fix(agent): enforce managed app contracts

[iamjr15]

Why

Production app-builder QA showed that managed runs still advertised code_start_dev_server through Mastra client tools, models attempted to replace the prepared Next.js template with Vite, and otherwise valid browser actions failed because placeholder null fields were mandatory. These behaviors wasted run time and could leave verification incomplete.

What changed

• filter the provider-facing clientTools registry itself for managed and skill-creator runs
• use one method-specific browser action schema for provider and driver boundaries
• reject Vite entrypoints, framework manifest replacement, alternate package managers, redundant installs, and direct server starts only for managed templates
• retain source editing, explicit pnpm add/pnpm remove, builds, and all imported-repository capabilities
• align agent instructions and architecture documentation with the enforced contract

Verification

• pnpm lint
• pnpm typecheck
• pnpm turbo build --force
• pnpm deadcode
• pnpm architecture:check
• pnpm turbo skills:build
• generated-schema checks: click/fill accepted; timeout-only and missing-value calls rejected
• production browser QA will be repeated against the exact merged/deployed SHA before handoff

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
cheatcode	Skipped		Aug 12, 2026 8:53pm