Tool "${toolName}" cannot run before load-skill succeeds in the same step. ` +
+    `Call "${LOAD_SKILL_TOOL_ID}" first to establish the active skill context.`;
+}
 
 /**
- * Detect whether the resolved model is local inference.
- * Handles both explicit "local/*" requests and cloud->local auto-fallback.
+ * Extract and validate the skill policy from a load-skill tool result.
+ * Returns `[]` (no tools allowed) for invalid/missing policies instead of
+ * `undefined` (no restrictions), preventing accidental policy bypass.
  */
-function isLocalInferenceModel(model: LanguageModel, requestedModel: string): boolean {
-  if (requestedModel.startsWith("local/")) return true;
+export function extractSkillPolicy(result: unknown): string[] | undefined {
+  if (!result || typeof result !== "object") return undefined;
+  const skillResult = result as { allowedTools?: unknown };
+
+  // No allowedTools key means the skill has no restrictions
+  if (!("allowedTools" in skillResult) || skillResult.allowedTools === undefined) {
+    return undefined;
+  }
+
+  // Validate the shape: must be a string array
+  const raw = skillResult.allowedTools;
+  if (!Array.isArray(raw) || !raw.every((v) => typeof v === "string")) {
+    // Invalid shape — fail closed (empty policy = no tools allowed)
+    logger.warn(
+      "load-skill returned invalid allowedTools; falling back to empty policy (no tools)",
+    );
+    return [];
+  }
+
+  // Validate each pattern against the regex
+  try {
+    return validateAllowedToolPatterns(raw);
+  } catch {
+    logger.warn(
+      "load-skill returned invalid tool patterns; falling back to empty policy (no tools)",
+    );
+    return [];
+  }
+}
+
+/** Result of skill policy enforcement for a single tool call */
+type SkillPolicyResult =
+  | { allowed: true }
+  | { allowed: false; error: string };
+
+/**
+ * Enforce skill policy on a single tool call.
+ * Shared between generate() and stream() paths.
+ */
+export function enforceSkillPolicy(
+  toolName: string,
+  activeSkillPolicy: string[] | undefined,
+  mustLoadSkillFirst: boolean,
+): SkillPolicyResult {
+  // Must load skill before other tools
+  if (mustLoadSkillFirst && toolName !== LOAD_SKILL_TOOL_ID) {
+    return { allowed: false, error: getSkillActivationRequiredError(toolName) };
+  }
 
-  // LanguageModel is a union that includes string, so we need to narrow first
-  if (typeof model === "string") return model.startsWith("local/");
+  // Check tool allowed by active skill policy (Layer 2: execution-time)
+  if (activeSkillPolicy && !isToolAllowedBySkill(toolName, activeSkillPolicy)) {
+    return {
+      allowed: false,
+      error: `Tool "${toolName}" is not allowed by the active skill policy. Allowed: ${
+        activeSkillPolicy.join(", ")
+      }`,
+    };
+  }
 
-  if ("provider" in model && model.provider === "local") return true;
+  return { allowed: true };
+}
 
-  if (
-    "modelId" in model && typeof model.modelId === "string" && model.modelId.startsWith("local/")
-  ) {
-    return true;
+/**
+ * Auto-upgrade a local model string to a cloud provider when API keys are available.
+ *
+ * Returns the upgraded "provider/model" string, or the original string unchanged
+ * if no cloud provider is available. This keeps resolveModel as a pure resolver
+ * while the runtime owns the upgrade policy.
+ */
+function maybeUpgradeLocalModel(modelString: string): string {
+  if (!modelString.startsWith("local/")) return modelString;
+
+  const cloud = findAvailableCloudModel();
+  if (cloud) {
+    logger.info(
+      `⚡ Cloud AI API key found — using "${cloud}" instead of local model.`,
+    );
+    return cloud;
   }
+  return modelString;
+}
 
-  return false;
+/**
+ * Check whether a resolved LanguageModel is a local inference model.
+ * Checks the model object properties rather than the requested string,
+ * because resolveModel may internally fall back from cloud to local.
+ */
+function isLocalModel(model: LanguageModel): boolean {
+  const m = model as Record<string, unknown>;
+  return !!m._isVfLocalModel ||
+    m.provider === "local" ||
+    (typeof m.modelId === "string" && m.modelId.startsWith("local/"));
 }
 
 export class AgentRuntime {
@@ -102,12 +191,12 @@ export class AgentRuntime {
     context?: Record<string, unknown>,
     modelOverride?: string,
   ): Promise<AgentResponse> {
-    const modelString = modelOverride || this.config.model;
+    const resolvedModelString = maybeUpgradeLocalModel(modelOverride || this.config.model);
 
     return withSpan("agent.generate", async (span) => {
       setSpanAttributes(span, {
         "agent.id": this.id,
-        "agent.model": modelString,
+        "agent.model": resolvedModelString,
       });
 
       const inputMessages = normalizeInput(input);
@@ -118,7 +207,7 @@ export class AgentRuntime {
 
       const agentContext: AgentContext = {
         agentId: this.id,
-        model: modelString,
+        model: resolvedModelString,
         input: inputMessages,
         data: context,
         platform: detectPlatform(),
@@ -127,7 +216,7 @@ export class AgentRuntime {
       const chain = new MiddlewareChain(this.config.middleware);
       return chain.execute(
         agentContext,
-        () => this.executeAgentLoop(systemPrompt, messages, modelString),
+        () => this.executeAgentLoop(systemPrompt, messages, resolvedModelString),
       );
     });
   }
@@ -145,8 +234,9 @@ export class AgentRuntime {
     },
     modelOverride?: string,
   ): Promise<ReadableStream<Uint8Array>> {
-    const modelString = modelOverride || this.config.model;
-    const requestedModel = modelString || this.config.model;
+    const requestedModel = modelOverride || this.config.model;
+    // Auto-upgrade local/* to a cloud provider when API keys are available.
+    const resolvedModelString = maybeUpgradeLocalModel(requestedModel);
 
     for (const msg of messages) await this.memory.add(msg);
 
@@ -160,7 +250,11 @@ export class AgentRuntime {
     // Resolve model BEFORE creating the ReadableStream — if this throws
     // (e.g., no_ai_available), the error propagates to the caller who can
     // return a proper error response (503) instead of a 200 with an error event.
-    const languageModel = resolveModel(requestedModel);
+    const languageModel = resolveModel(resolvedModelString);
+
+    // Determine inference mode from the resolved model object (not the string),
+    // because resolveModel may internally fall back from cloud to local.
+    const isLocal = isLocalModel(languageModel);
 
     // Eagerly verify the model runtime is available. For local models this
     // checks that @huggingface/transformers can be imported. Must happen
@@ -176,12 +270,17 @@ export class AgentRuntime {
 
           const messageId = generateMessageId();
           sendSSE(controller, encoder, { type: "message-start", messageId });
+          // Report the effective model — when resolveModel falls back from
+          // cloud to local (e.g. missing API key), use the resolved object's
+          // modelId so the client avatar matches the actual provider.
+          const effectiveModel = isLocal && !resolvedModelString.startsWith("local/")
+            ? `local/${(languageModel as Record<string, unknown>).modelId ?? "unknown"}`
+            : resolvedModelString;
           sendSSE(controller, encoder, {
             type: "data",
             data: {
-              inferenceMode: isLocalInferenceModel(languageModel, requestedModel)
-                ? "server-local"
-                : "cloud",
+              inferenceMode: isLocal ? "server-local" : "cloud",
+              model: effectiveModel,
             },
           });
           sendSSE(controller, encoder, { type: "text-start", id: textPartId });
@@ -194,7 +293,7 @@ export class AgentRuntime {
             callbacks,
             textPartId,
             toolContext,
-            modelString,
+            resolvedModelString,
             languageModel,
           );
 
@@ -224,28 +323,38 @@ export class AgentRuntime {
     return withSpan("agent.execution_loop", async (loopSpan) => {
       const { maxAgentSteps } = getPlatformCapabilities();
       const maxSteps = this.computeMaxSteps(maxAgentSteps);
-      const requestedModel = modelString || this.config.model;
-      const languageModel = resolveModel(requestedModel);
+      const effectiveModel = modelString || this.config.model;
+      const languageModel = resolveModel(effectiveModel);
 
       const toolCalls: ToolCall[] = [];
       const currentMessages = [...messages];
       const totalUsage = { promptTokens: 0, completionTokens: 0, totalTokens: 0 };
 
       // Local models can't reliably do function calling — skip tools gracefully.
-      const isLocal = isLocalInferenceModel(languageModel, requestedModel);
+      const isLocal = isLocalModel(languageModel);
       if (isLocal && this.config.tools) {
         logger.warn(
-          `Agent "${this.id}" has tools configured but is using local model "${requestedModel}". ` +
+          `Agent "${this.id}" has tools configured but is using local model "${effectiveModel}". ` +
             "Local models don't support tool calling — tools will be skipped. " +
             "Set OPENAI_API_KEY, ANTHROPIC_API_KEY, or GOOGLE_API_KEY for full tool support.",
         );
       }
 
+      // Request-scoped skill policy (not class-level mutable state)
+      let activeSkillPolicy: string[] | undefined;
+
       for (let step = 0; step < maxSteps; step++) {
         this.status = "thinking";
         addSpanEvent(loopSpan, "step_start", { step });
 
-        const tools = isLocal ? [] : getAvailableTools(this.config.tools);
+        let tools = isLocal ? [] : getAvailableTools(this.config.tools, {
+          includeSkillTools: Boolean(this.config.skills),
+        });
+
+        // Layer 1: Filter tools based on active skill policy (planning-time)
+        if (activeSkillPolicy) {
+          tools = filterToolsForSkill(tools, activeSkillPolicy);
+        }
 
         const response = await withSpan("agent.generate_text", async (span) => {
           setSpanAttributes(span, {
@@ -308,6 +417,9 @@ export class AgentRuntime {
 
         this.status = "tool_execution";
         addSpanEvent(loopSpan, "tool_execution_start", { count: response.toolCalls.length });
+        let mustLoadSkillFirst = !activeSkillPolicy &&
+          Boolean(this.config.skills) &&
+          response.toolCalls.some((tc) => tc.toolName === LOAD_SKILL_TOOL_ID);
 
         for (const tc of response.toolCalls) {
           const toolCall: ToolCall = {
@@ -320,6 +432,32 @@ export class AgentRuntime {
           await withSpan("agent.tool_execute", async (toolSpan) => {
             setSpanAttributes(toolSpan, { "tool.name": tc.toolName, "tool.id": tc.toolCallId });
 
+            const policyCheck = enforceSkillPolicy(
+              tc.toolName,
+              activeSkillPolicy,
+              mustLoadSkillFirst,
+            );
+            if (!policyCheck.allowed) {
+              toolCall.status = "error";
+              toolCall.error = policyCheck.error;
+
+              const errorMessage: Message = {
+                id: `tool_error_${tc.toolCallId}`,
+                role: "tool",
+                parts: [{
+                  type: "tool-result",
+                  toolCallId: tc.toolCallId,
+                  toolName: tc.toolName,
+                  result: { error: policyCheck.error },
+                }],
+                timestamp: Date.now(),
+              };
+              currentMessages.push(errorMessage);
+              await this.memory.add(errorMessage);
+              toolCalls.push(toolCall);
+              return;
+            }
+
             try {
               toolCall.status = "executing";
               const startTime = Date.now();
@@ -330,6 +468,12 @@ export class AgentRuntime {
               toolCall.result = result;
               toolCall.executionTime = Date.now() - startTime;
 
+              // Track skill policy from load-skill results
+              if (tc.toolName === LOAD_SKILL_TOOL_ID) {
+                activeSkillPolicy = extractSkillPolicy(result);
+                mustLoadSkillFirst = false;
+              }
+
               const toolResultMessage: Message = {
                 id: `tool_${tc.toolCallId}`,
                 role: "tool",
@@ -408,27 +552,38 @@ export class AgentRuntime {
   ): Promise<AgentResponse> {
     const { maxAgentSteps } = getPlatformCapabilities();
     const maxSteps = this.computeMaxSteps(maxAgentSteps);
-    const requestedModel = modelString || this.config.model;
-    const languageModel = resolvedModel ?? resolveModel(requestedModel);
+    const effectiveModel = modelString || this.config.model;
+    const languageModel = resolvedModel ?? resolveModel(effectiveModel);
 
     const toolCalls: ToolCall[] = [];
     const currentMessages = [...messages];
     const totalUsage = { promptTokens: 0, completionTokens: 0, totalTokens: 0 };
 
     // Local models can't reliably do function calling — skip tools gracefully.
-    const isLocalStreaming = isLocalInferenceModel(languageModel, requestedModel);
+    const isLocalStreaming = isLocalModel(languageModel);
     if (isLocalStreaming && this.config.tools) {
       logger.warn(
-        `Agent "${this.id}" has tools configured but is using local model "${requestedModel}". ` +
+        `Agent "${this.id}" has tools configured but is using local model "${effectiveModel}". ` +
           "Local models don't support tool calling — tools will be skipped. " +
           "Set OPENAI_API_KEY, ANTHROPIC_API_KEY, or GOOGLE_API_KEY for full tool support.",
       );
     }
 
+    // Request-scoped skill policy (not class-level mutable state)
+    let activeSkillPolicy: string[] | undefined;
+
     for (let step = 0; step < maxSteps; step++) {
       sendSSE(controller, encoder, { type: "step-start" });
 
-      const tools = isLocalStreaming ? [] : getAvailableTools(this.config.tools);
+      let tools = isLocalStreaming ? [] : getAvailableTools(this.config.tools, {
+        includeSkillTools: Boolean(this.config.skills),
+      });
+
+      // Layer 1: Filter tools based on active skill policy (planning-time)
+      if (activeSkillPolicy) {
+        tools = filterToolsForSkill(tools, activeSkillPolicy);
+      }
+
       const result = streamText({
         model: languageModel,
         system: systemPrompt,
@@ -478,8 +633,12 @@ export class AgentRuntime {
       }
 
       this.status = "tool_execution";
+      const streamedToolCalls = Array.from(state.toolCalls.values());
+      let mustLoadSkillFirst = !activeSkillPolicy &&
+        Boolean(this.config.skills) &&
+        streamedToolCalls.some((tc) => tc.name === LOAD_SKILL_TOOL_ID);
 
-      for (const tc of state.toolCalls.values()) {
+      for (const tc of streamedToolCalls) {
         const { args, error: argError } = parseToolArgs(tc.arguments);
         const toolCall: ToolCall = { id: tc.id, name: tc.name, args, status: "pending" };
 
@@ -508,6 +667,19 @@ export class AgentRuntime {
           continue;
         }
 
+        const policyCheck = enforceSkillPolicy(tc.name, activeSkillPolicy, mustLoadSkillFirst);
+        if (!policyCheck.allowed) {
+          await this.recordToolError(
+            toolCall,
+            policyCheck.error,
+            controller,
+            encoder,
+            currentMessages,
+            toolCalls,
+          );
+          continue;
+        }
+
         try {
           toolCall.status = "executing";
           const startTime = Date.now();
@@ -524,6 +696,12 @@ export class AgentRuntime {
           toolCall.executionTime = Date.now() - startTime;
           toolCalls.push(toolCall);
 
+          // Track skill policy from load-skill results
+          if (tc.name === LOAD_SKILL_TOOL_ID) {
+            activeSkillPolicy = extractSkillPolicy(result);
+            mustLoadSkillFirst = false;
+          }
+
           const dynamic = isDynamicTool(tc.name);
           sendSSE(controller, encoder, {
             type: "tool-output-available",

package/src/src/agent/runtime/tool-helpers.ts

@@ -9,6 +9,7 @@
 import type { Tool, ToolDefinition } from "../../tool/index.js";
 import { toolRegistry } from "../../tool/index.js";
 import { toolToProviderDefinition } from "../../tool/registry.js";
+import { SKILL_TOOL_IDS } from "../../skill/types.js";
 import { serverLogger } from "../../utils/index.js";
 
 const logger = serverLogger.component("agent");
@@ -87,9 +88,13 @@ function addToolDefinition(
  * Get available tools based on agent configuration.
  * When tools === true, loads all tools from registry.
  * Otherwise loads specific tools from config.
+ *
+ * @param toolsConfig - Agent tools configuration
+ * @param options.includeSkillTools - When true, include skill tools for `tools: true` agents
  */
 export function getAvailableTools(
   toolsConfig: true | Record<string, ToolConfigEntry> | undefined,
+  options?: { includeSkillTools?: boolean },
 ): ToolDefinition[] {
   if (!toolsConfig) return [];
 
@@ -101,6 +106,10 @@ export function getAvailableTools(
       const def = toolToProviderDefinition(tool);
       logToolDefinition(name, def);
       return def;
+    }).filter((def) => {
+      // Exclude skill tools unless explicitly included
+      if (SKILL_TOOL_IDS.has(def.name) && !options?.includeSkillTools) return false;
+      return true;
     });
   }
 

package/src/src/agent/types.ts

@@ -60,6 +60,16 @@ export interface AgentConfig {
   };
   /** Restrict runtime model overrides to these "provider/model" strings. */
   allowedModels?: ModelString[];
+  /**
+   * Enable skills for this agent.
+   * - true: include all discovered skills from skills/ directory
+   * - string[]: include only specific skill IDs
+   *
+   * Discovery happens at startup via discoverAll().
+   * This controls which skills appear in the agent's prompt
+   * and registers the skill tools.
+   */
+  skills?: true | string[];
 }
 
 // Import for use in AgentMiddleware

package/src/src/ai/registry-manager.ts

@@ -102,7 +102,8 @@ export class ProjectScopedRegistryManager<T> {
    */
   has(id: string): boolean {
     const projectId = this.getCurrentProjectId();
-    return this.registriesByProject.get(projectId)?.has(id) ?? this.sharedRegistry.has(id);
+    return (this.registriesByProject.get(projectId)?.has(id) ?? false) ||
+      this.sharedRegistry.has(id);
   }
 
   /**

package/src/src/build/bundler/code-splitter/manifest-builder.ts

@@ -84,7 +84,7 @@ export async function getChunkInfo(
 }
 
 /** Adds a route entry to the manifest */
-export function addRouteToManifest(
+function addRouteToManifest(
   manifest: ChunkManifest,
   output: MetafileOutput,
   relativePath: string,

package/src/src/build/compiler/mdx-compiler/validator.ts

@@ -9,21 +9,17 @@ export function validateCompileParams(
   content: string,
   options: CompileOptions,
 ): void {
-  if (!filePath) throw new TypeError("filePath must be a non-empty string");
-  if (typeof filePath !== "string") throw new TypeError("filePath must be a non-empty string");
-
+  if (!filePath || typeof filePath !== "string") {
+    throw new TypeError("filePath must be a non-empty string");
+  }
   if (typeof content !== "string") throw new TypeError("content must be a string");
-
   if (!options || typeof options !== "object") throw new TypeError("options must be an object");
-
   if (!options.projectDir || typeof options.projectDir !== "string") {
     throw new TypeError("options.projectDir must be a non-empty string");
   }
-
   if (!options.outputDir || typeof options.outputDir !== "string") {
     throw new TypeError("options.outputDir must be a non-empty string");
   }
-
   if (options.mode !== "development" && options.mode !== "production") {
     throw new TypeError('options.mode must be either "development" or "production"');
   }