Proxy TrueFoundry skill catalog and return 424 on skill writes

[bhaveshpatel640]

Summary

TrueFoundry mode proxies the SFY skill catalog with the caller token. Settings skill writes return 424.

Closes AGE-2127

Changes

• GET /api/v1/skills and GET /api/v1/skills/{skill_id}/versions read SFY (caller JWT)
• Settings skill create/upsert → 424 in TrueFoundry mode
• Catalog wire: id, fqn (latest), ml_repo_name, name, description; versions: version (number) + fqn

How was this tested?

Unit tests: mapSfyAgentSkills, TrueFoundrySkillStore, skills API.

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed

---

Note

Medium Risk
Changes skill validation, turn-time resolution, and external SFY calls with caller/agent tokens; misconfiguration could break agent saves or skill mounting in TrueFoundry mode.

Overview
Adds TrueFoundry-managed skills: in TrueFoundry mode, GET /api/v1/skills and GET /api/v1/skills/versions are served from ServiceFoundry via a per-request TrueFoundrySkillStore (same token/vend pattern as models and MCP). Settings create/upsert skill calls return 424 when the catalog is externally managed.

Schema/API: SkillManifest is a discriminated git | truefoundry union; chat AvailableSkill can include metadata (display_name, repository_name, version). AgentSpec skills accept opaque FQN-style names, optional preload, and are capped at 50; git-backed stores reject preload.

Runtime: Skill storage is wired through resolveSkillStore (SQLite/Postgres git skills vs SFY). Agent save/turn paths use validateAgentSkills (git name lookup or SFY resolve). OpenAPI and trueforge-sdk add listVersions and 424 handling on settings skills.

UI: The builder maps catalog id (attach key) to wire name, surfaces display labels, and round-trips preload on session/agent admission.

^{Reviewed by Cursor Bugbot for commit 6142574. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 6142574

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@truefoundry/trueforge	Patch
@truefoundry/trueforge-core	Patch
@truefoundry/trueforge-ui	Patch
@truefoundry/trueforge-sdk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4ca386a. Configure here.}