veryfront 0.1.55 → 0.1.57

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.55",
+    "version": "0.1.57",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "exclude": [

package/esm/src/agent/chat-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat-handler.d.ts","sourceRoot":"","sources":["../../../src/src/agent/chat-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAG/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA8K1C,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACpC,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,KAAK,EAAE,8BAA8B,KAEnC,IAAI,GACJ,OAAO,CAAC,QAAQ,GAChB,6BAA6B,GAC7B,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,6BAA6B,CAAC,CAAC;AAiCrE,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IACjC,uFAAuF;IACvF,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,CAAC,CACD,OAAO,EAAE,OAAO,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACnE;;;OAGG;IACH,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACxC;AAsCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,IAED,cAAc,OAAO,KAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CA+E7E"}
+{"version":3,"file":"chat-handler.d.ts","sourceRoot":"","sources":["../../../src/src/agent/chat-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAG/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA8K1C,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACpC,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,KAAK,EAAE,8BAA8B,KAEnC,IAAI,GACJ,OAAO,CAAC,QAAQ,GAChB,6BAA6B,GAC7B,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,6BAA6B,CAAC,CAAC;AAiCrE,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IACjC,uFAAuF;IACvF,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,CAAC,CACD,OAAO,EAAE,OAAO,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACnE;;;OAGG;IACH,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACxC;AAgDD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,IAED,cAAc,OAAO,KAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CA+E7E"}

package/esm/src/agent/chat-handler.js

@@ -172,6 +172,14 @@ function isRequest(obj) {
         "method" in obj &&
         typeof obj.method === "string");
 }
+function extractUserId(request) {
+    const userId = request.headers.get("x-user-id");
+    if (userId)
+        return userId;
+    agentLogger.warn("No user identity found in request. Using anonymous fallback. " +
+        "Set x-user-id header or provide a context function for proper user isolation.");
+    return "anonymous";
+}
 function extractRequest(requestOrCtx) {
     if (isRequest(requestOrCtx))
         return requestOrCtx;
@@ -219,7 +227,7 @@ export function createChatHandler(agentId, options) {
             const { messages: rawMessages, model: requestModel } = chatRequestSchema.parse(body);
             const context = typeof options?.context === "function"
                 ? await options.context(request)
-                : options?.context ?? { userId: "current-user" };
+                : options?.context ?? { userId: extractUserId(request) };
             const baseMessages = transformUIMessages(rawMessages);
             const beforeStreamResult = await options?.beforeStream?.({
                 request,

package/esm/src/agent/memory/redis.d.ts

@@ -25,12 +25,15 @@ export interface RedisMemoryConfig extends MemoryConfigBase {
     client: RedisClient;
     /** Key prefix for namespacing */
     keyPrefix?: string;
+    /** User ID for per-user memory isolation */
+    userId?: string;
     /** TTL in seconds (default: 24 hours) */
     ttl?: number;
 }
 export declare class RedisMemory<M extends MinimalMessage = MinimalMessage> implements Memory<M> {
     private client;
     private agentId;
+    private userId;
     private keyPrefix;
     private ttl;
     private config;

package/esm/src/agent/memory/redis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/memory/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAEL,KAAK,MAAM,EACX,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAG/B;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,4BAA4B;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAKD,qBAAa,WAAW,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,CAAE,YAAW,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,MAAM,CAAoB;gBAEtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB;IAQtD,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,aAAa;IAUrB,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B9B,WAAW,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAQ3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAUtB,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC;IAehC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAYtB,OAAO,CAAC,gBAAgB;CAazB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,EACzE,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,iBAAiB,GACxB,WAAW,CAAC,CAAC,CAAC,CAEhB"}
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/memory/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAEL,KAAK,MAAM,EACX,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAG/B;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,4BAA4B;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAKD,qBAAa,WAAW,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,CAAE,YAAW,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,MAAM,CAAoB;gBAEtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB;IAStD,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,aAAa;IAUrB,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B9B,WAAW,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAQ3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAUtB,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC;IAehC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAYtB,OAAO,CAAC,gBAAgB;CAazB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,EACzE,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,iBAAiB,GACxB,WAAW,CAAC,CAAC,CAAC,CAEhB"}

package/esm/src/agent/memory/redis.js

@@ -11,18 +11,20 @@ const DEFAULT_KEY_PREFIX = "veryfront:agent:memory:";
 export class RedisMemory {
     client;
     agentId;
+    userId;
     keyPrefix;
     ttl;
     config;
     constructor(agentId, config) {
         this.client = config.client;
         this.agentId = agentId;
+        this.userId = config.userId ?? "anonymous";
         this.keyPrefix = config.keyPrefix ?? DEFAULT_KEY_PREFIX;
         this.ttl = config.ttl ?? DEFAULT_TTL;
         this.config = config;
     }
     getKey() {
-        return `${this.keyPrefix}${this.agentId}`;
+        return `${this.keyPrefix}${this.agentId}:${this.userId}`;
     }
     parseMessages(data) {
         if (!data)

package/esm/src/agent/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,aAAa,EAGlB,KAAK,OAAO,EAEZ,KAAK,QAAQ,EACd,MAAM,aAAa,CAAC;AAKrB,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAe/D,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACpF,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAqBxB;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CA6BxE;AAED,gEAAgE;AAChE,KAAK,iBAAiB,GAClB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,iBAAiB,EAAE,MAAM,EAAE,GAAG,SAAS,EACvC,kBAAkB,EAAE,OAAO,GAC1B,iBAAiB,CAiBnB;AAkCD,qBAAa,YAAY;IACvB,OAAO,CAAC,EAAE,CAAS;IACnB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,MAAM,CAAuB;gBAEzB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;IAS3C;;OAEG;IACG,QAAQ,CACZ,KAAK,EAAE,MAAM,GAAG,OAAO,EAAE,EACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,aAAa,CAAC;IAgCzB;;;OAGG;IACG,MAAM,CACV,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC1C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,EACD,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IA+EtC;;OAEG;YACW,gBAAgB;IAyN9B;;;;OAIG;YACW,yBAAyB;IAyNvC;;OAEG;YACW,eAAe;IAqC7B;;OAEG;YACW,mBAAmB;IAOjC;;OAEG;IACH,OAAO,CAAC,eAAe;IAKvB;;OAEG;IACH,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC;IAI5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IAIF;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;CAGnC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,aAAa,EAGlB,KAAK,OAAO,EAEZ,KAAK,QAAQ,EACd,MAAM,aAAa,CAAC;AAKrB,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAe/D,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACpF,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAqBxB;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CA6BxE;AAED,gEAAgE;AAChE,KAAK,iBAAiB,GAClB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,iBAAiB,EAAE,MAAM,EAAE,GAAG,SAAS,EACvC,kBAAkB,EAAE,OAAO,GAC1B,iBAAiB,CAiBnB;AAkCD,qBAAa,YAAY;IACvB,OAAO,CAAC,EAAE,CAAS;IACnB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,MAAM,CAAuB;gBAEzB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;IAS3C;;OAEG;IACG,QAAQ,CACZ,KAAK,EAAE,MAAM,GAAG,OAAO,EAAE,EACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,aAAa,CAAC;IAgCzB;;;OAGG;IACG,MAAM,CACV,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC1C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,EACD,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAgFtC;;OAEG;YACW,gBAAgB;IAyN9B;;;;OAIG;YACW,yBAAyB;IAyNvC;;OAEG;YACW,eAAe;IAqC7B;;OAEG;YACW,mBAAmB;IAOjC;;OAEG;IACH,OAAO,CAAC,eAAe;IAKvB;;OAEG;IACH,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC;IAI5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IAIF;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;CAGnC"}

package/esm/src/agent/runtime/index.js

@@ -211,9 +211,10 @@ export class AgentRuntime {
                 }
                 catch (error) {
                     this.status = "error";
+                    logger.error("Agent stream error", { error });
                     sendSSE(controller, encoder, {
                         type: "error",
-                        error: error instanceof Error ? error.message : String(error),
+                        error: "An internal error occurred",
                     });
                     controller.close();
                 }

package/esm/src/cache/backends/disk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"disk.d.ts","sourceRoot":"","sources":["../../../../src/src/cache/backends/disk.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0BhD,qBAAa,gBAAiB,YAAW,YAAY;IACnD,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAU;IAChC,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,UAAU,CAA6B;gBAEnC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;IAKhD,OAAO,CAAC,QAAQ;YAIF,SAAS;IAKjB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBnE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB/B,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAwCrD"}
+{"version":3,"file":"disk.d.ts","sourceRoot":"","sources":["../../../../src/src/cache/backends/disk.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0BhD,qBAAa,gBAAiB,YAAW,YAAY;IACnD,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAU;IAChC,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,UAAU,CAA6B;gBAEnC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;IAKhD,OAAO,CAAC,QAAQ;YAIF,SAAS;IAKjB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBnE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB/B,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAwCrD"}

package/esm/src/cache/backends/disk.js

@@ -1,3 +1,4 @@
+import * as dntShim from "../../../_dnt.shims.js";
 import { join } from "../../platform/compat/path/index.js";
 import { getCacheBaseDir } from "../../utils/cache-dir.js";
 import { logger } from "../../utils/index.js";
@@ -65,7 +66,7 @@ export class DiskCacheBackend {
             expiresAt: ttlSeconds != null ? Date.now() + ttlSeconds * 1000 : undefined,
         };
         const filePath = this.filePath(key);
-        const tmpPath = `${filePath}.tmp.${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
+        const tmpPath = `${filePath}.tmp.${Date.now()}.${dntShim.crypto.randomUUID().slice(0, 8)}`;
         const content = JSON.stringify(envelope);
         const { writeFile, rename, unlink } = await fsPromises;
         try {

package/esm/src/middleware/builtin/security/rate-limit.d.ts

@@ -16,4 +16,6 @@ export interface RateLimitOptions {
     keyGenerator?: (req: dntShim.Request) => string;
 }
 export declare function rateLimit(optionsOrMaxRequests?: number | RateLimitOptions, windowMsArg?: number): Middleware;
+/** Pre-configured rate limiter for authentication endpoints (5 req/15min). */
+export declare function authRateLimit(store?: RateLimitStore): Middleware;
 //# sourceMappingURL=rate-limit.d.ts.map

package/esm/src/middleware/builtin/security/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/src/middleware/builtin/security/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAYjE,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,eAAe,CAAC,CAAyC;gBAErD,QAAQ,EAAE,MAAM;IAgB5B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAcjE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjC,OAAO,IAAI,IAAI;CAIhB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC;CACjD;AAED,wBAAgB,SAAS,CACvB,oBAAoB,CAAC,EAAE,MAAM,GAAG,gBAAgB,EAChD,WAAW,CAAC,EAAE,MAAM,GACnB,UAAU,CA2BZ"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/src/middleware/builtin/security/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAYjE,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,eAAe,CAAC,CAAyC;gBAErD,QAAQ,EAAE,MAAM;IAgB5B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAcjE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjC,OAAO,IAAI,IAAI;CAIhB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC;CACjD;AAED,wBAAgB,SAAS,CACvB,oBAAoB,CAAC,EAAE,MAAM,GAAG,gBAAgB,EAChD,WAAW,CAAC,EAAE,MAAM,GACnB,UAAU,CAkCZ;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAMhE"}

package/esm/src/middleware/builtin/security/rate-limit.js

@@ -49,8 +49,16 @@ export function rateLimit(optionsOrMaxRequests, windowMsArg) {
     const maxRequests = options.maxRequests ?? DEFAULT_RATE_LIMIT_REQUESTS;
     const windowMs = options.windowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS;
     const store = options.store ?? new MemoryRateLimitStore(windowMs);
-    const keyGenerator = options.keyGenerator ??
-        ((req) => req.headers.get("x-forwarded-for") || "anonymous");
+    const keyGenerator = options.keyGenerator ?? ((req) => {
+        const forwarded = req.headers.get("x-forwarded-for");
+        if (forwarded) {
+            const parts = forwarded.split(",").map((s) => s.trim()).filter(Boolean);
+            // Use rightmost IP — added by nearest trusted proxy, not spoofable by clients
+            if (parts.length > 0)
+                return parts[parts.length - 1];
+        }
+        return "anonymous";
+    });
     return async (ctx, next) => {
         const req = getRequest(ctx);
         const key = keyGenerator(req);
@@ -64,3 +72,11 @@ export function rateLimit(optionsOrMaxRequests, windowMsArg) {
         });
     };
 }
+/** Pre-configured rate limiter for authentication endpoints (5 req/15min). */
+export function authRateLimit(store) {
+    return rateLimit({
+        maxRequests: 5,
+        windowMs: 15 * MS_PER_MINUTE,
+        store,
+    });
+}

package/esm/src/modules/react-loader/unified-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unified-loader.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/react-loader/unified-loader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAMtE,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQtF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,eAAe,EAAE,EAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAsCvB"}
+{"version":3,"file":"unified-loader.d.ts","sourceRoot":"","sources":["../../../../src/src/modules/react-loader/unified-loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAMtE,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQtF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,eAAe,EAAE,EAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAsCvB"}

package/esm/src/modules/react-loader/unified-loader.js

@@ -1,3 +1,4 @@
+import * as dntShim from "../../../_dnt.shims.js";
 import { join } from "../../platform/compat/path/index.js";
 import { transformToESM } from "../../transforms/esm/index.js";
 import { rendererLogger as logger } from "../../utils/index.js";
@@ -37,7 +38,7 @@ async function transformAllComponents(components, projectDir, adapter, transform
 }
 async function createTempDir(projectId, adapter) {
     const baseTmp = await getProjectTmpDir(projectId);
-    const uniqueTmp = `unified-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+    const uniqueTmp = `unified-${Date.now()}-${dntShim.crypto.randomUUID().slice(0, 12)}`;
     const tmpDir = join(baseTmp, uniqueTmp);
     await adapter.fs.mkdir(tmpDir, { recursive: true });
     return tmpDir;

package/esm/src/oauth/token-store/memory.d.ts

@@ -2,6 +2,9 @@ import type { OAuthState, OAuthTokens, TokenStore } from "../types.js";
 export declare class MemoryTokenStore implements TokenStore {
     private tokens;
     private states;
+    private projectId;
+    constructor(projectId?: string);
+    private scopedKey;
     getTokens(serviceId: string): Promise<OAuthTokens | null>;
     setTokens(serviceId: string, tokens: OAuthTokens): Promise<void>;
     clearTokens(serviceId: string): Promise<void>;

package/esm/src/oauth/token-store/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/token-store/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKvE,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,MAAM,CAAiC;IAEzC,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAIzD,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAYnD,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,OAAO,CAAC,oBAAoB;IAS5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAQvC,QAAQ,IAAI,IAAI;CAIjB;AAED,eAAO,MAAM,gBAAgB,kBAAyB,CAAC"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/token-store/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKvE,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,MAAM,CAAiC;IAC/C,OAAO,CAAC,SAAS,CAAS;gBAEd,SAAS,SAAY;IAIjC,OAAO,CAAC,SAAS;IAIX,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAIzD,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAYnD,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,OAAO,CAAC,oBAAoB;IAS5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAQvC,QAAQ,IAAI,IAAI;CAIjB;AAED,eAAO,MAAM,gBAAgB,kBAAyB,CAAC"}

package/esm/src/oauth/token-store/memory.js

@@ -3,14 +3,21 @@ const STATE_EXPIRATION_MS = 10 * 60 * 1_000;
 export class MemoryTokenStore {
     tokens = new Map();
     states = new Map();
+    projectId;
+    constructor(projectId = "default") {
+        this.projectId = projectId;
+    }
+    scopedKey(serviceId) {
+        return `${this.projectId}:${serviceId}`;
+    }
     async getTokens(serviceId) {
-        return this.tokens.get(serviceId) ?? null;
+        return this.tokens.get(this.scopedKey(serviceId)) ?? null;
     }
     async setTokens(serviceId, tokens) {
-        this.tokens.set(serviceId, tokens);
+        this.tokens.set(this.scopedKey(serviceId), tokens);
     }
     async clearTokens(serviceId) {
-        this.tokens.delete(serviceId);
+        this.tokens.delete(this.scopedKey(serviceId));
     }
     async getState(state) {
         const oauthState = this.states.get(state);
@@ -41,7 +48,7 @@ export class MemoryTokenStore {
         return [...this.tokens.keys()];
     }
     isConnected(serviceId) {
-        const tokens = this.tokens.get(serviceId);
+        const tokens = this.tokens.get(this.scopedKey(serviceId));
         if (!tokens)
             return false;
         const isExpired = tokens.expiresAt != null && Date.now() > tokens.expiresAt;

package/esm/src/platform/adapters/fs/veryfront/websocket-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket-manager.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/fs/veryfront/websocket-manager.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAwB/F,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,qBAAqB,EAAE,qBAAqB,CAAC;IAE7C,iBAAiB,EAAE,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACvD,gBAAgB,EAAE,MAAM,aAAa,CAAC;IACtC,aAAa,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACxC,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,IAAI,CAAC;IAC/B,gBAAgB,EAAE,CAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,KAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED,qBAAa,gBAAgB;IAqBf,OAAO,CAAC,QAAQ,CAAC,IAAI;IApBjC,OAAO,CAAC,EAAE,CAA0B;IACpC,OAAO,CAAC,gBAAgB,CAAsD;IAC9E,OAAO,CAAC,gBAAgB,CAAuD;IAC/E,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,iBAAiB,CAAsD;IAC/E,OAAO,CAAC,0BAA0B,CAAsD;IACxF,OAAO,CAAC,mBAAmB,CAAqB;IAEhD,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,qBAAqB,CAAK;IAClC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,0BAA0B,CAAK;IACvC,OAAO,CAAC,iCAAiC,CAAqB;IAC9D,OAAO,CAAC,WAAW,CAIjB;gBAE2B,IAAI,EAAE,aAAa;IAEhD,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,8BAA8B;IAOtC,OAAO,CAAC,wBAAwB;IAahC,OAAO,CAAC,2BAA2B;IAUnC,cAAc,IAAI;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B;IAID,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IA2HhC,OAAO,CAAC,iBAAiB;IAMzB,OAAO,IAAI,IAAI;IA8Bf,OAAO,CAAC,iBAAiB;IAyJzB,OAAO,CAAC,8BAA8B;IA0GtC,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,6BAA6B;YAiBvB,4BAA4B;YAwI5B,mBAAmB;IA2IjC,OAAO,CAAC,cAAc;IA+BtB,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,WAAW;CAyBpB"}
+{"version":3,"file":"websocket-manager.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/fs/veryfront/websocket-manager.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAwB/F,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,qBAAqB,EAAE,qBAAqB,CAAC;IAE7C,iBAAiB,EAAE,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACvD,gBAAgB,EAAE,MAAM,aAAa,CAAC;IACtC,aAAa,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACxC,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,IAAI,CAAC;IAC/B,gBAAgB,EAAE,CAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,KAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED,qBAAa,gBAAgB;IAqBf,OAAO,CAAC,QAAQ,CAAC,IAAI;IApBjC,OAAO,CAAC,EAAE,CAA0B;IACpC,OAAO,CAAC,gBAAgB,CAAsD;IAC9E,OAAO,CAAC,gBAAgB,CAAuD;IAC/E,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,iBAAiB,CAAsD;IAC/E,OAAO,CAAC,0BAA0B,CAAsD;IACxF,OAAO,CAAC,mBAAmB,CAAqB;IAEhD,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,qBAAqB,CAAK;IAClC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,0BAA0B,CAAK;IACvC,OAAO,CAAC,iCAAiC,CAAqB;IAC9D,OAAO,CAAC,WAAW,CAIjB;gBAE2B,IAAI,EAAE,aAAa;IAEhD,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,8BAA8B;IAOtC,OAAO,CAAC,wBAAwB;IAahC,OAAO,CAAC,2BAA2B;IAUnC,cAAc,IAAI;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B;IAID,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IA+GhC,OAAO,CAAC,iBAAiB;IAMzB,OAAO,IAAI,IAAI;IA8Bf,OAAO,CAAC,iBAAiB;IAyJzB,OAAO,CAAC,8BAA8B;IA0GtC,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,6BAA6B;YAiBvB,4BAA4B;YAwI5B,mBAAmB;IA2IjC,OAAO,CAAC,cAAc;IA+BtB,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,WAAW;CAyBpB"}

package/esm/src/platform/adapters/fs/veryfront/websocket-manager.js

@@ -81,33 +81,23 @@ export class WebSocketManager {
             });
             this.wsConsecutiveFailures = 0;
         }
-        let wsUrl = this.deps.apiBaseUrl
+        const wsUrl = this.deps.apiBaseUrl
             .replace(/^http:/, "ws:")
             .replace(/^https:/, "wss:")
             .replace(/\/api$/, "");
-        // Enforce TLS for non-localhost connections to protect the auth token
-        if (wsUrl.startsWith("ws://")) {
-            try {
-                const host = new URL(wsUrl.replace(/^ws:/, "http:")).hostname;
-                const isLocal = host === "localhost" || host === "127.0.0.1" ||
-                    host === "::1" || host === "[::1]";
-                if (!isLocal) {
-                    wsUrl = wsUrl.replace(/^ws:/, "wss:");
-                    logger.warn("Upgraded WebSocket connection to wss:// for non-localhost host", this.getConnectionLogContext({ host }));
-                }
-            }
-            catch {
-                // If URL parsing fails, upgrade to be safe
-                wsUrl = wsUrl.replace(/^ws:/, "wss:");
-            }
-        }
-        const url = `${wsUrl}/ws/${projectId}/events?token=${this.deps.apiToken}`;
+        // The WebSocket protocol (ws vs wss) is derived from the configured
+        // apiBaseUrl (http→ws, https→wss). No forced upgrade is needed because
+        // the auth token is sent via a subprotocol header, not in the URL.
+        const url = `${wsUrl}/ws/${projectId}/events`;
         logger.debug("Connecting to WebSocket", this.getConnectionLogContext({
-            url: url.replace(this.deps.apiToken, "***"),
+            url,
             consecutiveFailures: this.wsConsecutiveFailures,
         }));
         try {
-            this.ws = new WebSocket(url);
+            // Send the API token via a WebSocket subprotocol header instead of
+            // a query-string parameter. Query strings can leak into server
+            // access logs, proxy logs, and the browser's Referer header.
+            this.ws = new WebSocket(url, [`bearer-${this.deps.apiToken}`]);
             this.wsConnectionId = dntShim.crypto.randomUUID().slice(0, 8);
             this.wsErrorLogged = false;
             this.ws.onopen = () => {
@@ -146,7 +136,7 @@ export class WebSocketManager {
                     this.wsErrorLogged = true;
                     logger.warn("WebSocket error", this.getConnectionLogContext({
                         type: event.type,
-                        url: event.target?.url?.replace(/token=[^&]+/, "token=***"),
+                        url: event.target?.url,
                         readyState: event.target?.readyState,
                         consecutiveFailures: this.wsConsecutiveFailures,
                     }));

package/esm/src/platform/compat/fs.js

@@ -98,7 +98,7 @@ class NodeFileSystem {
     }
     async makeTempDir(options) {
         await this.ensureInitialized();
-        const tempDir = this.getPath().join(this.getOs().tmpdir(), `${options?.prefix ?? "tmp-"}${Math.random().toString(36).substring(2, 8)}`);
+        const tempDir = this.getPath().join(this.getOs().tmpdir(), `${options?.prefix ?? "tmp-"}${dntShim.crypto.randomUUID().slice(0, 8)}`);
         await this.getFs().mkdir(tempDir, { recursive: true });
         return tempDir;
     }

package/esm/src/proxy/main.js

@@ -480,6 +480,9 @@ function router(req) {
     }
     switch (url.pathname) {
         case "/_proxy/stats":
+            if (Object.keys(proxyHandler.localProjects).length === 0) {
+                return Promise.resolve(new dntShim.Response("Forbidden", { status: 403 }));
+            }
             return handleStats();
         case "/_proxy/health":
             return Promise.resolve(dntShim.Response.json({ service: "veryfront-proxy", status: "ok" }));

package/esm/src/routing/api/module-loader/security-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-config.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/security-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,MAAM,EAAE,CAAC,CAcnB"}
+{"version":3,"file":"security-config.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/security-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,MAAM,EAAE,CAAC,CAoBnB"}

package/esm/src/routing/api/module-loader/security-config.js

@@ -5,6 +5,10 @@ export async function loadSecurityConfig(projectDir, adapter) {
         const cfg = await getConfig(projectDir, adapter);
         const remote = cfg.security?.remoteHosts;
         if (Array.isArray(remote)) {
+            if (remote.length === 0) {
+                logger.warn("security.remoteHosts is set to an empty array — all remote requests will be blocked. " +
+                    "If this is intentional, you can ignore this warning.");
+            }
             return remote;
         }
     }

package/esm/src/security/http/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAO7D,qBAAa,oBAAoB;IAO7B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc,CAAC;IARzB,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAA8B;gBAGvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,eAAe,YAAA;IAGpC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAQrB,IAAI;IAWlB,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,kBAAkB;IAgB1B,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,aAAa,IAAI,cAAc,CAAC,MAAM,CAAC;IAIvC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAwB,GAAG,MAAM;IAIjE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IASnE,KAAK,IAAI,IAAI;CAMd"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAO7D,qBAAa,oBAAoB;IAO7B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc,CAAC;IARzB,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAA8B;gBAGvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,eAAe,YAAA;IAGpC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAQrB,IAAI;IAWlB,OAAO,CAAC,WAAW;IAoBnB,OAAO,CAAC,kBAAkB;IAgB1B,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,aAAa,IAAI,cAAc,CAAC,MAAM,CAAC;IAIvC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAwB,GAAG,MAAM;IAIjE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IASnE,KAAK,IAAI,IAAI;CAMd"}

package/esm/src/security/http/config.js

@@ -38,7 +38,12 @@ export class SecurityConfigLoader {
         const security = cfg?.security ? { ...cfg.security } : {};
         if (security.headers)
             security.headers = { ...security.headers };
-        security.cors ??= true;
+        security.cors ??= false;
+        if (!cfg?.security?.cors && !cfg?.security?.csrf) {
+            logger.warn("Neither CORS nor CSRF protection is configured. " +
+                "CORS is disabled by default (same-origin only). " +
+                "Consider explicitly configuring security.cors and security.csrf.");
+        }
         this.securityConfig = security;
         this.cspUserHeader = this.parseCspUserHeader(security.csp);
         this.isLoaded = true;

package/esm/src/server/handlers/dev/dashboard/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/dashboard/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AA2BxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AA2CrD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CA8D5D"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/dashboard/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AA2BxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AA2CrD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAgE5D"}

package/esm/src/server/handlers/dev/dashboard/api.js

@@ -56,6 +56,8 @@ function errorResponse(message, status = 500) {
     return jsonResponse({ error: message }, status);
 }
 export function handleDashboardAPI(req, ctx) {
+    if (!ctx.isLocalProject)
+        return errorResponse("Unauthorized", 401);
     const { pathname } = new URL(req.url);
     if (req.method === "GET") {
         switch (pathname) {

package/esm/src/server/handlers/request/openapi.handler.js

@@ -40,7 +40,7 @@ export class OpenAPIHandler extends BaseHandler {
             const isDev = !!ctx.isLocalProject;
             const response = this.createResponseBuilder(ctx)
                 .withCache(isDev ? "no-cache" : { maxAge: SPEC_CACHE_MAX_AGE_SECONDS, public: true })
-                .withCORS(req, { origin: "*" })
+                .withCORS(req, ctx.securityConfig?.cors)
                 .withContentType(isYaml ? "text/yaml; charset=utf-8" : "application/json; charset=utf-8", content, HTTP_OK);
             return this.respond(response);
         }

package/esm/src/server/services/static/static-file.service.d.ts

@@ -75,6 +75,7 @@ export declare class StaticFileService {
     private loadManifestIndex;
     private extractManifestAssets;
     isAssetRequest(pathname: string): boolean;
+    private isDeniedDotfile;
     static clearCache(): void;
 }
 export {};

package/esm/src/server/services/static/static-file.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static-file.service.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/services/static/static-file.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAY3E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,aAAa,EAAE,aAAa,CAAC;IAC7B,gDAAgD;IAChD,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,cAAc,CAAC;IACxB,gDAAgD;IAChD,aAAa,EAAE,OAAO,CAAC;IACvB,iDAAiD;IACjD,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,UAAU,aAAa;IACrB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAYD;;GAEG;AACH,UAAU,qBAAqB;IAC7B,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3C,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC;CAC9D;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAE7E;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAC,aAAa,CAAoC;IAChE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAoD;IAElF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAuB;gBAEnC,MAAM,CAAC,EAAE,oBAAoB;IAIzC,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,aAAa;IAWf,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAarB,eAAe;YA2Bf,mBAAmB;IA2BjC,OAAO,CAAC,sBAAsB;YAkBhB,oBAAoB;YAYpB,iBAAiB;IA+C/B,OAAO,CAAC,qBAAqB;IAyC7B,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMzC,MAAM,CAAC,UAAU,IAAI,IAAI;CAI1B"}
+{"version":3,"file":"static-file.service.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/services/static/static-file.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAY3E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,aAAa,EAAE,aAAa,CAAC;IAC7B,gDAAgD;IAChD,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,cAAc,CAAC;IACxB,gDAAgD;IAChD,aAAa,EAAE,OAAO,CAAC;IACvB,iDAAiD;IACjD,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,UAAU,aAAa;IACrB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAYD;;GAEG;AACH,UAAU,qBAAqB;IAC7B,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3C,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC;CAC9D;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAE7E;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAC,aAAa,CAAoC;IAChE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAoD;IAElF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAuB;gBAEnC,MAAM,CAAC,EAAE,oBAAoB;IAIzC,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,aAAa;IAWf,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAarB,eAAe;YA2Bf,mBAAmB;IA2BjC,OAAO,CAAC,sBAAsB;YAkBhB,oBAAoB;YAYpB,iBAAiB;IA+C/B,OAAO,CAAC,qBAAqB;IAyC7B,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAOzC,OAAO,CAAC,eAAe;IAUvB,MAAM,CAAC,UAAU,IAAI,IAAI;CAI1B"}

package/esm/src/server/services/static/static-file.service.js

@@ -196,8 +196,19 @@ export class StaticFileService {
             return false;
         if (pathname.endsWith(".md"))
             return false;
+        if (this.isDeniedDotfile(pathname))
+            return false;
         return pathname.includes(".") || pathname.startsWith("/_veryfront/");
     }
+    isDeniedDotfile(pathname) {
+        const segments = pathname.split("/");
+        for (const segment of segments) {
+            if (segment.startsWith(".") && segment !== ".well-known") {
+                return true;
+            }
+        }
+        return false;
+    }
     static clearCache() {
         StaticFileService.manifestCache.clear();
         StaticFileService.manifestLoading.clear();

package/esm/src/skill/executor.js

@@ -64,7 +64,7 @@ function formatEnvAssignments(env) {
 }
 function createSandboxScriptPath(scriptPath) {
     const ext = extname(scriptPath) || ".sh";
-    const suffix = Math.random().toString(36).slice(2, 10);
+    const suffix = dntShim.crypto.randomUUID().slice(0, 8);
     return `/tmp/veryfront-skill-script-${Date.now()}-${suffix}${ext}`;
 }
 function getSandboxAuthOverride() {

package/esm/src/tool/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../src/src/tool/factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AA2HzE,wBAAgB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,EACtD,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAoCvB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACxF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;IAC7C,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,WAAW,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,aAAa,CAAC;KACpD,CAAC;CACH;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAiB7E"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../src/src/tool/factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AA2HzE,wBAAgB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,EACtD,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAoCvB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACxF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;IAC7C,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,WAAW,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,aAAa,CAAC;KACpD,CAAC;CACH;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CA2B7E"}

package/esm/src/tool/factory.js

@@ -105,6 +105,16 @@ export function dynamicTool(config) {
         inputSchema: config.inputSchema,
         inputSchemaJson,
         execute: async (input, context) => {
+            if (config.inputSchema &&
+                typeof config.inputSchema.parse === "function") {
+                config.inputSchema.parse(input);
+            }
+            else if (input === undefined) {
+                input = {};
+            }
+            else if (input === null || typeof input !== "object") {
+                throw new Error("dynamicTool: input must be a non-null object");
+            }
             const result = await config.execute(input, context);
             return config.toModelOutput ? config.toModelOutput(result) : result;
         },

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/transform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/pipeline/stages/ssr-vf-modules/transform.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAarE,OAAO,EAOL,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,gBAAgB,EACrB,oBAAoB,UAAQ,EAC5B,KAAK,SAAI,GACR,OAAO,CAAC,MAAM,CAAC,CAsPjB;AAED;;;GAGG;AACH,wBAAsB,kCAAkC,CACtD,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4CxB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CAEjB"}
+{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/pipeline/stages/ssr-vf-modules/transform.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAcrE,OAAO,EAOL,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAIxB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,gBAAgB,EACrB,oBAAoB,UAAQ,EAC5B,KAAK,SAAI,GACR,OAAO,CAAC,MAAM,CAAC,CAyQjB;AAED;;;GAGG;AACH,wBAAsB,kCAAkC,CACtD,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4CxB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CAEjB"}

package/esm/src/transforms/pipeline/stages/ssr-vf-modules/transform.js

@@ -5,6 +5,7 @@
  * resolves all imports (#veryfront/, relative, React).
  */
 import { join } from "../../../../platform/compat/path/index.js";
+import denoConfig from "../../../../../deno.js";
 import { rendererLogger as logger } from "../../../../utils/index.js";
 import { IMPORT_RESOLUTION_ERROR } from "../../../../errors/index.js";
 import { replaceSpecifiers } from "../../../esm/lexer.js";
@@ -17,6 +18,7 @@ import { buildReactUrl, getReactImportMap } from "../../../import-rewriter/url-b
 import { findRelativeImports } from "./import-finder.js";
 import { resolveRelativeFrameworkImport, resolveVeryfrontSourcePath } from "./path-resolver.js";
 import { EMBEDDED_SRC_DIR, FRAMEWORK_ROOT, frameworkFileCache, frameworkWriteFlight, LOG_PREFIX, MAX_RELATIVE_IMPORT_DEPTH, transformingFiles, veryfrontTransformCache, } from "./constants.js";
+const DENO_CONFIG_STUB_CODE = `export default ${JSON.stringify(denoConfig)};`;
 /**
  * Check if a transformed code string is a cycle placeholder.
  * Cycle placeholders are returned when transformFrameworkCode detects a cycle
@@ -236,7 +238,20 @@ export async function transformFrameworkCode(content, sourcePath, ctx, throwOnMi
         }
         // Rewrite imports to resolved paths
         const reactImportMap = getReactImportMap(ctx.reactVersion);
+        // Handle Deno import-map aliases (e.g. #deno-config) that only exist in
+        // the Deno runtime and cannot be resolved by esm.sh or the HTTP cache.
+        // We create a cached JS stub module so the transformed code can import it
+        // without losing access to imports/exports metadata from deno.json.
+        let denoConfigStubUrl = null;
+        if (transformed.includes('"#deno-config"') || transformed.includes("'#deno-config'")) {
+            const stubPath = await cacheTransformedCode(DENO_CONFIG_STUB_CODE, "#deno-config-stub", ctx.fs);
+            denoConfigStubUrl = `file://${stubPath}`;
+        }
         transformed = await replaceSpecifiers(transformed, (specifier) => {
+            // Handle Deno import-map aliases
+            if (specifier === "#deno-config") {
+                return denoConfigStubUrl;
+            }
             // Handle #veryfront/ imports
             if (specifier.startsWith("#veryfront/")) {
                 return veryfrontReplacements.get(specifier) ?? null;

package/esm/src/workflow/claude-code/tool.d.ts

@@ -20,21 +20,17 @@ declare const claudeCodeInputSchema: z.ZodObject<{
     files: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     /** Additional context */
     context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /** Custom system prompt */
-    system: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     mode: "code" | "custom" | "analysis";
     task: string;
     maxTurns: number;
     context?: Record<string, unknown> | undefined;
     files?: string[] | undefined;
-    system?: string | undefined;
 }, {
     task: string;
     context?: Record<string, unknown> | undefined;
     files?: string[] | undefined;
     mode?: "code" | "custom" | "analysis" | undefined;
-    system?: string | undefined;
     maxTurns?: number | undefined;
 }>;
 type ClaudeCodeInput = z.infer<typeof claudeCodeInputSchema>;
@@ -81,7 +77,6 @@ export declare const codeReviewTool: Tool<{
     maxTurns: number;
     context?: Record<string, unknown> | undefined;
     files?: string[] | undefined;
-    system?: string | undefined;
 }, ClaudeCodeResult>;
 /** Bug fix tool (code mode) */
 export declare const bugFixTool: Tool<{
@@ -90,7 +85,6 @@ export declare const bugFixTool: Tool<{
     maxTurns: number;
     context?: Record<string, unknown> | undefined;
     files?: string[] | undefined;
-    system?: string | undefined;
 }, ClaudeCodeResult>;
 /** Refactoring tool (code mode) */
 export declare const refactorTool: Tool<{
@@ -99,7 +93,6 @@ export declare const refactorTool: Tool<{
     maxTurns: number;
     context?: Record<string, unknown> | undefined;
     files?: string[] | undefined;
-    system?: string | undefined;
 }, ClaudeCodeResult>;
 /** Documentation tool (code mode) */
 export declare const docsTool: Tool<{
@@ -108,7 +101,6 @@ export declare const docsTool: Tool<{
     maxTurns: number;
     context?: Record<string, unknown> | undefined;
     files?: string[] | undefined;
-    system?: string | undefined;
 }, ClaudeCodeResult>;
 export {};
 //# sourceMappingURL=tool.d.ts.map

package/esm/src/workflow/claude-code/tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool.d.ts","sourceRoot":"","sources":["../../../../src/src/workflow/claude-code/tool.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnE;;GAEG;AACH,QAAA,MAAM,qBAAqB;IACzB,qCAAqC;;IAGrC,gBAAgB;;IAOhB,oBAAoB;;IAOpB,wBAAwB;;IAMxB,yBAAyB;;IAMzB,2BAA2B;;;;;;;;;;;;;;;;EAK3B,CAAC;AAEH,KAAK,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAmB7D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,gBAAgB,CA+BlE,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,GAAE;IACP,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GACL,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAiBzC;AAED;;GAEG;AAEH,kDAAkD;AAClD,eAAO,MAAM,cAAc;;;;;;;oBAazB,CAAC;AAEH,+BAA+B;AAC/B,eAAO,MAAM,UAAU;;;;;;;oBAarB,CAAC;AAEH,mCAAmC;AACnC,eAAO,MAAM,YAAY;;;;;;;oBAavB,CAAC;AAEH,qCAAqC;AACrC,eAAO,MAAM,QAAQ;;;;;;;oBAYnB,CAAC"}
+{"version":3,"file":"tool.d.ts","sourceRoot":"","sources":["../../../../src/src/workflow/claude-code/tool.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnE;;GAEG;AACH,QAAA,MAAM,qBAAqB;IACzB,qCAAqC;;IAGrC,gBAAgB;;IAOhB,oBAAoB;;IAQpB,wBAAwB;;IAMxB,yBAAyB;;;;;;;;;;;;;;EAKzB,CAAC;AAEH,KAAK,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAmB7D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,gBAAgB,CA6BlE,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,GAAE;IACP,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GACL,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAqBzC;AAED;;GAEG;AAEH,kDAAkD;AAClD,eAAO,MAAM,cAAc;;;;;;oBAazB,CAAC;AAEH,+BAA+B;AAC/B,eAAO,MAAM,UAAU;;;;;;oBAarB,CAAC;AAEH,mCAAmC;AACnC,eAAO,MAAM,YAAY;;;;;;oBAavB,CAAC;AAEH,qCAAqC;AACrC,eAAO,MAAM,QAAQ;;;;;;oBAYnB,CAAC"}

package/esm/src/workflow/claude-code/tool.js

@@ -20,6 +20,7 @@ const claudeCodeInputSchema = z.object({
     /** Maximum turns */
     maxTurns: z
         .number()
+        .max(100)
         .optional()
         .default(20)
         .describe("Maximum agentic loop turns"),
@@ -33,11 +34,6 @@ const claudeCodeInputSchema = z.object({
         .record(z.unknown())
         .optional()
         .describe("Additional context to include in the prompt"),
-    /** Custom system prompt */
-    system: z
-        .string()
-        .optional()
-        .describe("Custom system prompt override"),
 });
 /**
  * Build the full prompt from input
@@ -92,7 +88,6 @@ export const claudeCodeTool = {
             maxTurns: { type: "number", default: 20 },
             files: { type: "array", items: { type: "string" } },
             context: { type: "object" },
-            system: { type: "string" },
         },
         required: ["task"],
     },
@@ -100,7 +95,6 @@ export const claudeCodeTool = {
         return executeAgent(buildPrompt(input), {
             mode: input.mode,
             maxTurns: input.maxTurns,
-            systemPrompt: input.system,
             debug: true,
         });
     },
@@ -113,14 +107,18 @@ export function createClaudeCodeTool(options = {}) {
         ...claudeCodeTool,
         id: options.id || claudeCodeTool.id,
         description: options.description || claudeCodeTool.description,
-        execute: (input, context) => {
+        execute: (input, _context) => {
             const mergedInput = {
                 ...input,
                 mode: input.mode || options.defaultMode || "code",
                 maxTurns: input.maxTurns || options.defaultMaxTurns || 20,
-                system: input.system || options.system,
             };
-            return claudeCodeTool.execute(mergedInput, context);
+            return executeAgent(buildPrompt(mergedInput), {
+                mode: mergedInput.mode,
+                maxTurns: mergedInput.maxTurns,
+                systemPrompt: options.system,
+                debug: true,
+            });
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.55",
+  "version": "0.1.57",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.55",
+  "version": "0.1.57",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [

package/src/src/agent/chat-handler.ts

@@ -265,6 +265,16 @@ function isRequest(obj: unknown): obj is dntShim.Request {
   );
 }
 
+function extractUserId(request: dntShim.Request): string {
+  const userId = request.headers.get("x-user-id");
+  if (userId) return userId;
+  agentLogger.warn(
+    "No user identity found in request. Using anonymous fallback. " +
+      "Set x-user-id header or provide a context function for proper user isolation.",
+  );
+  return "anonymous";
+}
+
 function extractRequest(requestOrCtx: unknown): dntShim.Request {
   if (isRequest(requestOrCtx)) return requestOrCtx;
   // Pages Router APIContext — has a .request property
@@ -317,7 +327,7 @@ export function createChatHandler(
 
       const context = typeof options?.context === "function"
         ? await options.context(request)
-        : options?.context ?? { userId: "current-user" };
+        : options?.context ?? { userId: extractUserId(request) };
 
       const baseMessages = transformUIMessages(rawMessages);
       const beforeStreamResult = await options?.beforeStream?.({

package/src/src/agent/memory/redis.ts

@@ -33,6 +33,8 @@ export interface RedisMemoryConfig extends MemoryConfigBase {
   client: RedisClient;
   /** Key prefix for namespacing */
   keyPrefix?: string;
+  /** User ID for per-user memory isolation */
+  userId?: string;
   /** TTL in seconds (default: 24 hours) */
   ttl?: number;
 }
@@ -43,6 +45,7 @@ const DEFAULT_KEY_PREFIX = "veryfront:agent:memory:";
 export class RedisMemory<M extends MinimalMessage = MinimalMessage> implements Memory<M> {
   private client: RedisClient;
   private agentId: string;
+  private userId: string;
   private keyPrefix: string;
   private ttl: number;
   private config: RedisMemoryConfig;
@@ -50,13 +53,14 @@ export class RedisMemory<M extends MinimalMessage = MinimalMessage> implements M
   constructor(agentId: string, config: RedisMemoryConfig) {
     this.client = config.client;
     this.agentId = agentId;
+    this.userId = config.userId ?? "anonymous";
     this.keyPrefix = config.keyPrefix ?? DEFAULT_KEY_PREFIX;
     this.ttl = config.ttl ?? DEFAULT_TTL;
     this.config = config;
   }
 
   private getKey(): string {
-    return `${this.keyPrefix}${this.agentId}`;
+    return `${this.keyPrefix}${this.agentId}:${this.userId}`;
   }
 
   private parseMessages(data: string | null): M[] {

package/src/src/agent/runtime/index.ts

@@ -307,9 +307,10 @@ export class AgentRuntime {
           controller.close();
         } catch (error) {
           this.status = "error";
+          logger.error("Agent stream error", { error });
           sendSSE(controller, encoder, {
             type: "error",
-            error: error instanceof Error ? error.message : String(error),
+            error: "An internal error occurred",
           });
           controller.close();
         }

package/src/src/cache/backends/disk.ts

@@ -1,3 +1,4 @@
+import * as dntShim from "../../../_dnt.shims.js";
 import { join } from "../../platform/compat/path/index.js";
 import { getCacheBaseDir } from "../../utils/cache-dir.js";
 import { logger } from "../../utils/index.js";
@@ -78,7 +79,7 @@ export class DiskCacheBackend implements CacheBackend {
       expiresAt: ttlSeconds != null ? Date.now() + ttlSeconds * 1000 : undefined,
     };
     const filePath = this.filePath(key);
-    const tmpPath = `${filePath}.tmp.${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
+    const tmpPath = `${filePath}.tmp.${Date.now()}.${dntShim.crypto.randomUUID().slice(0, 8)}`;
     const content = JSON.stringify(envelope);
     const { writeFile, rename, unlink } = await fsPromises;
     try {

package/src/src/middleware/builtin/security/rate-limit.ts

@@ -76,8 +76,15 @@ export function rateLimit(
   const maxRequests = options.maxRequests ?? DEFAULT_RATE_LIMIT_REQUESTS;
   const windowMs = options.windowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS;
   const store = options.store ?? new MemoryRateLimitStore(windowMs);
-  const keyGenerator = options.keyGenerator ??
-    ((req: dntShim.Request) => req.headers.get("x-forwarded-for") || "anonymous");
+  const keyGenerator = options.keyGenerator ?? ((req: dntShim.Request) => {
+    const forwarded = req.headers.get("x-forwarded-for");
+    if (forwarded) {
+      const parts = forwarded.split(",").map((s) => s.trim()).filter(Boolean);
+      // Use rightmost IP — added by nearest trusted proxy, not spoofable by clients
+      if (parts.length > 0) return parts[parts.length - 1]!;
+    }
+    return "anonymous";
+  });
 
   return async (ctx, next) => {
     const req = getRequest(ctx);
@@ -96,3 +103,12 @@ export function rateLimit(
     });
   };
 }
+
+/** Pre-configured rate limiter for authentication endpoints (5 req/15min). */
+export function authRateLimit(store?: RateLimitStore): Middleware {
+  return rateLimit({
+    maxRequests: 5,
+    windowMs: 15 * MS_PER_MINUTE,
+    store,
+  });
+}

package/src/src/modules/react-loader/unified-loader.ts

@@ -1,3 +1,4 @@
+import * as dntShim from "../../../_dnt.shims.js";
 import { join } from "../../platform/compat/path/index.js";
 import type { RuntimeAdapter } from "../../platform/adapters/base.js";
 import { transformToESM } from "../../transforms/esm/index.js";
@@ -74,7 +75,7 @@ async function transformAllComponents(
 
 async function createTempDir(projectId: string, adapter: RuntimeAdapter): Promise<string> {
   const baseTmp = await getProjectTmpDir(projectId);
-  const uniqueTmp = `unified-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  const uniqueTmp = `unified-${Date.now()}-${dntShim.crypto.randomUUID().slice(0, 12)}`;
   const tmpDir = join(baseTmp, uniqueTmp);
 
   await adapter.fs.mkdir(tmpDir, { recursive: true });

package/src/src/oauth/token-store/memory.ts

@@ -6,17 +6,26 @@ const STATE_EXPIRATION_MS = 10 * 60 * 1_000;
 export class MemoryTokenStore implements TokenStore {
   private tokens = new Map<string, OAuthTokens>();
   private states = new Map<string, OAuthState>();
+  private projectId: string;
+
+  constructor(projectId = "default") {
+    this.projectId = projectId;
+  }
+
+  private scopedKey(serviceId: string): string {
+    return `${this.projectId}:${serviceId}`;
+  }
 
   async getTokens(serviceId: string): Promise<OAuthTokens | null> {
-    return this.tokens.get(serviceId) ?? null;
+    return this.tokens.get(this.scopedKey(serviceId)) ?? null;
   }
 
   async setTokens(serviceId: string, tokens: OAuthTokens): Promise<void> {
-    this.tokens.set(serviceId, tokens);
+    this.tokens.set(this.scopedKey(serviceId), tokens);
   }
 
   async clearTokens(serviceId: string): Promise<void> {
-    this.tokens.delete(serviceId);
+    this.tokens.delete(this.scopedKey(serviceId));
   }
 
   async getState(state: string): Promise<OAuthState | null> {
@@ -54,7 +63,7 @@ export class MemoryTokenStore implements TokenStore {
   }
 
   isConnected(serviceId: string): boolean {
-    const tokens = this.tokens.get(serviceId);
+    const tokens = this.tokens.get(this.scopedKey(serviceId));
     if (!tokens) return false;
 
     const isExpired = tokens.expiresAt != null && Date.now() > tokens.expiresAt;

package/src/src/platform/adapters/fs/veryfront/websocket-manager.ts

@@ -127,42 +127,30 @@ export class WebSocketManager {
       this.wsConsecutiveFailures = 0;
     }
 
-    let wsUrl = this.deps.apiBaseUrl
+    const wsUrl = this.deps.apiBaseUrl
       .replace(/^http:/, "ws:")
       .replace(/^https:/, "wss:")
       .replace(/\/api$/, "");
 
-    // Enforce TLS for non-localhost connections to protect the auth token
-    if (wsUrl.startsWith("ws://")) {
-      try {
-        const host = new URL(wsUrl.replace(/^ws:/, "http:")).hostname;
-        const isLocal = host === "localhost" || host === "127.0.0.1" ||
-          host === "::1" || host === "[::1]";
-        if (!isLocal) {
-          wsUrl = wsUrl.replace(/^ws:/, "wss:");
-          logger.warn(
-            "Upgraded WebSocket connection to wss:// for non-localhost host",
-            this.getConnectionLogContext({ host }),
-          );
-        }
-      } catch {
-        // If URL parsing fails, upgrade to be safe
-        wsUrl = wsUrl.replace(/^ws:/, "wss:");
-      }
-    }
+    // The WebSocket protocol (ws vs wss) is derived from the configured
+    // apiBaseUrl (http→ws, https→wss). No forced upgrade is needed because
+    // the auth token is sent via a subprotocol header, not in the URL.
 
-    const url = `${wsUrl}/ws/${projectId}/events?token=${this.deps.apiToken}`;
+    const url = `${wsUrl}/ws/${projectId}/events`;
 
     logger.debug(
       "Connecting to WebSocket",
       this.getConnectionLogContext({
-        url: url.replace(this.deps.apiToken, "***"),
+        url,
         consecutiveFailures: this.wsConsecutiveFailures,
       }),
     );
 
     try {
-      this.ws = new WebSocket(url);
+      // Send the API token via a WebSocket subprotocol header instead of
+      // a query-string parameter. Query strings can leak into server
+      // access logs, proxy logs, and the browser's Referer header.
+      this.ws = new WebSocket(url, [`bearer-${this.deps.apiToken}`]);
       this.wsConnectionId = dntShim.crypto.randomUUID().slice(0, 8);
       this.wsErrorLogged = false;
 
@@ -214,7 +202,7 @@ export class WebSocketManager {
             "WebSocket error",
             this.getConnectionLogContext({
               type: event.type,
-              url: (event.target as WebSocket)?.url?.replace(/token=[^&]+/, "token=***"),
+              url: (event.target as WebSocket)?.url,
               readyState: (event.target as WebSocket)?.readyState,
               consecutiveFailures: this.wsConsecutiveFailures,
             }),

package/src/src/platform/compat/fs.ts

@@ -162,7 +162,7 @@ class NodeFileSystem implements FileSystem {
     await this.ensureInitialized();
     const tempDir = this.getPath().join(
       this.getOs().tmpdir(),
-      `${options?.prefix ?? "tmp-"}${Math.random().toString(36).substring(2, 8)}`,
+      `${options?.prefix ?? "tmp-"}${dntShim.crypto.randomUUID().slice(0, 8)}`,
     );
     await this.getFs().mkdir(tempDir, { recursive: true });
     return tempDir;

package/src/src/proxy/main.ts

@@ -577,6 +577,9 @@ function router(req: dntShim.Request): Promise<dntShim.Response> {
 
   switch (url.pathname) {
     case "/_proxy/stats":
+      if (Object.keys(proxyHandler.localProjects).length === 0) {
+        return Promise.resolve(new dntShim.Response("Forbidden", { status: 403 }));
+      }
       return handleStats();
     case "/_proxy/health":
       return Promise.resolve(

package/src/src/routing/api/module-loader/security-config.ts

@@ -12,6 +12,12 @@ export async function loadSecurityConfig(
     const remote = cfg.security?.remoteHosts;
 
     if (Array.isArray(remote)) {
+      if (remote.length === 0) {
+        logger.warn(
+          "security.remoteHosts is set to an empty array — all remote requests will be blocked. " +
+            "If this is intentional, you can ignore this warning.",
+        );
+      }
       return remote;
     }
   } catch (e) {

package/src/src/security/http/config.ts

@@ -43,7 +43,15 @@ export class SecurityConfigLoader {
 
     if (security.headers) security.headers = { ...security.headers };
 
-    security.cors ??= true;
+    security.cors ??= false;
+
+    if (!cfg?.security?.cors && !cfg?.security?.csrf) {
+      logger.warn(
+        "Neither CORS nor CSRF protection is configured. " +
+          "CORS is disabled by default (same-origin only). " +
+          "Consider explicitly configuring security.cors and security.csrf.",
+      );
+    }
 
     this.securityConfig = security;
     this.cspUserHeader = this.parseCspUserHeader(security.csp);

package/src/src/server/handlers/dev/dashboard/api.ts

@@ -72,6 +72,8 @@ export function handleDashboardAPI(
   req: dntShim.Request,
   ctx: HandlerContext,
 ): Promise<dntShim.Response | null> | dntShim.Response | null {
+  if (!ctx.isLocalProject) return errorResponse("Unauthorized", 401);
+
   const { pathname } = new URL(req.url);
 
   if (req.method === "GET") {

package/src/src/server/handlers/request/openapi.handler.ts

@@ -56,7 +56,7 @@ export class OpenAPIHandler extends BaseHandler {
 
       const response = this.createResponseBuilder(ctx)
         .withCache(isDev ? "no-cache" : { maxAge: SPEC_CACHE_MAX_AGE_SECONDS, public: true })
-        .withCORS(req, { origin: "*" })
+        .withCORS(req, ctx.securityConfig?.cors)
         .withContentType(
           isYaml ? "text/yaml; charset=utf-8" : "application/json; charset=utf-8",
           content,

package/src/src/server/services/static/static-file.service.ts

@@ -312,9 +312,20 @@ export class StaticFileService {
   isAssetRequest(pathname: string): boolean {
     if (pathname.includes("/.veryfront/") || pathname.startsWith("/.veryfront")) return false;
     if (pathname.endsWith(".md")) return false;
+    if (this.isDeniedDotfile(pathname)) return false;
     return pathname.includes(".") || pathname.startsWith("/_veryfront/");
   }
 
+  private isDeniedDotfile(pathname: string): boolean {
+    const segments = pathname.split("/");
+    for (const segment of segments) {
+      if (segment.startsWith(".") && segment !== ".well-known") {
+        return true;
+      }
+    }
+    return false;
+  }
+
   static clearCache(): void {
     StaticFileService.manifestCache.clear();
     StaticFileService.manifestLoading.clear();

package/src/src/skill/executor.ts

@@ -78,7 +78,7 @@ function formatEnvAssignments(env?: Record<string, string>): string[] {
 
 function createSandboxScriptPath(scriptPath: string): string {
   const ext = extname(scriptPath) || ".sh";
-  const suffix = Math.random().toString(36).slice(2, 10);
+  const suffix = dntShim.crypto.randomUUID().slice(0, 8);
   return `/tmp/veryfront-skill-script-${Date.now()}-${suffix}${ext}`;
 }
 

package/src/src/tool/factory.ts

@@ -186,6 +186,16 @@ export function dynamicTool(config: DynamicToolConfig): Tool<unknown, unknown> {
     inputSchema: config.inputSchema as z.ZodSchema<unknown>,
     inputSchemaJson,
     execute: async (input: unknown, context?: ToolExecutionContext) => {
+      if (
+        config.inputSchema &&
+        typeof (config.inputSchema as { parse?: unknown }).parse === "function"
+      ) {
+        (config.inputSchema as { parse: (v: unknown) => unknown }).parse(input);
+      } else if (input === undefined) {
+        input = {};
+      } else if (input === null || typeof input !== "object") {
+        throw new Error("dynamicTool: input must be a non-null object");
+      }
       const result = await config.execute(input, context);
       return config.toModelOutput ? config.toModelOutput(result) : result;
     },

package/src/src/transforms/pipeline/stages/ssr-vf-modules/transform.ts

@@ -7,6 +7,7 @@
 
 import { createFileSystem } from "../../../../platform/compat/fs.js";
 import { join } from "../../../../platform/compat/path/index.js";
+import denoConfig from "../../../../../deno.js";
 import { rendererLogger as logger } from "../../../../utils/index.js";
 import { IMPORT_RESOLUTION_ERROR } from "../../../../errors/index.js";
 import { replaceSpecifiers } from "../../../esm/lexer.js";
@@ -30,6 +31,8 @@ import {
   veryfrontTransformCache,
 } from "./constants.js";
 
+const DENO_CONFIG_STUB_CODE = `export default ${JSON.stringify(denoConfig)};`;
+
 /**
  * Check if a transformed code string is a cycle placeholder.
  * Cycle placeholders are returned when transformFrameworkCode detects a cycle
@@ -291,7 +294,26 @@ export async function transformFrameworkCode(
     // Rewrite imports to resolved paths
     const reactImportMap = getReactImportMap(ctx.reactVersion);
 
+    // Handle Deno import-map aliases (e.g. #deno-config) that only exist in
+    // the Deno runtime and cannot be resolved by esm.sh or the HTTP cache.
+    // We create a cached JS stub module so the transformed code can import it
+    // without losing access to imports/exports metadata from deno.json.
+    let denoConfigStubUrl: string | null = null;
+    if (transformed.includes('"#deno-config"') || transformed.includes("'#deno-config'")) {
+      const stubPath = await cacheTransformedCode(
+        DENO_CONFIG_STUB_CODE,
+        "#deno-config-stub",
+        ctx.fs,
+      );
+      denoConfigStubUrl = `file://${stubPath}`;
+    }
+
     transformed = await replaceSpecifiers(transformed, (specifier) => {
+      // Handle Deno import-map aliases
+      if (specifier === "#deno-config") {
+        return denoConfigStubUrl;
+      }
+
       // Handle #veryfront/ imports
       if (specifier.startsWith("#veryfront/")) {
         return veryfrontReplacements.get(specifier) ?? null;

package/src/src/workflow/claude-code/tool.ts

@@ -26,6 +26,7 @@ const claudeCodeInputSchema = z.object({
   /** Maximum turns */
   maxTurns: z
     .number()
+    .max(100)
     .optional()
     .default(20)
     .describe("Maximum agentic loop turns"),
@@ -41,12 +42,6 @@ const claudeCodeInputSchema = z.object({
     .record(z.unknown())
     .optional()
     .describe("Additional context to include in the prompt"),
-
-  /** Custom system prompt */
-  system: z
-    .string()
-    .optional()
-    .describe("Custom system prompt override"),
 });
 
 type ClaudeCodeInput = z.infer<typeof claudeCodeInputSchema>;
@@ -108,7 +103,6 @@ export const claudeCodeTool: Tool<ClaudeCodeInput, ClaudeCodeResult> = {
       maxTurns: { type: "number", default: 20 },
       files: { type: "array", items: { type: "string" } },
       context: { type: "object" },
-      system: { type: "string" },
     },
     required: ["task"],
   },
@@ -117,7 +111,6 @@ export const claudeCodeTool: Tool<ClaudeCodeInput, ClaudeCodeResult> = {
     return executeAgent(buildPrompt(input), {
       mode: input.mode as ClaudeCodeMode,
       maxTurns: input.maxTurns,
-      systemPrompt: input.system,
       debug: true,
     });
   },
@@ -140,15 +133,19 @@ export function createClaudeCodeTool(
     id: options.id || claudeCodeTool.id,
     description: options.description || claudeCodeTool.description,
 
-    execute: (input, context) => {
+    execute: (input, _context) => {
       const mergedInput: ClaudeCodeInput = {
         ...input,
         mode: input.mode || options.defaultMode || "code",
         maxTurns: input.maxTurns || options.defaultMaxTurns || 20,
-        system: input.system || options.system,
       };
 
-      return claudeCodeTool.execute(mergedInput, context);
+      return executeAgent(buildPrompt(mergedInput), {
+        mode: mergedInput.mode as ClaudeCodeMode,
+        maxTurns: mergedInput.maxTurns,
+        systemPrompt: options.system,
+        debug: true,
+      });
     },
   };
 }