@agent-native/core 0.114.15 → 0.115.1

package/src/jobs/tools.ts

@@ -18,6 +18,7 @@ import { isValidCron, nextOccurrence, describeCron } from "./cron.js";
 import {
   parseJobFrontmatter,
   buildJobContent,
+  normalizeJobMcpTools,
   type JobFrontmatter,
 } from "./scheduler.js";
 
@@ -106,6 +107,13 @@ async function runCreate(args: Record<string, any>): Promise<string> {
     });
   }
 
+  let mcpTools: string[] | undefined;
+  try {
+    mcpTools = normalizeJobMcpTools(args.mcpTools);
+  } catch (err) {
+    return JSON.stringify({ error: (err as Error).message });
+  }
+
   const owner = scope === "personal" ? getOwner() : getSharedOwner();
   const path = `jobs/${name}.md`;
   const now = new Date();
@@ -135,6 +143,7 @@ async function runCreate(args: Record<string, any>): Promise<string> {
     ...(typeof model === "string" && model.trim()
       ? { model: model.trim() }
       : {}),
+    ...(mcpTools?.length ? { mcpTools } : {}),
   };
 
   const content = buildJobContent(meta, instructions);
@@ -148,6 +157,7 @@ async function runCreate(args: Record<string, any>): Promise<string> {
     scheduleDescription: describeCron(schedule),
     nextRun: next.toISOString(),
     scope: scope || "shared",
+    ...(mcpTools?.length ? { mcpTools } : {}),
   });
 }
 
@@ -184,6 +194,7 @@ async function runList(args: Record<string, any>): Promise<string> {
         deliveryPlatform: meta.deliveryPlatform || null,
         deliveryDestination: meta.deliveryDestination || null,
         model: meta.model || null,
+        mcpTools: meta.mcpTools || [],
       };
     }),
   );
@@ -243,6 +254,16 @@ async function runUpdate(args: Record<string, any>): Promise<string> {
   }
   if (typeof model === "string" && model.trim()) meta.model = model.trim();
 
+  if (args.mcpTools !== undefined) {
+    try {
+      const mcpTools = normalizeJobMcpTools(args.mcpTools) ?? [];
+      if (mcpTools.length) meta.mcpTools = mcpTools;
+      else delete meta.mcpTools;
+    } catch (err) {
+      return JSON.stringify({ error: (err as Error).message });
+    }
+  }
+
   const newBody = instructions || body;
   const content = buildJobContent(meta, newBody);
   await resourcePut(resource.owner, resource.path, content);
@@ -254,6 +275,7 @@ async function runUpdate(args: Record<string, any>): Promise<string> {
     scheduleDescription: describeCron(meta.schedule),
     enabled: meta.enabled,
     nextRun: meta.nextRun,
+    mcpTools: meta.mcpTools || [],
   });
 }
 
@@ -295,7 +317,9 @@ Actions:
 - "update": Update a job's schedule, instructions, or enabled state. Requires name.
 - "delete": Delete a recurring job. Requires name. Always confirm with the user first.
 
-Cron format is 5 fields: minute hour day-of-month month day-of-week. Common patterns: '0 9 * * *' (daily 9am), '0 9 * * 1-5' (weekdays 9am), '0 * * * *' (every hour), '0 9 * * 1' (Mondays 9am), '*/30 * * * *' (every 30 min).`,
+Cron format is 5 fields: minute hour day-of-month month day-of-week. Common patterns: '0 9 * * *' (daily 9am), '0 9 * * 1-5' (weekdays 9am), '0 * * * *' (every hour), '0 9 * * 1' (Mondays 9am), '*/30 * * * *' (every 30 min).
+
+For jobs that use a connected MCP, pass the exact tool names in mcpTools. This binds only those tools to the background run; OAuth credentials remain in the connector and are resolved for the job's user/org context.`,
         parameters: {
           type: "object",
           properties: {
@@ -342,6 +366,12 @@ Cron format is 5 fields: minute hour day-of-month month day-of-week. Common patt
               description:
                 "Optional model id for this routine. The channel/app/engine default is used when omitted.",
             },
+            mcpTools: {
+              type: "array",
+              items: { type: "string" },
+              description:
+                'Optional explicit MCP capabilities for this job. Use the connected tool names exactly as advertised, for example ["mcp__meeting-notes__list_meetings", "mcp__meeting-notes__get_transcript"]. The job runs only with these tools; credentials remain in the connector.',
+            },
           },
           required: ["action"],
         },

package/src/localization/default-messages.ts

@@ -453,6 +453,7 @@ const messages = {
     cancel: "Cancel",
     recurringDetails: "Recurring job details",
     instructions: "Instructions",
+    mcpTools: "Connected MCP tools",
     automationsLoadError: "Could not load automations.",
     automationsEmpty: "No automations yet.",
     automationEventTrigger: "On {{event}}",

package/src/mcp-client/index.ts

@@ -166,6 +166,8 @@ import {
 
 export interface McpActionEntryOptions {
   invocationPolicy?: McpToolInvocationPolicy;
+  /** Restrict the generated entries to an explicit background capability set. */
+  toolNames?: readonly string[];
 }
 
 export function mcpToolsToActionEntries(
@@ -173,7 +175,11 @@ export function mcpToolsToActionEntries(
   options: McpActionEntryOptions = {},
 ): Record<string, ActionEntry> {
   const entries: Record<string, ActionEntry> = {};
+  const selectedToolNames = options.toolNames
+    ? new Set(options.toolNames)
+    : undefined;
   for (const tool of manager.getTools().filter(isVisibleToModel)) {
+    if (selectedToolNames && !selectedToolNames.has(tool.name)) continue;
     entries[tool.name] = mcpToolToActionEntry(manager, tool, options);
   }
   return entries;

package/src/provider-api/actions/provider-api.ts

@@ -177,7 +177,7 @@ export function createProviderApiRequestSchema(
       .string()
       .optional()
       .describe(
-        "Optional shared workspace connection id to use when the provider has multiple granted connections.",
+        "Shared workspace connection id to use when the provider has multiple granted connections. Required when provider-api-catalog marks requiresConnectionId.",
       ),
     accountId: z
       .string()

package/src/provider-api/index.ts

@@ -73,6 +73,7 @@ export const PROVIDER_API_IDS = [
   "granola",
   "grafana",
   "hubspot",
+  "salesforce",
   "jira",
   "mixpanel",
   "notion",
@@ -384,6 +385,7 @@ export interface ProviderApiConfig {
   id: ProviderApiId;
   label: string;
   defaultBaseUrl: string;
+  requiresConnectionId?: boolean;
   baseUrlCredentialKey?: string;
   auth: ProviderApiAuthKind;
   credentialKeys: readonly string[];
@@ -1212,6 +1214,43 @@ const PROVIDER_CONFIGS: Record<ProviderApiId, ProviderApiConfig> = {
       },
     ],
   },
+  salesforce: {
+    id: "salesforce",
+    label: "Salesforce",
+    defaultBaseUrl: "https://login.salesforce.com",
+    requiresConnectionId: true,
+    auth: {
+      type: "oauth-bearer",
+      oauthProvider: "salesforce",
+      tokenLabel: "Salesforce OAuth token",
+      workspaceProvider: "salesforce",
+    },
+    credentialKeys: ["SALESFORCE_OAUTH_ACCOUNT"],
+    docsUrls: [
+      "https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/",
+    ],
+    allowedHostSuffixes: [],
+    templateUses: ["analytics", "brain", "crm", "dispatch"],
+    examples: [
+      {
+        label: "List recent Accounts",
+        method: "GET",
+        path: "/services/data/v60.0/sobjects/Account",
+      },
+      {
+        label: "Query Opportunity records with SOQL",
+        method: "GET",
+        path: "/services/data/v60.0/query",
+        query: {
+          q: "SELECT Id, Name, StageName, Amount, CloseDate FROM Opportunity LIMIT 100",
+        },
+      },
+    ],
+    notes: [
+      "Workspace OAuth stores the Salesforce instance URL on the connection. Requests with a connectionId use that instance instead of the login host.",
+      "CRM templates own object allow-lists, field projections, and API-version selection.",
+    ],
+  },
   jira: {
     id: "jira",
     label: "Jira Cloud",
@@ -1574,6 +1613,7 @@ export function listProviderApiCatalog(
     id: config.id,
     label: config.label,
     defaultBaseUrl: config.defaultBaseUrl,
+    requiresConnectionId: config.requiresConnectionId ?? false,
     baseUrlCredentialKey: config.baseUrlCredentialKey ?? null,
     auth: describeAuth(config.auth),
     credentialKeys: config.credentialKeys,
@@ -1749,6 +1789,11 @@ export async function executeProviderApiRequest(
 
   // --- built-in provider path (original code) ---
   const config = builtIn!;
+  if (config.requiresConnectionId && !args.connectionId?.trim()) {
+    throw new Error(
+      `${config.label} Provider API requests require a workspace connectionId.`,
+    );
+  }
   const ctx = requireRuntimeCredentialContext(
     runtime,
     config.credentialKeys[0] ?? config.id,
@@ -1951,9 +1996,9 @@ export async function executeProviderApiRequest(
 }
 
 /**
- * Resolve a provider OAuth token for a trusted server-side UI bridge such as
- * Google Picker. Callers must keep the result out of agent, MCP, A2A, logs,
- * persistence, and extension/tool surfaces.
+ * Resolve a provider OAuth token for a trusted server-side integration bridge
+ * such as a CRM adapter or Google Picker. Callers must keep the result out of
+ * agent, MCP, A2A, logs, persistence, and extension/tool surfaces.
  */
 export async function resolveProviderApiOAuthAccessToken(
   args: {
@@ -3304,7 +3349,9 @@ async function resolveWorkspaceOAuthBaseUrl(
     auth.type === "oauth-bearer-or-basic"
       ? auth.workspaceProvider
       : undefined;
-  if (workspaceProvider !== "jira") return null;
+  if (workspaceProvider !== "jira" && workspaceProvider !== "salesforce") {
+    return null;
+  }
   let resolved: Awaited<ReturnType<typeof resolveWorkspaceConnectionForApp>>;
   try {
     resolved = await resolveWorkspaceConnectionForApp({
@@ -3325,11 +3372,33 @@ async function resolveWorkspaceOAuthBaseUrl(
   if (!resolved.available || !resolved.connection) return null;
   const connectionConfig = resolved.connection.config;
   if (connectionConfig.credentialMode !== "oauth") return null;
-  const baseUrl = connectionConfig.atlassianApiBaseUrl;
+  const baseUrl =
+    workspaceProvider === "salesforce"
+      ? connectionConfig.salesforceInstanceUrl
+      : connectionConfig.atlassianApiBaseUrl;
   if (typeof baseUrl !== "string" || !baseUrl.trim()) return null;
+  if (workspaceProvider === "salesforce" && !isSalesforceInstanceUrl(baseUrl)) {
+    return null;
+  }
   return baseUrl.replace(/\/+$/, "");
 }
 
+function isSalesforceInstanceUrl(value: string): boolean {
+  try {
+    const url = new URL(value);
+    const host = url.hostname.toLowerCase();
+    return (
+      url.protocol === "https:" &&
+      !url.username &&
+      !url.password &&
+      !url.port &&
+      (host === "salesforce.com" || host.endsWith(".salesforce.com"))
+    );
+  } catch {
+    return false;
+  }
+}
+
 async function resolvePlaceholders(
   config: ProviderApiConfig,
   runtime: ProviderApiRuntimeOptions,
@@ -4024,6 +4093,7 @@ async function resolveOAuthBearerToken(options: {
   ctx: CredentialContext;
   accountId?: string | null;
   ownerEmail?: string | null;
+  salesforceLoginUrl?: string | null;
 }): Promise<ProviderApiResolvedCredential> {
   const ownerEmail = options.ownerEmail?.trim() || options.ctx.userEmail;
   const accounts = await listOAuthAccountsByOwner(
@@ -4050,6 +4120,7 @@ async function resolveOAuthBearerToken(options: {
     accountId: account.accountId,
     ownerEmail,
     tokens,
+    salesforceLoginUrl: options.salesforceLoginUrl,
   });
   return {
     key: `${options.auth.oauthProvider.toUpperCase()}_OAUTH_TOKEN`,
@@ -4126,6 +4197,11 @@ async function resolveOptionalConnectionBoundOAuthBearerToken(options: {
     ctx: options.ctx,
     accountId: connectionAccountId,
     ownerEmail: resolved.connection.ownerEmail,
+    salesforceLoginUrl:
+      options.auth.oauthProvider === "salesforce" &&
+      typeof resolved.connection.config?.salesforceLoginUrl === "string"
+        ? resolved.connection.config.salesforceLoginUrl
+        : null,
   });
   return {
     ...credential,
@@ -4139,6 +4215,7 @@ async function getValidOAuthAccessToken(options: {
   accountId: string;
   ownerEmail: string;
   tokens: OAuthTokens;
+  salesforceLoginUrl?: string | null;
 }): Promise<string> {
   const accessToken =
     options.tokens.access_token ?? options.tokens.accessToken ?? "";
@@ -4177,6 +4254,9 @@ async function getValidOAuthAccessToken(options: {
   if (options.oauthProvider === "hubspot") {
     return refreshHubSpotOAuthToken(options, refreshToken);
   }
+  if (options.oauthProvider === "salesforce") {
+    return refreshSalesforceOAuthToken(options, refreshToken);
+  }
   if (options.oauthProvider === "jira") {
     return refreshJiraOAuthToken(options, refreshToken);
   }
@@ -4484,6 +4564,102 @@ async function refreshHubSpotOAuthToken(
   return data.access_token;
 }
 
+async function refreshSalesforceOAuthToken(
+  options: {
+    oauthProvider: string;
+    accountId: string;
+    ownerEmail: string;
+    tokens: OAuthTokens;
+    salesforceLoginUrl?: string | null;
+  },
+  refreshToken: string,
+): Promise<string> {
+  const credentials =
+    await resolveOAuthClientCredentialCandidates("SALESFORCE");
+  if (!credentials.length) {
+    throw new Error(
+      "SALESFORCE_CLIENT_ID/SECRET not set for Salesforce OAuth refresh.",
+    );
+  }
+
+  let response: Response | null = null;
+  let data: {
+    access_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+    token_type?: string;
+  } = {};
+  for (const credential of credentials) {
+    const result = await fetchBoundedOAuthRefreshJson<{
+      access_token?: string;
+      refresh_token?: string;
+      expires_in?: number;
+      token_type?: string;
+    }>(
+      salesforceOAuthRefreshUrl(options.salesforceLoginUrl),
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          client_id: credential.clientId,
+          client_secret: credential.clientSecret,
+          refresh_token: refreshToken,
+        }),
+      },
+      "Salesforce",
+    );
+    response = result.response;
+    data = result.data;
+    if (response.ok && data.access_token) break;
+  }
+
+  if (!response?.ok || !data.access_token) {
+    throw new Error(
+      `Salesforce OAuth refresh failed (${response?.status ?? 0}).`,
+    );
+  }
+  const updated = {
+    ...options.tokens,
+    access_token: data.access_token,
+    refresh_token: data.refresh_token ?? refreshToken,
+    token_type: data.token_type ?? options.tokens.token_type,
+    ...(Number.isFinite(data.expires_in) && (data.expires_in ?? 0) > 0
+      ? { expiry_date: Date.now() + (data.expires_in as number) * 1_000 }
+      : {}),
+  };
+  await saveOAuthTokens(
+    options.oauthProvider,
+    options.accountId,
+    updated as unknown as Record<string, unknown>,
+    options.ownerEmail,
+  );
+  return data.access_token;
+}
+
+function salesforceOAuthRefreshUrl(value: string | null | undefined): string {
+  const loginUrl = value?.trim() || "https://login.salesforce.com";
+  try {
+    const url = new URL(loginUrl);
+    if (
+      url.protocol !== "https:" ||
+      url.username ||
+      url.password ||
+      url.port ||
+      url.pathname !== "/" ||
+      url.search ||
+      url.hash ||
+      (url.hostname !== "login.salesforce.com" &&
+        url.hostname !== "test.salesforce.com")
+    ) {
+      throw new Error("Invalid Salesforce OAuth login URL.");
+    }
+    return `${url.origin}/services/oauth2/token`;
+  } catch {
+    throw new Error("Invalid Salesforce OAuth login URL.");
+  }
+}
+
 async function refreshJiraOAuthToken(
   options: {
     oauthProvider: string;
@@ -4796,6 +4972,15 @@ async function resolveOAuthClientCredentialCandidates(
   ].filter((value): value is { clientId: string; clientSecret: string } =>
     Boolean(value),
   );
+  if (provider === "SALESFORCE") {
+    const [consumerKey, consumerSecret] = await Promise.all([
+      resolveSecret("SALESFORCE_CONSUMER_KEY"),
+      resolveSecret("SALESFORCE_CONSUMER_SECRET"),
+    ]);
+    if (consumerKey && consumerSecret) {
+      candidates.push({ clientId: consumerKey, clientSecret: consumerSecret });
+    }
+  }
   const seen = new Set<string>();
   return candidates.filter((candidate) => {
     if (seen.has(candidate.clientId)) return false;

package/src/secrets/register-framework-secrets.ts

@@ -48,6 +48,14 @@ export function registerFrameworkSecrets(): void {
       docsUrl:
         "https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/oauth/oauth-quickstart-guide",
     },
+    {
+      id: "salesforce",
+      credentialPrefix: "SALESFORCE",
+      oauthProvider: "salesforce",
+      label: "Salesforce",
+      docsUrl:
+        "https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_understanding_web_server_oauth_flow.htm",
+    },
     {
       id: "jira",
       credentialPrefix: "JIRA",

package/src/server/agent-chat/context-tools.ts

@@ -97,6 +97,15 @@ Convert natural language to 5-field cron format:
 - "every hour" → \`0 * * * *\`
 - "every monday at 9am" → \`0 9 * * 1\`
 
+When a recurring job needs a connected MCP, discover the exact MCP tool names
+available in the current user/org context and pass them in the create call's
+\`mcpTools\` array. Bind only the tools the job needs; do not put an MCP URL,
+OAuth token, or arbitrary endpoint in the instructions. The scheduler resolves
+the selected tools with the job owner's existing connector grant and fails
+clearly if a connector is revoked or a selected tool disappears. For imports,
+normalize the provider response and call the app's bounded idempotent import
+action once with the full batch rather than issuing one write per item.
+
 #### Suggesting "Save as automation"
 
 When you finish a task that has obvious recurring value — daily inbox triage, weekly metrics summaries, archive sweeps, status digests, anything the user would plausibly want re-run on a fresh cadence — close the response with ONE short line offering to save it. Examples:

package/src/server/agent-chat/framework-prompts.ts

@@ -74,7 +74,7 @@ Keep \`create-extension\` payloads compact enough to finish quickly. For complex
 
 Generated UI content can use appAction(), appFetch(), dbQuery(), extensionFetch(), extensionData, agentNative.ui.output(value, opts?), and agentNative.chat.send(...)/sendToAgentChat(...). Use appAction() for app data writes, and dbQuery() only for read-only inspection of known app SQL tables. It can receive chat inputs through slotContext/window.onSlotContext. Use agentNative.ui.output for passive current values from knobs, sliders, selections, and controls; it writes application state at \`inline-ui:<extensionId>:output\` scoped to the inline extension id returned by \`render-inline-extension\` or \`show-extension-inline\`. When the user later says "use that value", "apply the current setting", or similar, read it with \`readAppState("inline-ui:<id>:output")\` instead of asking them to send it again. Use agentNative.chat.send for visible submit/apply actions that should put a message into chat. Transient extensionData is browser-local and not agent-readable, synced, promoted, or garbage-collected; use application_state/appFetch, appAction, ui.output, or chat.send for anything the agent or app must observe. Use semantic Tailwind classes like bg-background, text-foreground, bg-primary, border-border, and text-muted-foreground so the UI inherits the parent app theme.
 
-If the user asks to change, edit, fix, style, rename, or add behavior to an existing extension/widget/dashboard/calculator/mini-app, use the current extension id from \`<current-screen>\` or \`<current-url>\` when present. Call \`get-extension\` only if you need to inspect its content, then \`update-extension\` with that id. After one content read, keep the body in working memory and move to focused \`update-extension\` \`edits\`/\`patches\`; do not loop on repeated \`get-extension\` + \`run-code\` string scans before writing. For a data-only repair, preserve the existing layout, CSS, copy, and interactions: never send a reconstructed full \`content\` body. The update action blocks full-body replacement by default; use \`allowFullReplacement=true\` only when the user explicitly requests a broad visual rewrite or supplies a complete replacement body. If a focused patch fails, read the current body and change the target rather than retrying identical arguments. Use \`list-extensions\` only when no current id/name is available. Existing extension edits are SQL data updates, not source-code changes, even when the request says "change the UI" or "fix this". Do **NOT** call \`connect-builder\` for existing extension edits.
+If the user asks to change, edit, fix, style, rename, or add behavior to an existing extension/widget/dashboard/calculator/mini-app, use the current extension id from \`<current-screen>\` or \`<current-url>\` when present. Call \`get-extension\` only if you need to inspect its content, then call \`update-extension\` with exactly \`id\`, \`operation\`, and \`payloadJson\`; encode the operation payload as a JSON string and never send empty placeholder fields. After one content read, keep the body in working memory and use \`operation="edit"\` with focused \`edits\`/\`patches\` inside \`payloadJson\`; do not loop on repeated \`get-extension\` + \`run-code\` string scans before writing. For a data-only repair, preserve the existing layout, CSS, copy, and interactions. Use \`operation="replace"\` only when the user explicitly requests a broad visual rewrite or supplies a complete replacement body. Use \`operation="metadata"\` for name/description/icon, and use \`set-resource-visibility\` for sharing changes. If a focused patch fails, read the current body and change the target rather than retrying identical arguments. Use \`list-extensions\` only when no current id/name is available. Existing extension edits are SQL data updates, not source-code changes, even when the request says "change the UI" or "fix this". Do **NOT** call \`connect-builder\` for existing extension edits.
 
 In Act mode, when in doubt — if the request asks for a new small interactive utility and does not need reuse, choose \`render-inline-extension\`; if it mentions saving/reuse or asks for an extension/widget/dashboard/calculator/mini-app, choose \`create-extension\`. If it references an existing one or the current extension page, choose \`update-extension\`. Do **not** preface the call with planning text like "let me build the dashboard…" — just call the right extension action directly.
 
@@ -115,7 +115,7 @@ Keep the first \`create-extension\` call compact and working. If the request is
 
 Generated UI can read chat inputs from slotContext/window.onSlotContext, see/update app state through appFetch/appAction, use extensionData, record passive current values through agentNative.ui.output(value, opts?), and send visible results through agentNative.chat.send(...) or sendToAgentChat(...). ui.output writes \`inline-ui:<extensionId>:output\` in application state; when the user asks to use the current slider/selection/value, read \`readAppState("inline-ui:<id>:output")\`. Transient extensionData is browser-local only, so do not rely on it for values the agent or app must observe. Use semantic Tailwind theme classes.
 
-If the user asks to change, edit, fix, style, rename, or add behavior to an existing extension/widget/dashboard/calculator/mini-app, use the current extension id from \`<current-screen>\` or \`<current-url>\` when present. Call \`get-extension\` only if you need to inspect its content, then \`update-extension\` with that id. After one content read, use focused \`update-extension\` \`edits\`/\`patches\`; do not repeatedly re-read and scan the same HTML with \`run-code\` before writing. For a data-only repair, preserve the existing layout, CSS, copy, and interactions: never send a reconstructed full \`content\` body. The update action blocks full-body replacement by default; use \`allowFullReplacement=true\` only when the user explicitly requests a broad visual rewrite or supplies a complete replacement body. If a focused patch fails, read the current body and change the target rather than retrying identical arguments. Use \`list-extensions\` only when no current id/name is available. Existing extension edits are SQL data updates, not source-code changes. Do NOT call \`connect-builder\` for them.
+If the user asks to change, edit, fix, style, rename, or add behavior to an existing extension/widget/dashboard/calculator/mini-app, use the current extension id from \`<current-screen>\` or \`<current-url>\` when present. Call \`get-extension\` only if you need to inspect its content, then call \`update-extension\` with exactly \`id\`, \`operation\`, and \`payloadJson\`; encode the operation payload as a JSON string and never send empty placeholder fields. After one content read, use \`operation="edit"\` with focused \`edits\`/\`patches\` inside \`payloadJson\`; do not repeatedly re-read and scan the same HTML with \`run-code\` before writing. For a data-only repair, preserve the existing layout, CSS, copy, and interactions. Use \`operation="replace"\` only when the user explicitly requests a broad visual rewrite or supplies a complete replacement body. Use \`operation="metadata"\` for name/description/icon, and use \`set-resource-visibility\` for sharing changes. If a focused patch fails, read the current body and change the target rather than retrying identical arguments. Use \`list-extensions\` only when no current id/name is available. Existing extension edits are SQL data updates, not source-code changes. Do NOT call \`connect-builder\` for them.
 
 For existing extensions, use \`get-extension\` or \`update-extension\` directly when \`<current-screen>\` or \`<current-url>\` provides an \`extensionId\`. Use \`list-extensions\` only to browse or resolve an unknown name. Use \`hide-extension\` when the user wants a shared extension removed only from their own view. Do not query the legacy \`tools\` table directly.
 

package/src/server/agent-chat-plugin.ts

@@ -124,6 +124,7 @@ import {
   verifyInternalToken,
   extractBearerToken,
 } from "../integrations/internal-token.js";
+import type { RecurringJobContext } from "../jobs/scheduler.js";
 import {
   McpClientManager,
   loadMcpConfig,
@@ -575,6 +576,22 @@ export function createAgentChatPlugin(
       }
       setGlobalMcpManager(mcpManager);
       const mcpActionEntries = mcpToolsToActionEntries(mcpManager);
+      const getJobMcpActionEntries = (
+        job?: RecurringJobContext,
+      ): Record<string, ActionEntry> => {
+        const requested = job?.meta.mcpTools ?? [];
+        if (requested.length === 0) return {};
+        const entries = mcpToolsToActionEntries(mcpManager, {
+          toolNames: requested,
+        });
+        const missing = requested.filter((toolName) => !entries[toolName]);
+        if (missing.length > 0) {
+          throw new Error(
+            `Configured MCP tools are unavailable in this run: ${missing.join(", ")}. Reconnect the MCP server or update the job's capability list.`,
+          );
+        }
+        return entries;
+      };
 
       // Mount status + management routes so the settings UI can list / add /
       // remove remote MCP servers and hot-reload the running manager.
@@ -2632,6 +2649,7 @@ export function createAgentChatPlugin(
       // through the settings UI). getEngineTools() in production-agent re-reads
       // the registry per request, so updates here propagate without restart.
       mcpManager.onChange(() => {
+        syncMcpActionEntries(mcpManager, mcpActionEntries);
         syncMcpActionEntries(mcpManager, prodActions);
       });
 
@@ -5524,7 +5542,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
           const { processRecurringJobs } = await import("../jobs/scheduler.js");
 
           const schedulerDeps = {
-            getActions: () => ({
+            getActions: (job?: RecurringJobContext) => ({
               ...templateScripts,
               ...resourceScripts,
               ...docsScripts,
@@ -5537,6 +5555,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               ...fetchTool,
               ...webSearchTool,
               ...toolActions,
+              ...getJobMcpActionEntries(job),
             }),
             getSystemPrompt: async (owner: string) => {
               const resources = await loadResourcesForPrompt(
@@ -5557,10 +5576,11 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // first request on the same compact surface as interactive chat
             // instead of the full jobTools/automationTools/notificationTools/
             // fetchTool/webSearchTool/toolActions catalog every tick.
-            getInitialToolNames: () => [
+            getInitialToolNames: (job?: RecurringJobContext) => [
               ...effectiveInitialToolNames,
               "manage-jobs",
               "manage-progress",
+              ...(job?.meta.mcpTools ?? []),
             ],
             apiKey: options?.apiKey,
             model: options?.model,

package/src/server/core-routes-plugin.ts

@@ -1233,6 +1233,7 @@ export function createCoreRoutesPlugin(
         "google_drive",
         "github",
         "hubspot",
+        "salesforce",
         "jira",
         "sentry",
         "notion",

package/src/server/credential-provider.ts

@@ -75,6 +75,9 @@ export function readDeployCredentialEnv(key: string): string | undefined {
 
 const APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([
   "ANTHROPIC_API_KEY",
+  "EMAIL_FROM",
+  "EMAIL_INBOUND_WEBHOOK_SECRET",
+  "EMAIL_AGENT_ADDRESS",
   "OPENAI_API_KEY",
   "OPENAI_BASE_URL",
   "OPENROUTER_API_KEY",
@@ -84,6 +87,8 @@ const APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([
   "GROQ_API_KEY",
   "MISTRAL_API_KEY",
   "COHERE_API_KEY",
+  "RESEND_API_KEY",
+  "SENDGRID_API_KEY",
 ]);
 
 function isAppProvidedDeployCredentialKey(key: string | undefined): boolean {
@@ -97,9 +102,10 @@ function isAppProvidedDeployCredentialKey(key: string | undefined): boolean {
  * identity-bearing provider keys so one deploy key does not silently
  * impersonate another tenant. App-provided service credentials are different:
  * they configure the deployed app itself rather than identifying a user. This
- * includes LLM keys that let the app developer pay for model usage and OAuth
- * client credentials whose per-user identity remains in scoped OAuth tokens.
- * Key-aware callers may use those env vars.
+ * includes LLM keys that let the app developer pay for model usage, email
+ * transport configuration owned by the deployment, and OAuth client
+ * credentials whose per-user identity remains in scoped OAuth tokens. Key-aware
+ * callers may use those env vars.
  *
  * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic
  * provider secrets. This stricter helper remains for legacy call sites with