🛡️ feat: Persist & enforce disable-model-invocation / user-invocable / allowed-tools

api/server/controllers/agents/openai.js

@@ -326,7 +326,13 @@ const OpenAIChatCompletionController = async (req, res) => {
           tool_resources: primaryConfig.tool_resources,
           actionsEnabled: primaryConfig.actionsEnabled,
         });
-        return enrichWithSkillConfigurable(result, req, primaryConfig.accessibleSkillIds);
+        return enrichWithSkillConfigurable(
+          result,
+          req,
+          primaryConfig.accessibleSkillIds,
+          undefined,
+          primaryConfig.manualSkillPrimes?.map((p) => p.name),
+        );
       },
       toolEndCallback,
       ...getSkillToolDeps(),

api/server/controllers/agents/responses.js

@@ -509,7 +509,13 @@ const createResponse = async (req, res) => {
             tool_resources: primaryConfig.tool_resources,
             actionsEnabled: primaryConfig.actionsEnabled,
           });
-          return enrichWithSkillConfigurable(result, req, primaryConfig.accessibleSkillIds);
+          return enrichWithSkillConfigurable(
+            result,
+            req,
+            primaryConfig.accessibleSkillIds,
+            undefined,
+            primaryConfig.manualSkillPrimes?.map((p) => p.name),
+          );
         },
         toolEndCallback,
         ...getSkillToolDeps(),
@@ -676,7 +682,13 @@ const createResponse = async (req, res) => {
             tool_resources: primaryConfig.tool_resources,
             actionsEnabled: primaryConfig.actionsEnabled,
           });
-          return enrichWithSkillConfigurable(result, req, primaryConfig.accessibleSkillIds);
+          return enrichWithSkillConfigurable(
+            result,
+            req,
+            primaryConfig.accessibleSkillIds,
+            undefined,
+            primaryConfig.manualSkillPrimes?.map((p) => p.name),
+          );
         },
         toolEndCallback,
         ...getSkillToolDeps(),

api/server/services/Endpoints/agents/initialize.js

@@ -185,7 +185,13 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
       });
 
       logger.debug(`[ON_TOOL_EXECUTE] loaded ${result.loadedTools?.length ?? 0} tools`);
-      return enrichWithSkillConfigurable(result, req, ctx.accessibleSkillIds, codeApiKey);
+      return enrichWithSkillConfigurable(
+        result,
+        req,
+        ctx.accessibleSkillIds,
+        codeApiKey,
+        ctx.manualSkillNames,
+      );
     },
     toolEndCallback,
     ...getSkillToolDeps(),
@@ -295,6 +301,7 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
     tool_resources: primaryConfig.tool_resources,
     actionsEnabled: primaryConfig.actionsEnabled,
     accessibleSkillIds: primaryConfig.accessibleSkillIds,
+    manualSkillNames: primaryConfig.manualSkillPrimes?.map((p) => p.name),
   });
 
   const agent_ids = primaryConfig.agent_ids;

api/server/services/Endpoints/agents/skillDeps.js

@@ -28,15 +28,23 @@ function getSkillToolDeps() {
  * @param {object} req - The Express request object
  * @param {Array} accessibleSkillIds - Pre-computed accessible skill IDs
  * @param {string} [preResolvedCodeApiKey] - Pre-resolved code API key (skips redundant lookup)
+ * @param {string[]} [manualSkillNames] - Skill names manually invoked this turn via the `$` popover
  * @returns {Promise<object>} Augmented result with skill configurable
  */
-function enrichConfigurable(result, req, accessibleSkillIds, preResolvedCodeApiKey) {
+function enrichConfigurable(
+  result,
+  req,
+  accessibleSkillIds,
+  preResolvedCodeApiKey,
+  manualSkillNames,
+) {
   return enrichWithSkillConfigurable(
     result,
     req,
     accessibleSkillIds,
     loadAuthValues,
     preResolvedCodeApiKey,
+    manualSkillNames,
   );
 }
 

client/src/components/Chat/Input/SkillsCommand.tsx

@@ -2,7 +2,6 @@ import { memo, useState, useRef, useEffect, useMemo, useCallback } from 'react';
 import { ScrollText } from 'lucide-react';
 import { AutoSizer, List } from 'react-virtualized';
 import { Spinner, useCombobox } from '@librechat/client';
-import { InvocationMode } from 'librechat-data-provider';
 import { useRecoilValue, useSetRecoilState } from 'recoil';
 import type { TSkillSummary } from 'librechat-data-provider';
 import type { MentionOption } from '~/common';
@@ -22,16 +21,13 @@ const skillIcon = <ScrollText className="icon-md text-cyan-500" />;
 
 /**
  * Determines whether a skill should appear in the `$` command popover.
- * `manual` and `both` are user-invocable. `auto` is model-only and hidden.
- * Skills without an explicit mode (undefined) default to visible for
- * backward compatibility until the backend persists `invocationMode`.
+ * Reads the persisted `userInvocable` field (mirrors the `user-invocable`
+ * frontmatter). Defaults to visible when the field is absent so older
+ * skills authored before Phase 6 stay user-invocable without a migration;
+ * only an explicit `false` hides them.
  */
 export function isUserInvocable(skill: TSkillSummary): boolean {
-  const mode = skill.invocationMode;
-  if (mode == null || mode === InvocationMode.both) {
-    return true;
-  }
-  return mode === InvocationMode.manual;
+  return skill.userInvocable !== false;
 }
 
 /**

client/src/components/Chat/Input/__tests__/SkillsCommand.spec.tsx

@@ -14,7 +14,6 @@ import React from 'react';
 import { act } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { render, screen } from '@testing-library/react';
-import { InvocationMode } from 'librechat-data-provider';
 import type { TSkillSummary } from 'librechat-data-provider';
 
 const CONVO_ID = 'convo-1';
@@ -412,7 +411,7 @@ describe('filterSkillsForPopover', () => {
   const inactive = () => false;
   const s1 = makeSkill({ _id: '1', name: 'a' });
   const s2 = makeSkill({ _id: '2', name: 'b' });
-  const s3 = makeSkill({ _id: '3', name: 'c', invocationMode: InvocationMode.auto });
+  const s3 = makeSkill({ _id: '3', name: 'c', userInvocable: false });
 
   it('passes everything through when agentSkillIds is undefined', () => {
     const out = filterSkillsForPopover([s1, s2], { agentSkillIds: undefined, isActive: active });
@@ -440,7 +439,7 @@ describe('filterSkillsForPopover', () => {
     expect(out.map((s) => s._id)).toEqual(['2']);
   });
 
-  it('excludes auto-only skills via isUserInvocable', () => {
+  it('excludes skills with userInvocable: false via isUserInvocable', () => {
     const out = filterSkillsForPopover([s1, s3], { agentSkillIds: null, isActive: active });
     expect(out.map((s) => s._id)).toEqual(['1']);
   });
@@ -456,8 +455,8 @@ describe('filterSkillsForPopover', () => {
       agentSkillIds: ['1', '2', '3'],
       isActive,
     });
-    /* s1 passes (active, manual-by-default, scoped), s2 drops (inactive),
-       s3 drops (auto-only invocation mode). */
+    /* s1 passes (active, user-invocable by default, scoped), s2 drops (inactive),
+       s3 drops (userInvocable: false). */
     expect(out.map((s) => s._id)).toEqual(['1']);
   });