veryfront 0.1.511 → 0.1.513

package/src/src/agent/veryfront-cloud-agent-service.ts

@@ -40,7 +40,10 @@ import {
 } from "./agent-service-bootstrap.js";
 import { loadAgentServiceEnvFiles } from "./agent-service-env-files.js";
 import { createHostedFormInputTool } from "./hosted-form-input-tool.js";
-import { createHostedAgentProjectSteering } from "./hosted-agent-project-steering.js";
+import {
+  createHostedAgentProjectSteering,
+  type HostedAgentProjectSteering,
+} from "./hosted-agent-project-steering.js";
 import { type HostedChatRuntimeCreationResult } from "./hosted-chat-runtime-contract.js";
 import type { HostedConversationRootRunContext } from "./conversation-root-run-lifecycle.js";
 import { type AgentRuntimeMessage } from "./agent-runtime-message-adapter.js";
@@ -65,10 +68,7 @@ import type { AgentServiceMcpServerConfig } from "./agent-service-mcp-server-con
 import type { RuntimeLoadSkillToolContext } from "./runtime-load-skill-tool.js";
 import type { RuntimeProjectSteeringLookup } from "./runtime-project-skill-catalog.js";
 import type { RuntimeSkillDefinition } from "./runtime-skill-metadata.js";
-import {
-  loadRuntimeAgentMarkdownDefinitionFromFile,
-  resolveRuntimeAgentDefinitionsDir,
-} from "./runtime-agent-definition-files.js";
+import { listRuntimeAgentMarkdownDefinitionIds } from "./runtime-agent-definition-files.js";
 import type { RuntimeAgentMarkdownDefinition } from "./runtime-agent-definition.js";
 import {
   buildVeryfrontCloudRuntimeInstructions,
@@ -86,6 +86,11 @@ import {
   startNodeAgentService,
   type StartNodeAgentServiceResult,
 } from "./agent-service-runtime.js";
+import type { AgentServiceServerLifecycle } from "./agent-service-server.js";
+import {
+  createAgentServiceRegistrationLifecycle,
+  resolveAgentServiceRegistrationInput,
+} from "./agent-service-registration.js";
 import { createDetachedRunTracker } from "./detached-run-tracker.js";
 import type { AgUiResumeValue } from "./ag-ui-tool-shared.js";
 import type { ParsedHostedChatRequest } from "./hosted-chat-request-parser.js";
@@ -132,7 +137,11 @@ type AgentServicePathOption = string | URL;
 
 export type NodeVeryfrontCloudAgentServiceOptions = {
   serviceName: string;
-  agentId: string;
+  /**
+   * Default agent served by requests that do not provide an agent id. When
+   * omitted, the service selects the only discovered code or markdown agent.
+   */
+  agentId?: string;
   /**
    * Project/discovery root. Defaults to the process cwd when neither baseDir
    * nor an entrypoint URL is provided.
@@ -155,6 +164,7 @@ export type NodeVeryfrontCloudAgentServiceOptions = {
   processTarget?: NodeVeryfrontCloudAgentServiceProcessTarget;
   drainTimeoutMs?: number;
   hardShutdownTimeoutMs?: number;
+  signals?: readonly NodeJS.Signals[];
 };
 
 export type VeryfrontCloudAgentServiceOptions = NodeVeryfrontCloudAgentServiceOptions;
@@ -310,13 +320,6 @@ function createNodeVeryfrontCloudAgentServiceContext(
   ): TResult | Promise<TResult> {
     return infrastructure.tracer.trace(operationName, operation);
   }
-  const projectSteering = createHostedAgentProjectSteering({
-    baseDir: resolveBaseDir(options),
-    agentId: options.agentId,
-    getApiUrl: () => infrastructure.getConfig().VERYFRONT_API_URL,
-    logger: infrastructure.logger,
-    trace,
-  });
 
   return {
     options,
@@ -324,7 +327,8 @@ function createNodeVeryfrontCloudAgentServiceContext(
     projectDir: resolveProjectDir(options),
     infrastructure,
     trace,
-    projectSteering,
+    defaultAgentId: null as string | null,
+    projectSteeringByAgentId: new Map<string, HostedAgentProjectSteering>(),
     tracker: createDetachedRunTracker<AgUiResumeValue>(),
     discoveryResult: null as DiscoveryResult | null,
     agentConfig: null as RuntimeAgentMarkdownDefinition | null,
@@ -351,27 +355,16 @@ async function createRuntimeAgentDefinitionFromCodeAgent(
 
 function getMarkdownAgentConfig(
   context: NodeVeryfrontCloudAgentServiceContext,
+  agentId: string,
 ): RuntimeAgentMarkdownDefinition {
-  return context.projectSteering.getAgentConfig();
+  return getProjectSteering(context, agentId).getAgentConfig();
 }
 
 function loadMarkdownAgentConfig(
   context: NodeVeryfrontCloudAgentServiceContext,
   agentId: string,
 ): RuntimeAgentMarkdownDefinition {
-  if (agentId === context.options.agentId) {
-    return getMarkdownAgentConfig(context);
-  }
-
-  const agentsDir = resolveRuntimeAgentDefinitionsDir({
-    baseDir: resolveBaseDir(context.options),
-    id: agentId,
-  });
-
-  return loadRuntimeAgentMarkdownDefinitionFromFile({
-    agentsDir,
-    id: agentId,
-  });
+  return getMarkdownAgentConfig(context, agentId);
 }
 
 async function resolveAgentConfig(
@@ -427,11 +420,102 @@ async function discoverProjectPrimitives(
   context.discoveryResult = await discoverAll(discoveryOptions);
 }
 
+function getDiscoveredCodeAgentIds(context: NodeVeryfrontCloudAgentServiceContext): string[] {
+  return [...(context.discoveryResult?.agents.keys() ?? [])].sort((left, right) =>
+    left.localeCompare(right)
+  );
+}
+
+function getDiscoveredMarkdownAgentIds(context: NodeVeryfrontCloudAgentServiceContext): string[] {
+  return listRuntimeAgentMarkdownDefinitionIds({
+    baseDir: resolveBaseDir(context.options),
+  });
+}
+
+function describeAgentIdCandidates(input: {
+  codeAgentIds: string[];
+  markdownAgentIds: string[];
+}): string {
+  const ids = [...new Set([...input.codeAgentIds, ...input.markdownAgentIds])]
+    .sort((left, right) => left.localeCompare(right));
+
+  return ids.length > 0 ? ids.join(", ") : "none";
+}
+
+function resolveSingleAgentId(input: {
+  codeAgentIds: string[];
+  markdownAgentIds: string[];
+  source: NodeVeryfrontCloudAgentServiceAgentSource;
+}): string | null {
+  if (input.source === "code") {
+    return input.codeAgentIds.length === 1 ? input.codeAgentIds[0] ?? null : null;
+  }
+
+  if (input.source === "markdown") {
+    return input.markdownAgentIds.length === 1 ? input.markdownAgentIds[0] ?? null : null;
+  }
+
+  const candidateIds = [...new Set([...input.codeAgentIds, ...input.markdownAgentIds])];
+  return candidateIds.length === 1 ? candidateIds[0] ?? null : null;
+}
+
+function resolveDefaultAgentId(context: NodeVeryfrontCloudAgentServiceContext): string {
+  if (context.options.agentId) {
+    return context.options.agentId;
+  }
+
+  const source = context.options.agentSource ?? "auto";
+  const codeAgentIds = getDiscoveredCodeAgentIds(context);
+  const markdownAgentIds = getDiscoveredMarkdownAgentIds(context);
+  const agentId = resolveSingleAgentId({ codeAgentIds, markdownAgentIds, source });
+
+  if (agentId) {
+    return agentId;
+  }
+
+  throw new Error(
+    [
+      "agentId is required when agent discovery does not resolve to exactly one agent.",
+      `Discovered agents: ${describeAgentIdCandidates({ codeAgentIds, markdownAgentIds })}.`,
+    ].join(" "),
+  );
+}
+
 async function initializeNodeVeryfrontCloudAgentServiceContext(
   context: NodeVeryfrontCloudAgentServiceContext,
 ): Promise<void> {
   await discoverProjectPrimitives(context);
-  context.agentConfig = await resolveAgentConfig(context, context.options.agentId);
+  context.defaultAgentId = resolveDefaultAgentId(context);
+  context.agentConfig = await resolveAgentConfig(context, context.defaultAgentId);
+}
+
+function getDefaultAgentId(context: NodeVeryfrontCloudAgentServiceContext): string {
+  if (!context.defaultAgentId) {
+    throw new Error("Agent service context has not been initialized.");
+  }
+
+  return context.defaultAgentId;
+}
+
+function getProjectSteering(
+  context: NodeVeryfrontCloudAgentServiceContext,
+  agentId: string = getDefaultAgentId(context),
+): HostedAgentProjectSteering {
+  const cachedProjectSteering = context.projectSteeringByAgentId.get(agentId);
+  if (cachedProjectSteering) {
+    return cachedProjectSteering;
+  }
+
+  const projectSteering = createHostedAgentProjectSteering({
+    baseDir: resolveBaseDir(context.options),
+    agentId,
+    getApiUrl: () => context.infrastructure.getConfig().VERYFRONT_API_URL,
+    logger: context.infrastructure.logger,
+    trace: context.trace,
+  });
+
+  context.projectSteeringByAgentId.set(agentId, projectSteering);
+  return projectSteering;
 }
 
 function getDiscoveredHostTools(): HostToolSet {
@@ -445,7 +529,7 @@ function getProjectInstructions(
   lookup: RuntimeProjectSteeringLookup,
 ): Promise<string> {
   return context.trace("chat.getProjectInstructions", async () => {
-    return await context.projectSteering.getProjectInstructions(lookup);
+    return await getProjectSteering(context).getProjectInstructions(lookup);
   });
 }
 
@@ -454,7 +538,7 @@ function getSkillsConfig(
   lookup: RuntimeProjectSteeringLookup,
 ): Promise<RuntimeSkillDefinition[]> {
   return context.trace("chat.getSkillsConfig", async () => {
-    return await context.projectSteering.getSkillsConfig(lookup);
+    return await getProjectSteering(context).getSkillsConfig(lookup);
   });
 }
 
@@ -462,14 +546,14 @@ function createLoadSkillTool(
   context: NodeVeryfrontCloudAgentServiceContext,
   toolContext: RuntimeLoadSkillToolContext,
 ) {
-  return context.projectSteering.createLoadSkillTool(toolContext);
+  return getProjectSteering(context).createLoadSkillTool(toolContext);
 }
 
 async function refreshProjectSkillIds(
   context: NodeVeryfrontCloudAgentServiceContext,
   skillContext: HostedProjectSkillIdsContext,
 ): Promise<void> {
-  await context.projectSteering.refreshProjectSkillIds(skillContext);
+  await getProjectSteering(context).refreshProjectSkillIds(skillContext);
 }
 
 function setFilteredTraceAttributes(
@@ -683,7 +767,7 @@ async function prepareChatExecution(
 
   setPrepareChatExecutionStartAttributes(context, { projectId, userId });
 
-  const agentConfig = await resolveAgentConfig(context, req.agentId ?? context.options.agentId);
+  const agentConfig = await resolveAgentConfig(context, req.agentId ?? getDefaultAgentId(context));
   const {
     effectiveMessages,
     rootRunContext,
@@ -760,6 +844,58 @@ function createPreparedExecutionRuntimeOptions(
   });
 }
 
+function resolveAgentServiceRuntimeName(): string {
+  if (Reflect.get(dntShim.dntGlobalThis, "Bun")) {
+    return "bun";
+  }
+  if (Reflect.get(dntShim.dntGlobalThis, "Deno")) {
+    return "deno";
+  }
+  return "node";
+}
+
+function getAgentServiceVersion(
+  context: NodeVeryfrontCloudAgentServiceContext,
+): string | undefined {
+  return context.options.env?.npm_package_version;
+}
+
+async function createControlPlaneRegistrationLifecycle(
+  context: NodeVeryfrontCloudAgentServiceContext,
+): Promise<AgentServiceServerLifecycle | undefined> {
+  const config = context.infrastructure.getConfig();
+  const registrationInput = await resolveAgentServiceRegistrationInput({
+    config,
+    serviceName: context.options.serviceName,
+    agentId: getDefaultAgentId(context),
+    version: getAgentServiceVersion(context),
+    runtime: resolveAgentServiceRuntimeName(),
+  });
+
+  if (!registrationInput) {
+    return undefined;
+  }
+
+  try {
+    const lifecycle = await createAgentServiceRegistrationLifecycle({
+      ...registrationInput,
+      logger: context.infrastructure.logger,
+    });
+    return {
+      stop: () => lifecycle.stop(),
+    };
+  } catch (error) {
+    if (config.VERYFRONT_AGENT_SERVICE_REGISTRATION === "enabled") {
+      throw error;
+    }
+
+    context.infrastructure.logger.warn("Agent service registration skipped", {
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return undefined;
+  }
+}
+
 function createNodeVeryfrontCloudAgentServiceRuntimeOptions(
   context: NodeVeryfrontCloudAgentServiceContext,
 ): CreateAgentServiceRuntimeOptions<NodeVeryfrontCloudAgentServicePreparedExecution> {
@@ -818,10 +954,18 @@ export async function startNodeVeryfrontCloudAgentService(
   const resolvedOptions = await resolveNodeVeryfrontCloudAgentServiceOptions(options);
   const context = createNodeVeryfrontCloudAgentServiceContext(resolvedOptions);
   await initializeNodeVeryfrontCloudAgentServiceContext(context);
-  return await startNodeAgentService({
-    ...createNodeVeryfrontCloudAgentServiceRuntimeOptions(context),
-    hardShutdownTimeoutMs: options.hardShutdownTimeoutMs ?? DEFAULT_HARD_SHUTDOWN_TIMEOUT_MS,
-  });
+  const registrationLifecycle = await createControlPlaneRegistrationLifecycle(context);
+  try {
+    return await startNodeAgentService({
+      ...createNodeVeryfrontCloudAgentServiceRuntimeOptions(context),
+      lifecycle: registrationLifecycle,
+      signals: options.signals,
+      hardShutdownTimeoutMs: options.hardShutdownTimeoutMs ?? DEFAULT_HARD_SHUTDOWN_TIMEOUT_MS,
+    });
+  } catch (error) {
+    await registrationLifecycle?.stop?.();
+    throw error;
+  }
 }
 
 export async function startAgentService(
@@ -856,10 +1000,18 @@ export async function startAgentService(
       __registerTraceContextGetter(getter);
     },
     start: async () => {
-      await startAgentServiceRuntime({
-        ...createNodeVeryfrontCloudAgentServiceRuntimeOptions(context),
-        hardShutdownTimeoutMs: options.hardShutdownTimeoutMs ?? DEFAULT_HARD_SHUTDOWN_TIMEOUT_MS,
-      });
+      const registrationLifecycle = await createControlPlaneRegistrationLifecycle(context);
+      try {
+        await startAgentServiceRuntime({
+          ...createNodeVeryfrontCloudAgentServiceRuntimeOptions(context),
+          lifecycle: registrationLifecycle,
+          signals: options.signals,
+          hardShutdownTimeoutMs: options.hardShutdownTimeoutMs ?? DEFAULT_HARD_SHUTDOWN_TIMEOUT_MS,
+        });
+      } catch (error) {
+        await registrationLifecycle?.stop?.();
+        throw error;
+      }
     },
     onStartupError: (error) => {
       console.error("Error in server startup:", error);

package/src/src/oauth/providers/base.ts

@@ -341,6 +341,38 @@ export class OAuthService extends OAuthProvider {
     return result.tokens.accessToken;
   }
 
+  /**
+   * Resolve `endpoint` against `apiBaseUrl`, validating that absolute URLs
+   * share the configured origin.
+   *
+   * Without this check, a caller that forwards user-controlled data as
+   * `endpoint` could cause `fetch()` to issue requests to arbitrary hosts
+   * (including cloud metadata services and internal infrastructure). See
+   * SEC-003 in the security audit.
+   */
+  private resolveEndpointUrl(endpoint: string): string {
+    if (!endpoint.startsWith("http")) {
+      return `${this.apiBaseUrl}${endpoint}`;
+    }
+    let target: URL;
+    let allowed: URL;
+    try {
+      target = new URL(endpoint);
+      allowed = new URL(this.apiBaseUrl);
+    } catch {
+      throw INVALID_ARGUMENT.create({
+        detail: `Invalid OAuth endpoint URL`,
+      });
+    }
+    if (target.origin !== allowed.origin) {
+      throw INVALID_ARGUMENT.create({
+        detail:
+          `OAuth endpoint origin ${target.origin} does not match configured ${allowed.origin}`,
+      });
+    }
+    return endpoint;
+  }
+
   async fetch<T>(userId: string, endpoint: string, options: RequestInit = {}): Promise<T> {
     const token = await this.getAccessToken(userId);
     if (!token) {
@@ -349,7 +381,7 @@ export class OAuthService extends OAuthProvider {
       });
     }
 
-    const url = endpoint.startsWith("http") ? endpoint : `${this.apiBaseUrl}${endpoint}`;
+    const url = this.resolveEndpointUrl(endpoint);
 
     const response = await fetch(url, {
       ...options,

package/src/src/utils/version-constant.ts

@@ -1,3 +1,3 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
-export const VERSION = "0.1.511";
+export const VERSION = "0.1.513";