vinhnx
diff --git a/Collapse file
‎.gitignore‎
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion b/Collapse file
‎.gitignore‎
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion
diff --git a/Collapse file
‎.vtcode/tool-policy.json‎
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion b/Collapse file
‎.vtcode/tool-policy.json‎
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion
diff --git a/Collapse file
‎vtcode-core/.vtcode/tool-policy.json‎
Copy file name to clipboard
+196Lines changed: 196 additions & 0 deletions b/Collapse file
‎vtcode-core/.vtcode/tool-policy.json‎
Copy file name to clipboard
+196Lines changed: 196 additions & 0 deletions
diff --git a/Collapse file
‎vtcode-core/src/llm/providers/huggingface.rs‎
Copy file name to clipboard
+44-15Lines changed: 44 additions & 15 deletions b/Collapse file
‎vtcode-core/src/llm/providers/huggingface.rs‎
Copy file name to clipboard
+44-15Lines changed: 44 additions & 15 deletions
@@ -784,7 +784,7 @@ TODO2.md
 .cursorignore
 .vtcode/index/
 .vtcode/checkpoints/
-.vtcode/
+.vtcode/skills/
 .claude/
 .agent/
 .pi/
@@ -50,7 +50,7 @@
     "web_fetch": "prompt",
     "write_file": "allow",
     "search_replace": "prompt",
-    "skill": "prompt",
+    "skill": "allow",
     "code_intelligence": "prompt",
     "mcp_convert_time": "prompt",
     "mcp_time_convert_time": "prompt",
 
@@ -0,0 +1,196 @@
+{
+  "version": 1,
+  "available_tools": [
+    "analyze_agent",
+    "apply_patch",
+    "close_pty_session",
+    "create_file",
+    "create_pty_session",
+    "debug_agent",
+    "delete_file",
+    "edit_file",
+    "execute_code",
+    "grep_file",
+    "list_files",
+    "list_pty_sessions",
+    "read_file",
+    "read_pty_session",
+    "resize_pty_session",
+    "run_pty_cmd",
+    "search_replace",
+    "search_tools",
+    "send_pty_input",
+    "skill",
+    "update_plan",
+    "web_fetch",
+    "write_file"
+  ],
+  "policies": {
+    "grep_file": "allow",
+    "update_plan": "allow",
+    "read_file": "allow",
+    "edit_file": "allow",
+    "analyze_agent": "allow",
+    "apply_patch": "allow",
+    "close_pty_session": "allow",
+    "create_file": "allow",
+    "create_pty_session": "allow",
+    "debug_agent": "allow",
+    "delete_file": "allow",
+    "execute_code": "allow",
+    "list_pty_sessions": "allow",
+    "read_pty_session": "allow",
+    "resize_pty_session": "allow",
+    "search_tools": "allow",
+    "send_pty_input": "allow",
+    "web_fetch": "allow",
+    "write_file": "allow",
+    "run_pty_cmd": "allow",
+    "list_files": "allow",
+    "search_replace": "prompt",
+    "skill": "prompt"
+  },
+  "constraints": {},
+  "mcp": {
+    "allowlist": {
+      "enforce": true,
+      "default": {
+        "tools": null,
+        "resources": null,
+        "prompts": null,
+        "logging": [
+          "mcp.provider_initialized",
+          "mcp.provider_initialization_failed",
+          "mcp.tool_filtered",
+          "mcp.tool_execution",
+          "mcp.tool_failed",
+          "mcp.tool_denied"
+        ],
+        "configuration": {
+          "client": [
+            "max_concurrent_connections",
+            "request_timeout_seconds",
+            "retry_attempts",
+            "startup_timeout_seconds",
+            "tool_timeout_seconds",
+            "experimental_use_rmcp_client"
+          ],
+          "server": [
+            "enabled",
+            "bind_address",
+            "port",
+            "transport",
+            "name",
+            "version"
+          ],
+          "ui": [
+            "mode",
+            "max_events",
+            "show_provider_names"
+          ]
+        }
+      },
+      "providers": {
+        "context7": {
+          "tools": [
+            "search_*",
+            "fetch_*",
+            "list_*",
+            "context7_*",
+            "get_*"
+          ],
+          "resources": [
+            "docs::*",
+            "snippets::*",
+            "repositories::*",
+            "context7::*"
+          ],
+          "prompts": [
+            "context7::*",
+            "support::*",
+            "docs::*"
+          ],
+          "logging": [
+            "mcp.tool_execution",
+            "mcp.tool_failed",
+            "mcp.tool_denied",
+            "mcp.tool_filtered",
+            "mcp.provider_initialized"
+          ],
+          "configuration": {
+            "context7": [
+              "workspace",
+              "search_scope",
+              "max_results"
+            ],
+            "provider": [
+              "max_concurrent_requests"
+            ]
+          }
+        },
+        "sequential-thinking": {
+          "tools": [
+            "plan",
+            "critique",
+            "reflect",
+            "decompose",
+            "sequential_*"
+          ],
+          "resources": null,
+          "prompts": [
+            "sequential-thinking::*",
+            "plan",
+            "reflect",
+            "critique"
+          ],
+          "logging": [
+            "mcp.tool_execution",
+            "mcp.tool_failed",
+            "mcp.tool_denied",
+            "mcp.tool_filtered",
+            "mcp.provider_initialized"
+          ],
+          "configuration": {
+            "provider": [
+              "max_concurrent_requests"
+            ],
+            "sequencing": [
+              "max_depth",
+              "max_branches"
+            ]
+          }
+        },
+        "time": {
+          "tools": [
+            "get_*",
+            "list_*",
+            "convert_timezone",
+            "describe_timezone",
+            "time_*"
+          ],
+          "resources": [
+            "timezone:*",
+            "location:*"
+          ],
+          "prompts": null,
+          "logging": [
+            "mcp.tool_execution",
+            "mcp.tool_failed",
+            "mcp.tool_denied",
+            "mcp.tool_filtered",
+            "mcp.provider_initialized"
+          ],
+          "configuration": {
+            "provider": [
+              "max_concurrent_requests"
+            ],
+            "time": [
+              "local_timezone_override"
+            ]
+          }
+        }
+      }
+    },
+    "providers": {}
+  }
+}
@@ -116,6 +116,7 @@ pub struct HuggingFaceProvider {
     http_client: HttpClient,
     base_url: String,
     model: String,
+    _timeouts: TimeoutsConfig,
 }
 
 impl HuggingFaceProvider {
@@ -132,35 +133,51 @@ impl HuggingFaceProvider {
         Self::with_model_internal(api_key, model, None, None)
     }
 
+    pub fn with_timeouts(api_key: String, timeouts: TimeoutsConfig) -> Self {
+        Self::with_model_internal(
+            api_key,
+            models::huggingface::DEFAULT_MODEL.to_string(),
+            None,
+            Some(timeouts),
+        )
+    }
+
     fn with_model_internal(
         api_key: String,
         model: String,
         base_url: Option<String>,
-        _prompt_cache: Option<PromptCachingConfig>,
+        timeouts: Option<TimeoutsConfig>,
     ) -> Self {
+        let timeouts = timeouts.unwrap_or_default();
+        let timeout = std::time::Duration::from_secs(timeouts.default_ceiling_seconds);
+        
         Self {
             api_key,
-            http_client: HttpClient::new(),
+            http_client: HttpClient::builder()
+                .timeout(timeout)
+                .build()
+                .unwrap_or_else(|_| HttpClient::new()),
             base_url: override_base_url(
                 urls::HUGGINGFACE_API_BASE,
                 base_url,
                 Some(env_vars::HUGGINGFACE_BASE_URL),
             ),
             model,
+            _timeouts: timeouts,
         }
     }
 
     pub fn from_config(
         api_key: Option<String>,
         model: Option<String>,
         base_url: Option<String>,
-        prompt_cache: Option<PromptCachingConfig>,
-        _timeouts: Option<TimeoutsConfig>,
+        _prompt_cache: Option<PromptCachingConfig>,
+        timeouts: Option<TimeoutsConfig>,
         _anthropic: Option<AnthropicConfig>,
     ) -> Self {
         let api_key_value = api_key.unwrap_or_default();
         let model_value = resolve_model(model, models::huggingface::DEFAULT_MODEL);
-        Self::with_model_internal(api_key_value, model_value, base_url, prompt_cache)
+        Self::with_model_internal(api_key_value, model_value, base_url, timeouts)
     }
 
     /// Behavior 10: Normalize and validate HuggingFace model IDs
@@ -797,6 +814,15 @@ impl HuggingFaceProvider {
             .map(|s| s.to_string())
             .collect()
     }
+    /// Behavior 14: Resolve API endpoint based on selected mode
+    fn get_endpoint(&self, use_responses_api: bool) -> String {
+        let base = self.base_url.trim_end_matches('/');
+        if use_responses_api {
+            format!("{}/responses", base)
+        } else {
+            format!("{}/chat/completions", base)
+        }
+    }
 }
 
 #[async_trait]
@@ -838,6 +864,8 @@ impl LLMProvider for HuggingFaceProvider {
         128_000 // Default context window
     }
 
+
+
     async fn generate(&self, mut request: LLMRequest) -> Result<LLMResponse, LLMError> {
         if request.model.trim().is_empty() {
             request.model = self.model.clone();
@@ -860,11 +888,7 @@ impl LLMProvider for HuggingFaceProvider {
         };
 
         // Make HTTP request
-        let endpoint = if use_responses_api {
-            format!("{}/responses", self.base_url.trim_end_matches('/'))
-        } else {
-            format!("{}/chat/completions", self.base_url.trim_end_matches('/'))
-        };
+        let endpoint = self.get_endpoint(use_responses_api);
 
         let response = self
             .http_client
@@ -901,11 +925,7 @@ impl LLMProvider for HuggingFaceProvider {
         };
 
         // Make HTTP request
-        let endpoint = if use_responses_api {
-            format!("{}/responses", self.base_url.trim_end_matches('/'))
-        } else {
-            format!("{}/chat/completions", self.base_url.trim_end_matches('/'))
-        };
+        let endpoint = self.get_endpoint(use_responses_api);
 
         let response = self
             .http_client
@@ -970,6 +990,15 @@ impl HuggingFaceProvider {
                 let text = String::from_utf8_lossy(&chunk);
                 buffer.push_str(&text);
 
+                // Behavior 15: Enforce maximum buffer size to prevent memory exhaustion
+                // from malformed streams without newlines.
+                if buffer.len() > 128_000 {
+                    Err(LLMError::Provider {
+                        message: format_llm_error(PROVIDER_NAME, "Stream buffer exceeded maximum size (128KB)"),
+                        metadata: None,
+                    })?;
+                }
+
                 // Process complete SSE events
                 while let Some(newline_pos) = buffer.find('\n') {
                     let line = buffer[..newline_pos].trim().to_string();