🛡️ feat: Persist & enforce disable-model-invocation / user-invocable / allowed-tools

api/server/controllers/agents/openai.js

@@ -42,6 +42,7 @@ const { findAccessibleResources } = require('~/server/services/PermissionService
 const {
   getSkillToolDeps,
   enrichWithSkillConfigurable,
+  buildManualSkillPrimedIdsByName,
 } = require('~/server/services/Endpoints/agents/skillDeps');
 const db = require('~/models');
 
@@ -326,7 +327,13 @@ const OpenAIChatCompletionController = async (req, res) => {
           tool_resources: primaryConfig.tool_resources,
           actionsEnabled: primaryConfig.actionsEnabled,
         });
-        return enrichWithSkillConfigurable(result, req, primaryConfig.accessibleSkillIds);
+        return enrichWithSkillConfigurable(
+          result,
+          req,
+          primaryConfig.accessibleSkillIds,
+          undefined,
+          buildManualSkillPrimedIdsByName(primaryConfig.manualSkillPrimes),
+        );
       },
       toolEndCallback,
       ...getSkillToolDeps(),

api/server/controllers/agents/responses.js

@@ -51,6 +51,7 @@ const { findAccessibleResources } = require('~/server/services/PermissionService
 const {
   getSkillToolDeps,
   enrichWithSkillConfigurable,
+  buildManualSkillPrimedIdsByName,
 } = require('~/server/services/Endpoints/agents/skillDeps');
 const db = require('~/models');
 
@@ -509,7 +510,13 @@ const createResponse = async (req, res) => {
             tool_resources: primaryConfig.tool_resources,
             actionsEnabled: primaryConfig.actionsEnabled,
           });
-          return enrichWithSkillConfigurable(result, req, primaryConfig.accessibleSkillIds);
+          return enrichWithSkillConfigurable(
+            result,
+            req,
+            primaryConfig.accessibleSkillIds,
+            undefined,
+            buildManualSkillPrimedIdsByName(primaryConfig.manualSkillPrimes),
+          );
         },
         toolEndCallback,
         ...getSkillToolDeps(),
@@ -676,7 +683,13 @@ const createResponse = async (req, res) => {
             tool_resources: primaryConfig.tool_resources,
             actionsEnabled: primaryConfig.actionsEnabled,
           });
-          return enrichWithSkillConfigurable(result, req, primaryConfig.accessibleSkillIds);
+          return enrichWithSkillConfigurable(
+            result,
+            req,
+            primaryConfig.accessibleSkillIds,
+            undefined,
+            buildManualSkillPrimedIdsByName(primaryConfig.manualSkillPrimes),
+          );
         },
         toolEndCallback,
         ...getSkillToolDeps(),

api/server/services/Endpoints/agents/initialize.js

@@ -29,7 +29,11 @@ const {
 const { loadAgentTools, loadToolsForExecution } = require('~/server/services/ToolService');
 const { loadAuthValues } = require('~/server/services/Tools/credentials');
 const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
-const { getSkillToolDeps, enrichWithSkillConfigurable } = require('./skillDeps');
+const {
+  getSkillToolDeps,
+  enrichWithSkillConfigurable,
+  buildManualSkillPrimedIdsByName,
+} = require('./skillDeps');
 const { getModelsConfig } = require('~/server/controllers/ModelController');
 const { checkPermission, findAccessibleResources } = require('~/server/services/PermissionService');
 const AgentClient = require('~/server/controllers/agents/client');
@@ -185,7 +189,13 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
       });
 
       logger.debug(`[ON_TOOL_EXECUTE] loaded ${result.loadedTools?.length ?? 0} tools`);
-      return enrichWithSkillConfigurable(result, req, ctx.accessibleSkillIds, codeApiKey);
+      return enrichWithSkillConfigurable(
+        result,
+        req,
+        ctx.accessibleSkillIds,
+        codeApiKey,
+        ctx.manualSkillPrimedIdsByName,
+      );
     },
     toolEndCallback,
     ...getSkillToolDeps(),
@@ -288,13 +298,21 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
   logger.debug(
     `[initializeClient] Storing tool context for ${primaryConfig.id}: ${primaryConfig.toolDefinitions?.length ?? 0} tools, registry size: ${primaryConfig.toolRegistry?.size ?? '0'}`,
   );
+  /** Maps each manually-primed skill name to the `_id` of the exact doc
+   *  that was primed. Plumbed to `enrichWithSkillConfigurable` so the
+   *  read_file handler can pin same-name collision lookups to the
+   *  resolver's chosen doc. */
+  const manualSkillPrimedIdsByName = buildManualSkillPrimedIdsByName(
+    primaryConfig.manualSkillPrimes,
+  );
   agentToolContexts.set(primaryConfig.id, {
     agent: primaryAgent,
     toolRegistry: primaryConfig.toolRegistry,
     userMCPAuthMap: primaryConfig.userMCPAuthMap,
     tool_resources: primaryConfig.tool_resources,
     actionsEnabled: primaryConfig.actionsEnabled,
     accessibleSkillIds: primaryConfig.accessibleSkillIds,
+    manualSkillPrimedIdsByName,
   });
 
   const agent_ids = primaryConfig.agent_ids;

api/server/services/Endpoints/agents/skillDeps.js

@@ -5,6 +5,27 @@ const { loadAuthValues } = require('~/server/services/Tools/credentials');
 const { enrichWithSkillConfigurable } = require('@librechat/api');
 const db = require('~/models');
 
+/**
+ * Builds the `manualSkillPrimedIdsByName` map passed through to
+ * `enrichWithSkillConfigurable`. Centralized here so the four CJS call
+ * sites (`initialize.js`, `responses.js` x2, `openai.js`) share one
+ * source of truth — if `ResolvedManualSkill` ever renames `_id` or
+ * gains new identifying fields, only this helper changes.
+ *
+ * Returns `undefined` (not `{}`) when there are no primes, so the
+ * downstream `enrichWithSkillConfigurable` cleanly omits the field
+ * from `mergedConfigurable` rather than threading an empty object.
+ *
+ * @param {Array<{ name: string, _id: { toString(): string } }> | undefined} manualSkillPrimes
+ * @returns {Record<string, string> | undefined}
+ */
+function buildManualSkillPrimedIdsByName(manualSkillPrimes) {
+  if (!manualSkillPrimes?.length) {
+    return undefined;
+  }
+  return Object.fromEntries(manualSkillPrimes.map((p) => [p.name, p._id.toString()]));
+}
+
 /** Skill-related properties for ToolExecuteOptions (stable references, allocated once). */
 const skillToolDeps = {
   getSkillByName: db.getSkillByName,
@@ -28,16 +49,28 @@ function getSkillToolDeps() {
  * @param {object} req - The Express request object
  * @param {Array} accessibleSkillIds - Pre-computed accessible skill IDs
  * @param {string} [preResolvedCodeApiKey] - Pre-resolved code API key (skips redundant lookup)
+ * @param {Record<string, string>} [manualSkillPrimedIdsByName] - Map of name → skill id for skills manually invoked this turn via the `$` popover. Pins same-name collision lookups in `read_file`.
  * @returns {Promise<object>} Augmented result with skill configurable
  */
-function enrichConfigurable(result, req, accessibleSkillIds, preResolvedCodeApiKey) {
+function enrichConfigurable(
+  result,
+  req,
+  accessibleSkillIds,
+  preResolvedCodeApiKey,
+  manualSkillPrimedIdsByName,
+) {
   return enrichWithSkillConfigurable(
     result,
     req,
     accessibleSkillIds,
     loadAuthValues,
     preResolvedCodeApiKey,
+    manualSkillPrimedIdsByName,
   );
 }
 
-module.exports = { getSkillToolDeps, enrichWithSkillConfigurable: enrichConfigurable };
+module.exports = {
+  getSkillToolDeps,
+  enrichWithSkillConfigurable: enrichConfigurable,
+  buildManualSkillPrimedIdsByName,
+};

client/src/components/Chat/Input/SkillsCommand.tsx

@@ -2,7 +2,6 @@ import { memo, useState, useRef, useEffect, useMemo, useCallback } from 'react';
 import { ScrollText } from 'lucide-react';
 import { AutoSizer, List } from 'react-virtualized';
 import { Spinner, useCombobox } from '@librechat/client';
-import { InvocationMode } from 'librechat-data-provider';
 import { useRecoilValue, useSetRecoilState } from 'recoil';
 import type { TSkillSummary } from 'librechat-data-provider';
 import type { MentionOption } from '~/common';
@@ -22,16 +21,13 @@ const skillIcon = <ScrollText className="icon-md text-cyan-500" />;
 
 /**
  * Determines whether a skill should appear in the `$` command popover.
- * `manual` and `both` are user-invocable. `auto` is model-only and hidden.
- * Skills without an explicit mode (undefined) default to visible for
- * backward compatibility until the backend persists `invocationMode`.
+ * Reads the persisted `userInvocable` field (mirrors the `user-invocable`
+ * frontmatter). Defaults to visible when the field is absent so older
+ * skills authored before Phase 6 stay user-invocable without a migration;
+ * only an explicit `false` hides them.
  */
 export function isUserInvocable(skill: TSkillSummary): boolean {
-  const mode = skill.invocationMode;
-  if (mode == null || mode === InvocationMode.both) {
-    return true;
-  }
-  return mode === InvocationMode.manual;
+  return skill.userInvocable !== false;
 }
 
 /**

client/src/components/Chat/Input/__tests__/SkillsCommand.spec.tsx

@@ -14,7 +14,6 @@ import React from 'react';
 import { act } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { render, screen } from '@testing-library/react';
-import { InvocationMode } from 'librechat-data-provider';
 import type { TSkillSummary } from 'librechat-data-provider';
 
 const CONVO_ID = 'convo-1';
@@ -412,7 +411,7 @@ describe('filterSkillsForPopover', () => {
   const inactive = () => false;
   const s1 = makeSkill({ _id: '1', name: 'a' });
   const s2 = makeSkill({ _id: '2', name: 'b' });
-  const s3 = makeSkill({ _id: '3', name: 'c', invocationMode: InvocationMode.auto });
+  const s3 = makeSkill({ _id: '3', name: 'c', userInvocable: false });
 
   it('passes everything through when agentSkillIds is undefined', () => {
     const out = filterSkillsForPopover([s1, s2], { agentSkillIds: undefined, isActive: active });
@@ -440,7 +439,7 @@ describe('filterSkillsForPopover', () => {
     expect(out.map((s) => s._id)).toEqual(['2']);
   });
 
-  it('excludes auto-only skills via isUserInvocable', () => {
+  it('excludes skills with userInvocable: false via isUserInvocable', () => {
     const out = filterSkillsForPopover([s1, s3], { agentSkillIds: null, isActive: active });
     expect(out.map((s) => s._id)).toEqual(['1']);
   });
@@ -456,8 +455,8 @@ describe('filterSkillsForPopover', () => {
       agentSkillIds: ['1', '2', '3'],
       isActive,
     });
-    /* s1 passes (active, manual-by-default, scoped), s2 drops (inactive),
-       s3 drops (auto-only invocation mode). */
+    /* s1 passes (active, user-invocable by default, scoped), s2 drops (inactive),
+       s3 drops (userInvocable: false). */
     expect(out.map((s) => s._id)).toEqual(['1']);
   });