@agent-native/core 0.210.1-nightly-20261020093350 → 0.210.1

package/dist/mcp-client/oauth-routes.js

@@ -1,5 +1,7 @@
 import crypto from "node:crypto";
 import { deleteCookie, defineEventHandler, getMethod, getQuery, getRequestHeader, setChunkedCookie, setResponseStatus, } from "h3";
+import { mcpSettingsMessagesForLocale } from "../localization/mcp-settings-messages.js";
+import { resolveLocaleFromRequest } from "../localization/server.js";
 import { encryptSecretValue } from "../secrets/crypto.js";
 import { CredentialStoreUnavailableError, resolveSecretPairs, } from "../server/credential-provider.js";
 import { getH3App } from "../server/framework-request-handler.js";
@@ -17,7 +19,8 @@ import { normalizeMcpPrincipal } from "./principal.js";
 import { addOAuthRemoteServer, listRemoteServers, normalizeServerName, replaceOAuthRemoteServer, validateRemoteUrl, } from "./remote-store.js";
 const getOrgContext = (...args) => import("../org/context.js").then(({ getOrgContext }) => getOrgContext(...args));
 function safeReturnPath(raw) {
-    return normalizeAppPath(raw) ?? "/";
+    const basePath = getAppBasePath();
+    return normalizeAppPath(raw, basePath) ?? (basePath || "/");
 }
 async function getSessionForEvent(event) {
     const { getSession } = await import("../server/auth.js");
@@ -214,7 +217,15 @@ async function handleMcpOAuthStart(event) {
     }
     if (managedMcpOAuthClientFor(urlCheck.url)?.requireClientCredentials &&
         !clientInformation) {
-        return refuse(event, 400, MCP_OAUTH_MANAGED_CLIENT_MISSING_MESSAGE);
+        return mcpOAuthStartFailureResponse(event, {
+            status: 400,
+            body: { error: MCP_OAUTH_MANAGED_CLIENT_MISSING_MESSAGE },
+        }, {
+            backHref: safeReturnPath(returnUrl || `${getAppBasePath()}/settings/integrations`),
+            backLabel: mcpSettingsMessagesForLocale(resolveLocaleFromRequest({
+                acceptLanguage: getRequestHeader(event, "accept-language"),
+            }).locale).mcpOAuthBackToApp,
+        });
     }
     // A pre-registered client has a fixed redirect URI on the shared workspace
     // callback. A dynamically registered client registers whatever URI this
@@ -350,12 +361,12 @@ function authorizationServerLabel(error) {
         return raw;
     }
 }
-export function mcpOAuthStartFailureResponse(event, failure) {
+export function mcpOAuthStartFailureResponse(event, failure, htmlOptions) {
     if (!wantsHtmlResponse(event)) {
         setResponseStatus(event, failure.status);
         return failure.body;
     }
-    return withStagedCookies(event, oauthErrorPage(failure.body.error, failure.status));
+    return withStagedCookies(event, oauthErrorPage(failure.body.error, failure.status, htmlOptions));
 }
 function refuse(event, status, error) {
     return mcpOAuthStartFailureResponse(event, { status, body: { error } });

package/dist/notifications/routes.d.ts

@@ -1,13 +1,13 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated: number;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated?: undefined;
@@ -16,6 +16,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/org/index.d.ts

@@ -164,8 +164,8 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     name?: undefined;
     success: boolean;
-    role?: undefined;
     id?: undefined;
+    role?: undefined;
 } | {
     success?: undefined;
     id: string;

package/dist/progress/routes.d.ts

@@ -2,6 +2,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,6 +75,7 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
+    provider?: undefined;
     id?: undefined;
     deleted?: undefined;
     found?: undefined;
@@ -88,46 +89,45 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    provider?: undefined;
     registered?: undefined;
     label?: undefined;
     message?: undefined;
 } | {
     id?: undefined;
+    count?: undefined;
     deleted?: undefined;
     providers?: undefined;
-    count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
     message?: undefined;
 } | {
+    provider?: undefined;
+    count?: undefined;
     deleted?: undefined;
     providers?: undefined;
-    count?: undefined;
-    provider?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
     message?: undefined;
 } | {
+    provider?: undefined;
+    count?: undefined;
     found?: undefined;
     providers?: undefined;
-    count?: undefined;
-    provider?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
     message?: undefined;
 } | {
+    provider?: undefined;
+    count?: undefined;
     deleted?: undefined;
     found?: undefined;
     providers?: undefined;
-    count?: undefined;
-    provider?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -316,10 +316,10 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        message?: undefined;
-        deleted?: undefined;
         id?: undefined;
         provider?: undefined;
+        message?: undefined;
+        deleted?: undefined;
         found?: undefined;
         providers: {
             id: string;
@@ -334,41 +334,41 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         registered?: undefined;
         label?: undefined;
     } | {
+        id?: undefined;
+        count?: undefined;
         message?: undefined;
         deleted?: undefined;
-        id?: undefined;
         providers?: undefined;
-        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
     } | {
+        provider?: undefined;
+        count?: undefined;
         message?: undefined;
         deleted?: undefined;
-        provider?: undefined;
         providers?: undefined;
-        count?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
     } | {
-        message?: undefined;
         provider?: undefined;
+        count?: undefined;
+        message?: undefined;
         found?: undefined;
         providers?: undefined;
-        count?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
     } | {
-        deleted?: undefined;
         provider?: undefined;
+        count?: undefined;
+        deleted?: undefined;
         found?: undefined;
         providers?: undefined;
-        count?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/secrets/register-framework-secrets.js

@@ -203,6 +203,31 @@ export function registerFrameworkSecrets() {
             docsUrl: "https://developers.notion.com/docs/authorization",
         },
     ];
+    const hubspotMcpAuthAppDocsUrl = "https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server";
+    for (const credential of [
+        { key: "HUBSPOT_MCP_CLIENT_ID", label: "HubSpot MCP OAuth client ID" },
+        {
+            key: "HUBSPOT_MCP_CLIENT_SECRET",
+            label: "HubSpot MCP OAuth client secret",
+        },
+    ]) {
+        registerSecretUsage(credential.key, [
+            {
+                feature: "HubSpot MCP connections",
+                effectWhenRemoved: "Workspace members cannot start new HubSpot MCP connections.",
+            },
+        ]);
+        if (!getRequiredSecret(credential.key)) {
+            registerRequiredSecret({
+                ...credential,
+                description: "Workspace-managed HubSpot MCP Auth App credential. Each member authorizes their own HubSpot account separately.",
+                docsUrl: hubspotMcpAuthAppDocsUrl,
+                scope: "workspace",
+                kind: "api-key",
+                required: false,
+            });
+        }
+    }
     for (const provider of workspaceOAuthProviders) {
         const prefix = provider.credentialPrefix;
         for (const credential of [

package/dist/secrets/routes.d.ts

@@ -65,31 +65,31 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     status?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     errorCode?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     error: string;
     removed?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
     note?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -117,11 +117,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/action-discovery.js

@@ -386,6 +386,8 @@ export const ALWAYS_ON_CORE_ACTIONS = new Set([
     "upload-image",
     "list-mcp-tools",
     "call-mcp-tool",
+    // Connection setup UI needs the workspace prerequisite even in minimal apps.
+    "get-managed-mcp-oauth-readiness",
     "get-agentkit-capabilities",
     "get-hosted-harness-config",
     "set-hosted-harness-enabled",
@@ -750,6 +752,10 @@ export function coreActionLoaderEntries() {
             "get-auth-methods",
             () => import("../user-profile/actions/get-auth-methods.js"),
         ],
+        [
+            "get-managed-mcp-oauth-readiness",
+            () => import("../mcp-client/actions/get-managed-mcp-oauth-readiness.js"),
+        ],
         ["set-password", () => import("../user-profile/actions/set-password.js")],
         [
             "change-password",

package/dist/server/agent-chat-plugin.js

@@ -20,11 +20,11 @@ import { SYSTEM_PROMPT_CACHE_SPLIT } from "../agent/engine/prompt-cache.js";
 import { PROVIDER_TO_ENV } from "../agent/engine/provider-env-vars.js";
 import { currentExecutionFence, withExecutionFence, } from "../agent/execution-fence.js";
 import { hostedHarnessSystemPrompt } from "../agent/harness/hosted.js";
-import { createProductionAgentHandler, endsAtContinuationBoundary, actionsToEngineTools, executeAgentToolCall, filterActionsByAllowedNames, normalizeAgentActionSurfaceResolution, getActiveRunForThreadAsync, abortRunDurably, abortRunAtSafeBoundaryDurably, abortTurnByRefDurably, abortTurnDurably, subscribeToRun, } from "../agent/production-agent.js";
+import { createProductionAgentHandler, endsAtContinuationBoundary, actionsToEngineTools, executeAgentToolCall, filterActionsByAllowedNames, normalizeAgentActionSurfaceResolution, getActiveRunForThreadAsync, abortRunDurably, abortRunAndTurnDurably, abortRunAtSafeBoundaryDurably, abortTurnByRefDurably, abortTurnDurably, subscribeToRun, } from "../agent/production-agent.js";
 import { applyProviderModelSelection, providerForEngineName, resolveProviderModelSelectionAtScope, } from "../agent/provider-model-selection.js";
 import { startRun } from "../agent/run-manager.js";
 import { callerHasRunAccess, callerHasThreadAccess, } from "../agent/run-ownership.js";
-import { readBackgroundRunClaim } from "../agent/run-store.js";
+import { getRunById, readBackgroundRunClaim } from "../agent/run-store.js";
 import { buildAssistantMessageFromRunJournal } from "../agent/run-thread-projector.js";
 import { buildCurrentTimeUserContext, buildRuntimeContextPrompt, } from "../agent/runtime-context.js";
 import { buildAssistantMessage, buildUserMessage, applySubmittedUserMessage, containsInlineAttachmentPayload, foldAgentChatRunCompletion, extractThreadMeta, foldUnstartedTurnFailure, mergeThreadDataForClientSave, } from "../agent/thread-data-builder.js";
@@ -33,7 +33,7 @@ import { attachToolSearch } from "../agent/tool-search.js";
 import { getAppConfig } from "../app-config/index.js";
 import { readAppStateForCurrentTab } from "../application-state/script-helpers.js";
 import { runChatThreadDataMigrations } from "../chat-threads/migrations.js";
-import { InlineAttachmentDataNotPersistableError, QueuedSubmissionAdmissionError, adoptThreadScopeIfUnscoped, blockQueuedSubmissionReceipt, createThread, forkThread, getThread, getQueuedSubmissionReceipt, listQueuedSubmissionReceipts, markQueuedSubmissionSubmitted, queuedSubmissionBehaviorMatches, registerChatThreadsShareable, retryQueuedSubmissionReceipt, resolveRunThreadScope, resolveThreadAccess, listThreads, searchThreads, renameThread, createThreadShareLink, getThreadByShareToken, getThreadShareState, revokeThreadShareLink, setThreadArchived, setThreadPinned, setThreadScope, updateThreadData, withThreadDataLock, deleteThread, mutateThreadQueuedMessages, setThreadSourceIfMissing, isAppOwnedChatScope, threadScopeMismatch, } from "../chat-threads/store.js";
+import { InlineAttachmentDataNotPersistableError, QueuedSubmissionAdmissionError, adoptThreadScopeIfUnscoped, blockQueuedSubmissionReceipt, clearQueuedSubmissionInterruptRun, createThread, forkThread, getThread, getQueuedSubmissionReceipt, listQueuedSubmissionReceipts, markQueuedSubmissionSubmitted, queuedSubmissionBehaviorMatches, recordQueuedSubmissionInterruptRun, renewQueuedSubmissionInterruptClaim, registerChatThreadsShareable, retryQueuedSubmissionReceipt, resolveRunThreadScope, resolveThreadAccess, listThreads, searchThreads, renameThread, createThreadShareLink, getThreadByShareToken, getThreadShareState, revokeThreadShareLink, setThreadArchived, setThreadPinned, setThreadScope, updateThreadData, withThreadDataLock, deleteThread, mutateThreadQueuedMessages, setThreadSourceIfMissing, isAppOwnedChatScope, threadScopeMismatch, } from "../chat-threads/store.js";
 import { isCheckpointRestorePath } from "../checkpoints/route-match.js";
 import { createDbAdminAgentTools } from "../db-admin/agent-tools.js";
 import { isTransientDatabaseError } from "../db/client.js";
@@ -420,7 +420,7 @@ export async function runA2AAgentLoopWithRunManager(runOptions, pluginOptions, t
         model: runOptions.model,
         engineName: runOptions.engine.name,
     });
-    let cancellation = Promise.resolve(false);
+    let cancellation = Promise.resolve({ status: "fulfilled", aborted: false });
     const abortFromTask = () => {
         const reason = taskSignal?.reason;
         const reasonCode = reason && typeof reason === "object" && "code" in reason
@@ -431,7 +431,7 @@ export async function runA2AAgentLoopWithRunManager(runOptions, pluginOptions, t
             run.abort.abort("execution_lease_lost");
             return;
         }
-        cancellation = abortRunDurably(runId, clientAbortReason(reason));
+        cancellation = abortRunDurably(runId, clientAbortReason(reason)).then((aborted) => ({ status: "fulfilled", aborted }), (error) => ({ status: "rejected", error }));
     };
     if (taskSignal?.aborted) {
         abortFromTask();
@@ -440,8 +440,17 @@ export async function runA2AAgentLoopWithRunManager(runOptions, pluginOptions, t
         taskSignal?.addEventListener("abort", abortFromTask, { once: true });
     }
     try {
-        await run.finalized;
-        await cancellation;
+        const finalization = await run.finalized.then(() => ({ status: "fulfilled" }), (error) => ({ status: "rejected", error }));
+        const cancellationResult = await cancellation;
+        if (finalization.status === "rejected" &&
+            cancellationResult.status === "rejected") {
+            throw new AggregateError([finalization.error, cancellationResult.error], "A2A run finalization and durable cancellation both failed");
+        }
+        if (finalization.status === "rejected")
+            throw finalization.error;
+        if (cancellationResult.status === "rejected") {
+            throw cancellationResult.error;
+        }
     }
     finally {
         taskSignal?.removeEventListener("abort", abortFromTask);
@@ -5262,18 +5271,28 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         // Empty/invalid body — keep the default user abort reason.
                     }
                     if (safeBoundary) {
-                        const aborted = await abortRunAtSafeBoundaryDurably(runId, reason);
-                        if (aborted && USER_STOP_ABORT_REASONS.has(reason)) {
-                            await abortTurnDurably(runId, reason);
+                        const isUserStop = USER_STOP_ABORT_REASONS.has(reason);
+                        const aborted = isUserStop
+                            ? await abortRunAndTurnDurably(runId, reason, {
+                                safeBoundary: true,
+                            })
+                            : await abortRunAtSafeBoundaryDurably(runId, reason);
+                        if (isUserStop && !aborted) {
+                            const latest = await getRunById(runId);
+                            if (latest?.status === "aborted") {
+                                await abortTurnDurably(runId, reason);
+                            }
                         }
                         return { ok: true, aborted };
                     }
                     // Recovery starts as soon as this response resolves, so wait for
                     // the cross-isolate abort + terminal event to be durable. Returning
                     // early lets Retry collide with the still-running row.
-                    await abortRunDurably(runId, reason);
                     if (USER_STOP_ABORT_REASONS.has(reason)) {
-                        await abortTurnDurably(runId, reason);
+                        await abortRunAndTurnDurably(runId, reason);
+                    }
+                    else {
+                        await abortRunDurably(runId, reason);
                     }
                     return { ok: true };
                 }
@@ -6539,6 +6558,67 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         }
                         const claimedMessage = claim.claimedMessage;
                         result.claimed += 1;
+                        const claimedReceipt = await getQueuedSubmissionReceipt(receipt.threadId, receipt.messageId);
+                        if (!claimedReceipt || claimedReceipt.state !== "queued") {
+                            if (claimedReceipt?.state === "submitted") {
+                                result.submitted += 1;
+                            }
+                            else {
+                                result.deferred += 1;
+                            }
+                            await mutateThreadQueuedMessages(receipt.threadId, {
+                                type: "release",
+                                messageId: receipt.messageId,
+                                claimId,
+                            });
+                            claimId = undefined;
+                            continue;
+                        }
+                        const finishInterrupt = async (runId) => {
+                            if (!(await renewQueuedSubmissionInterruptClaim({
+                                threadId: receipt.threadId,
+                                messageId: receipt.messageId,
+                                runId,
+                                claimId: claimId,
+                            }))) {
+                                return false;
+                            }
+                            const aborted = await abortRunAtSafeBoundaryDurably(runId, "user");
+                            if (!aborted) {
+                                const latest = await getRunById(runId);
+                                if (latest?.threadId !== receipt.threadId ||
+                                    !["completed", "truncated", "errored", "aborted"].includes(latest.status)) {
+                                    return false;
+                                }
+                            }
+                            await abortTurnDurably(runId, "user");
+                            if (!(await waitForStableIdle(receipt.threadId)))
+                                return false;
+                            const cleared = await clearQueuedSubmissionInterruptRun({
+                                threadId: receipt.threadId,
+                                messageId: receipt.messageId,
+                                runId,
+                                claimId: claimId,
+                            });
+                            if (!cleared) {
+                                throw new Error(`Queued interruption target ${runId} could not be cleared by its current claim`);
+                            }
+                            return true;
+                        };
+                        if (claimedReceipt.interruptRunId) {
+                            const stableIdle = await finishInterrupt(claimedReceipt.interruptRunId);
+                            if (!stableIdle) {
+                                await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, { claimId });
+                                await mutateThreadQueuedMessages(receipt.threadId, {
+                                    type: "release",
+                                    messageId: receipt.messageId,
+                                    claimId,
+                                });
+                                claimId = undefined;
+                                result.deferred += 1;
+                                continue;
+                            }
+                        }
                         const active = await getActiveRunForThreadAsync(receipt.threadId);
                         if (active?.inFlight) {
                             if (claimedMessage.interruptActiveRun !== true) {
@@ -6552,8 +6632,13 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 result.deferred += 1;
                                 continue;
                             }
-                            const aborted = await abortRunAtSafeBoundaryDurably(active.runId, "user");
-                            if (!aborted) {
+                            const recorded = await recordQueuedSubmissionInterruptRun({
+                                threadId: receipt.threadId,
+                                messageId: receipt.messageId,
+                                runId: active.runId,
+                                claimId,
+                            });
+                            if (!recorded) {
                                 await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, { claimId });
                                 await mutateThreadQueuedMessages(receipt.threadId, {
                                     type: "release",
@@ -6564,8 +6649,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 result.deferred += 1;
                                 continue;
                             }
-                            await abortTurnDurably(active.runId, "user");
-                            if (!(await waitForStableIdle(receipt.threadId))) {
+                            if (!(await finishInterrupt(active.runId))) {
                                 await retryQueuedSubmissionReceipt(receipt.threadId, receipt.messageId, Date.now() + 10_000, { claimId });
                                 await mutateThreadQueuedMessages(receipt.threadId, {
                                     type: "release",

package/dist/server/agent-engine-api-key-route.d.ts

@@ -66,7 +66,6 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     error: any;
     code: any;
 } | {
-    error?: undefined;
     errorCode?: undefined;
     code?: undefined;
     ok: boolean;
@@ -74,5 +73,6 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
     defaultModel?: import("./agent-engine-default-model-route.js").SavedKeyDefaultModelOutcome;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-default-model-route.d.ts

@@ -16,9 +16,9 @@ export declare function createAgentEngineDisconnectHandler(): import("h3").Event
     error: any;
     scope?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     scope: "org" | "user";
-    error?: undefined;
 }>>;
 export interface DefaultModelSelectionRequest {
     engine: string;

package/dist/server/agent-teams.d.ts

@@ -44,6 +44,9 @@ export interface AgentTask {
     terminalEffectsVersion?: 1;
     terminalEffectsReconciled?: boolean;
     terminalProgressStatus?: TerminalProgressStatus;
+    stopRequestedAt?: number;
+    stopRequestedRunId?: string;
+    stopRequestedReason?: string;
 }
 export interface AgentTeamOwnerScope {
     ownerEmail: string | null;