veryfront 0.1.49 → 0.1.51

package/src/src/server/services/rsc/orchestrators/render-handler.ts

@@ -35,7 +35,7 @@ export class RenderHandler {
     }
   }
 
-  private async loadComponent(pathname: string): Promise<React.ComponentType<any>> {
+  private async loadComponent(pathname: string): Promise<React.ComponentType<RenderProps>> {
     const componentPath = await resolveComponentPath(pathname, this.projectDir);
     if (!componentPath) {
       throw toError(
@@ -58,7 +58,7 @@ export class RenderHandler {
       );
     }
 
-    return Component as React.ComponentType<any>;
+    return Component as React.ComponentType<RenderProps>;
   }
 
   private buildProps(pathname: string, searchParams: URLSearchParams): RenderProps {
@@ -69,7 +69,7 @@ export class RenderHandler {
   }
 
   private async renderPayload(
-    component: React.ComponentType<any>,
+    component: React.ComponentType<RenderProps>,
     props: RenderProps,
   ): Promise<RSCPayload> {
     const renderer = this.getRenderer();

package/src/src/server/services/rsc/orchestrators/stream-handler.ts

@@ -82,7 +82,7 @@ export class StreamHandler {
 }
 
 function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => dntShim.setTimeout(resolve, ms));
+  return new Promise((resolve) => dntShim.setTimeout(resolve, ms)); // no cleanup needed: one-shot
 }
 
 function enqueueSlot(

package/src/src/server/services/static/static-file.service.ts

@@ -78,7 +78,7 @@ interface FileSystemLike {
 /**
  * Injection interface for testing StaticFileService dependencies
  */
-export interface StaticFileServiceDeps {
+interface StaticFileServiceDeps {
   manifestCache?: Map<string, ManifestIndex>;
   manifestLoading?: Map<string, Promise<ManifestIndex | null>>;
 }
@@ -185,7 +185,8 @@ export class StaticFileService {
         cacheStrategy: this.determineCacheStrategy(candidate, requestPath, options),
         source: candidate.source,
       };
-    } catch {
+    } catch (_) {
+      /* expected: file may not exist */
       return null;
     }
   }
@@ -231,7 +232,8 @@ export class StaticFileService {
     let stat: { isFile: boolean; mtime: Date | null };
     try {
       stat = await fs.stat(manifestPath);
-    } catch {
+    } catch (_) {
+      /* expected: manifest file may not exist */
       return null;
     }
 
@@ -253,7 +255,8 @@ export class StaticFileService {
         const indexValue: ManifestIndex = { assets, mtime: currentMtime };
         manifestCache.set(cacheKey, indexValue);
         return indexValue;
-      } catch {
+      } catch (_) {
+        /* expected: manifest may be malformed or unreadable */
         manifestCache.delete(cacheKey);
         return null;
       } finally {

package/src/src/server/shared/renderer/adapter.ts

@@ -36,6 +36,12 @@ import { computeContentSourceId } from "../../../cache/keys.js";
 
 const logger = rendererLogger.component("renderer-adapter");
 
+/** TTL for the API-backed distributed render cache (1 hour) */
+const RENDER_CACHE_TTL_SECONDS = 3_600;
+
+/** Maximum entries for the local render cache layer */
+const RENDER_CACHE_LOCAL_MAX_ENTRIES = 200;
+
 export interface RendererAdapter {
   renderPage(slug: string, options?: RenderOptions): Promise<RenderResult>;
   resolvePageData(slug: string, options?: RenderOptions): Promise<PageDataResponse>;
@@ -74,16 +80,15 @@ async function getOrInitRenderer(): Promise<Renderer> {
 
   // Only use API-backed cache when both PROXY_MODE=1 and API URL is configured
   if (isProxyMode && apiBaseUrl) {
-    const renderCacheTtlSeconds = 3600;
     logger.debug("Using API-backed distributed render cache");
     options.cache = {
       store: new APICacheStore({
         keyPrefix: "render",
-        ttlSeconds: renderCacheTtlSeconds,
-        localMaxEntries: 200,
+        ttlSeconds: RENDER_CACHE_TTL_SECONDS,
+        localMaxEntries: RENDER_CACHE_LOCAL_MAX_ENTRIES,
         enableLocalCache: false,
       }),
-      ttlMs: renderCacheTtlSeconds * 1000,
+      ttlMs: RENDER_CACHE_TTL_SECONDS * 1000,
     };
   }
 

package/src/src/server/utils/domain-lookup.ts

@@ -25,7 +25,7 @@ export interface DomainLookupResult {
   release_id: string | null;
 }
 
-export interface DomainLookupConfig {
+interface DomainLookupConfig {
   apiBaseUrl: string;
   apiToken: string;
 }

package/src/src/server/utils/error-html.ts

@@ -1,4 +1,4 @@
-export interface ErrorHtmlOptions {
+interface ErrorHtmlOptions {
   statusCode: number;
   title: string;
   message: string;

package/src/src/skill/allowed-tools.ts

@@ -35,7 +35,7 @@ export function matchesAllowedTool(toolName: string, pattern: string): boolean {
 }
 
 /** Minimal tool definition shape for filtering */
-export interface FilterableToolDefinition {
+interface FilterableToolDefinition {
   name: string;
   description: string;
   parameters: unknown;

package/src/src/skill/executor.ts

@@ -10,6 +10,7 @@ import * as dntShim from "../../_dnt.shims.js";
 
 import { getEnv, runCommand } from "../platform/compat/process.js";
 import { isDeno } from "../platform/compat/runtime.js";
+import { getVeryfrontCloudAuthToken } from "../platform/cloud/resolver.js";
 import { extname } from "../platform/compat/path/index.js";
 import { readTextFile } from "../platform/compat/fs.js";
 import { createError, toError } from "../errors/veryfront-error.js";
@@ -81,6 +82,14 @@ function createSandboxScriptPath(scriptPath: string): string {
   return `/tmp/veryfront-skill-script-${Date.now()}-${suffix}${ext}`;
 }
 
+function getSandboxAuthOverride(): string | undefined {
+  return getEnv("SANDBOX_AUTH_TOKEN")?.trim() || undefined;
+}
+
+function hasCloudScriptExecutionAuth(): boolean {
+  return Boolean(getSandboxAuthOverride() || getVeryfrontCloudAuthToken());
+}
+
 /**
  * Detect the runtime command for a script based on file extension.
  */
@@ -137,28 +146,17 @@ export class LocalScriptExecutor implements SkillScriptExecutor {
 
 /**
  * Cloud script executor using sandbox.
- * Requires SANDBOX_AUTH_TOKEN environment variable.
+ * Uses SANDBOX_AUTH_TOKEN as an explicit override, otherwise falls back to the
+ * standard Veryfront Cloud bootstrap.
  */
-export class CloudScriptExecutor implements SkillScriptExecutor {
+class CloudScriptExecutor implements SkillScriptExecutor {
   async execute(input: SkillScriptExecutorInput): Promise<SkillScriptResult> {
     const timeoutMs = resolveTimeoutMs(input.timeoutMs);
-    // NOTE: In SSR contexts, getEnv() reads through the project-env overlay
-    // (AsyncLocalStorage-backed). If the token is set at host level only,
-    // the overlay may not surface it. Ensure SANDBOX_AUTH_TOKEN is available
-    // in the request-scoped environment when running under SSR.
-    const authToken = getEnv("SANDBOX_AUTH_TOKEN");
-    if (!authToken) {
-      throw toError(
-        createError({
-          type: "agent",
-          message: "Cloud script execution requires SANDBOX_AUTH_TOKEN environment variable",
-        }),
-      );
-    }
 
     // Lazy import to avoid bundling sandbox in non-cloud environments
     const { Sandbox } = await import("../sandbox/index.js");
-    const sandbox = await Sandbox.create({ authToken });
+    const authToken = getSandboxAuthOverride();
+    const sandbox = await Sandbox.create(authToken ? { authToken } : undefined);
     try {
       const sandboxScriptPath = createSandboxScriptPath(input.scriptPath);
       const scriptContent = input.scriptContent ?? await readTextFile(input.scriptPath);
@@ -184,8 +182,8 @@ export class CloudScriptExecutor implements SkillScriptExecutor {
         // races the timer, it doesn't terminate the sandbox command.
         try {
           await sandbox.executeCommand("kill -9 -1 2>/dev/null || true");
-        } catch {
-          // Best-effort kill; sandbox.close() in finally will clean up.
+        } catch (_) {
+          // expected: best-effort kill; sandbox.close() in finally will clean up
         }
         return timeoutResult(timeoutMs);
       }
@@ -198,8 +196,8 @@ export class CloudScriptExecutor implements SkillScriptExecutor {
     } finally {
       try {
         await sandbox.close();
-      } catch {
-        // Best-effort cleanup.
+      } catch (_) {
+        // expected: best-effort cleanup
       }
     }
   }
@@ -207,9 +205,9 @@ export class CloudScriptExecutor implements SkillScriptExecutor {
 
 /**
  * Get the appropriate script executor.
- * Checks SANDBOX_AUTH_TOKEN on every call so request-scoped env overlays
- * (e.g. project-env AsyncLocalStorage) are respected.
+ * Checks cloud auth availability on every call so request-scoped credentials
+ * and environment overrides are respected.
  */
 export function getSkillScriptExecutor(): SkillScriptExecutor {
-  return getEnv("SANDBOX_AUTH_TOKEN") ? new CloudScriptExecutor() : new LocalScriptExecutor();
+  return hasCloudScriptExecutionAuth() ? new CloudScriptExecutor() : new LocalScriptExecutor();
 }

package/src/src/skill/parser.ts

@@ -17,7 +17,7 @@ import {
 } from "./types.js";
 
 /** Result of parsing a SKILL.md file */
-export interface ParsedSkillContent {
+interface ParsedSkillContent {
   frontmatter: Record<string, unknown>;
   body: string;
 }
@@ -34,8 +34,8 @@ export async function parseSkillFrontmatter(content: string): Promise<ParsedSkil
     const { extract } = await import("../platform/compat/std/front-matter-yaml.js");
     const result = extract<Record<string, unknown>>(content);
     return { frontmatter: result.attrs, body: result.body };
-  } catch {
-    // Fall through to fallback
+  } catch (_) {
+    // expected: front-matter parser unavailable, fall through to regex fallback
   }
 
   // Fallback: regex-based parser
@@ -52,8 +52,8 @@ function parseFrontmatterFallback(content: string): ParsedSkillContent {
     return { frontmatter: {}, body: content };
   }
 
-  const rawFrontmatter = match[1]!;
-  const body = match[2]!;
+  const rawFrontmatter = match[1] ?? "";
+  const body = match[2] ?? "";
   const frontmatter: Record<string, unknown> = {};
 
   for (const line of rawFrontmatter.split("\n")) {

package/src/src/skill/path-safety.ts

@@ -53,7 +53,8 @@ async function isLocalSymlink(path: string): Promise<boolean> {
     const fs = await import("node:fs/promises");
     const info = await fs.lstat(path);
     return info.isSymbolicLink();
-  } catch {
+  } catch (_) {
+    // expected: path may not exist or not be accessible
     return false;
   }
 }
@@ -128,7 +129,15 @@ export async function validateSkillPath(
     );
   }
 
-  const canonicalPath = result.canonicalPath!;
+  if (!result.canonicalPath) {
+    throw toError(
+      createError({
+        type: "agent",
+        message: `Path validation succeeded but canonical path is undefined for: ${requestedPath}`,
+      }),
+    );
+  }
+  const canonicalPath = result.canonicalPath;
 
   // Verify the path exists and points to a file.
   if (!(await pathExists(canonicalPath, fsAdapter))) {

package/src/src/skill/tools.ts

@@ -27,6 +27,9 @@ import {
   SKILL_SCRIPTS_DIR,
 } from "./types.js";
 
+/** Maximum allowed script execution timeout in milliseconds (5 minutes) */
+const MAX_SCRIPT_TIMEOUT_MS = 300_000;
+
 /**
  * Read a file from a skill directory.
  * Uses skill.fsAdapter if available (VFS/cloud), otherwise falls back to compat readTextFile.
@@ -159,9 +162,9 @@ export function createExecuteSkillScriptTool(): Tool {
         .number()
         .int()
         .positive()
-        .max(300_000)
+        .max(MAX_SCRIPT_TIMEOUT_MS)
         .optional()
-        .describe("Optional execution timeout in milliseconds (max 300000)"),
+        .describe(`Optional execution timeout in milliseconds (max ${MAX_SCRIPT_TIMEOUT_MS})`),
     }),
     execute: async (input) => {
       const skill = skillRegistry.get(input.skillId);