@agent-native/core 0.77.4 → 0.77.7

package/corpus/core/src/client/use-agent-engine-configured.ts

@@ -26,21 +26,13 @@ export function useAgentEngineConfigured(
 ): UseAgentEngineConfiguredResult {
   const [state, setState] = useState<AgentEngineConfiguredState>("unknown");
 
-  // Mid-run adapter signal that no key is usable — honored even when disabled.
   useEffect(() => {
-    const onMissing = () => setState("missing");
-    window.addEventListener("agent-chat:missing-api-key", onMissing);
-    return () =>
-      window.removeEventListener("agent-chat:missing-api-key", onMissing);
-  }, []);
-
-  useEffect(() => {
-    if (!enabled) {
-      setState("configured");
-      return;
-    }
     let cancelled = false;
-    const check = async () => {
+    const check = async (options?: { missingFallback?: boolean }) => {
+      if (!enabled) {
+        setState("configured");
+        return;
+      }
       const [envKeys, builderStatus, engineStatus] = await Promise.all([
         fetch(agentNativePath("/_agent-native/env-status"))
           .then((r) => (r.ok ? r.json() : null))
@@ -55,6 +47,7 @@ export function useAgentEngineConfigured(
       if (cancelled) return;
       // All three failed — likely a flaky network; keep the current state.
       if (envKeys == null && builderStatus == null && engineStatus == null) {
+        if (options?.missingFallback) setState("missing");
         return;
       }
       const keys = (envKeys ?? []) as Array<{
@@ -68,11 +61,32 @@ export function useAgentEngineConfigured(
         engineStatus?.configured === true;
       setState(anyConfigured ? "configured" : "missing");
     };
+    const onConfiguredChanged = () => {
+      void check();
+    };
+    const onMissing = () => {
+      if (!enabled) {
+        setState("configured");
+        return;
+      }
+      void check({ missingFallback: true });
+    };
+
     void check();
-    window.addEventListener("agent-engine:configured-changed", check);
+    window.addEventListener(
+      "agent-engine:configured-changed",
+      onConfiguredChanged,
+    );
+    // A stale failed stream can arrive after a reconnect succeeds. Re-check the
+    // current status before pinning the composer in setup.
+    window.addEventListener("agent-chat:missing-api-key", onMissing);
     return () => {
       cancelled = true;
-      window.removeEventListener("agent-engine:configured-changed", check);
+      window.removeEventListener(
+        "agent-engine:configured-changed",
+        onConfiguredChanged,
+      );
+      window.removeEventListener("agent-chat:missing-api-key", onMissing);
     };
   }, [enabled]);
 

package/corpus/core/src/client/use-chat-threads.ts

@@ -74,6 +74,7 @@ export interface UseChatThreadsOptions {
 
 const ACTIVE_THREAD_KEY = "agent-chat-active-thread";
 const THREADS_UPDATED_EVENT = "agent-chat:threads-updated";
+const THREADS_PAGE_SIZE = 50;
 
 function emitThreadsUpdated() {
   if (typeof window === "undefined") return;
@@ -215,6 +216,10 @@ export function useChatThreads(
   }
 
   const [threads, setThreads] = useState<ChatThreadSummary[]>([]);
+  const [hasMoreThreads, setHasMoreThreads] = useState(false);
+  const [isLoadingMoreThreads, setIsLoadingMoreThreads] = useState(false);
+  const [threadsLoadError, setThreadsLoadError] = useState<string | null>(null);
+  const nextThreadsOffsetRef = useRef(0);
   const threadsRef = useRef<ChatThreadSummary[]>(threads);
   threadsRef.current = threads;
 
@@ -414,66 +419,106 @@ export function useChatThreads(
     threads,
   ]);
 
-  const fetchThreads = useCallback(async () => {
-    try {
-      const res = await fetch(`${apiUrl}/threads`);
-      if (!res.ok) return;
-      const data = await res.json();
-      setThreads((prev) => {
-        const loaded = (data.threads ?? []) as ChatThreadSummary[];
-        const loadedIds = new Set(loaded.map((t) => t.id));
-        // Preserve any optimistic threads we've created this session that
-        // haven't shown up in the server list yet — the server only learns
-        // about a thread when the user actually sends a message and the
-        // agent run's `persistSubmittedUserMessage` writes the row.
-        const optimisticOnly = prev.filter(
-          (t) => newlyCreatedRef.current.has(t.id) && !loadedIds.has(t.id),
+  const fetchThreads = useCallback(
+    async (options?: { append?: boolean }) => {
+      try {
+        const offset = options?.append ? nextThreadsOffsetRef.current : 0;
+        const res = await fetch(
+          offset > 0
+            ? `${apiUrl}/threads?offset=${offset}`
+            : `${apiUrl}/threads`,
         );
-        // Reconcile each server thread against our local copy. If the local
-        // copy has a newer updatedAt or higher messageCount, keep those
-        // fields — the server probably hasn't observed the user's latest
-        // send yet, and naively replacing makes the recent-chats list
-        // visibly jump back to older timestamps right after a send.
-        const merged = loaded.map((server) => {
-          const local = prev.find((t) => t.id === server.id);
-          if (!local) return server;
-          const next = { ...server };
-          if (local.updatedAt > server.updatedAt) {
-            next.updatedAt = local.updatedAt;
-          }
-          if (userRenamedThreadIdsRef.current.has(server.id) && local.title) {
-            next.title = local.title;
-          }
-          if (pendingPinnedAtRef.current.has(server.id)) {
-            next.pinnedAt = pendingPinnedAtRef.current.get(server.id) ?? null;
-          }
-          if (pendingArchivedAtRef.current.has(server.id)) {
-            next.archivedAt =
-              pendingArchivedAtRef.current.get(server.id) ?? null;
-          }
-          if (local.messageCount > server.messageCount) {
-            next.messageCount = local.messageCount;
-            if (local.preview) next.preview = local.preview;
-            if (local.title) next.title = local.title;
+        if (!res.ok) {
+          if (!options?.append) {
+            setThreadsLoadError("Could not load chat history.");
           }
-          // Preserve optimistic scope: when the server creates the row
-          // on first message it does so without scope, and the next PUT
-          // (saveThreadData) writes the local scope back. In the brief
-          // window between those, the server list returns scope: null
-          // while the user is clearly working inside a deck — keep the
-          // local value so the tab bar doesn't blink unscoped.
-          if (local.scope && !server.scope) {
-            next.scope = local.scope;
+          return;
+        }
+        const data = await res.json();
+        setThreadsLoadError(null);
+        const loaded = (data.threads ?? []) as ChatThreadSummary[];
+        if (!options?.append) {
+          nextThreadsOffsetRef.current = loaded.length;
+        } else {
+          nextThreadsOffsetRef.current += loaded.length;
+        }
+        setHasMoreThreads(loaded.length >= THREADS_PAGE_SIZE);
+        setThreads((prev) => {
+          const loadedIds = new Set(loaded.map((t) => t.id));
+          // Preserve any optimistic threads we've created this session that
+          // haven't shown up in the server list yet — the server only learns
+          // about a thread when the user actually sends a message and the
+          // agent run's `persistSubmittedUserMessage` writes the row.
+          const optimisticOnly = prev.filter(
+            (t) => newlyCreatedRef.current.has(t.id) && !loadedIds.has(t.id),
+          );
+          // Reconcile each server thread against our local copy. If the local
+          // copy has a newer updatedAt or higher messageCount, keep those
+          // fields — the server probably hasn't observed the user's latest
+          // send yet, and naively replacing makes the recent-chats list
+          // visibly jump back to older timestamps right after a send.
+          const merged = loaded.map((server) => {
+            const local = prev.find((t) => t.id === server.id);
+            if (!local) return server;
+            const next = { ...server };
+            if (local.updatedAt > server.updatedAt) {
+              next.updatedAt = local.updatedAt;
+            }
+            if (userRenamedThreadIdsRef.current.has(server.id) && local.title) {
+              next.title = local.title;
+            }
+            if (pendingPinnedAtRef.current.has(server.id)) {
+              next.pinnedAt = pendingPinnedAtRef.current.get(server.id) ?? null;
+            }
+            if (pendingArchivedAtRef.current.has(server.id)) {
+              next.archivedAt =
+                pendingArchivedAtRef.current.get(server.id) ?? null;
+            }
+            if (local.messageCount > server.messageCount) {
+              next.messageCount = local.messageCount;
+              if (local.preview) next.preview = local.preview;
+              if (local.title) next.title = local.title;
+            }
+            // Preserve optimistic scope: when the server creates the row
+            // on first message it does so without scope, and the next PUT
+            // (saveThreadData) writes the local scope back. In the brief
+            // window between those, the server list returns scope: null
+            // while the user is clearly working inside a deck — keep the
+            // local value so the tab bar doesn't blink unscoped.
+            if (local.scope && !server.scope) {
+              next.scope = local.scope;
+            }
+            return next;
+          });
+          if (options?.append) {
+            const existingIds = new Set(prev.map((t) => t.id));
+            return sortThreadSummaries([
+              ...prev,
+              ...merged.filter((t) => !existingIds.has(t.id)),
+            ]);
           }
-          return next;
+          return [...optimisticOnly, ...merged];
         });
-        return [...optimisticOnly, ...merged];
-      });
-      return data.threads as ChatThreadSummary[];
-    } catch {
-      return undefined;
+        return data.threads as ChatThreadSummary[];
+      } catch {
+        if (!options?.append) {
+          setThreadsLoadError("Could not load chat history.");
+        }
+        return undefined;
+      }
+    },
+    [apiUrl],
+  );
+
+  const loadMoreThreads = useCallback(async (): Promise<void> => {
+    if (isLoadingMoreThreads || !hasMoreThreads) return;
+    setIsLoadingMoreThreads(true);
+    try {
+      await fetchThreads({ append: true });
+    } finally {
+      setIsLoadingMoreThreads(false);
     }
-  }, [apiUrl]);
+  }, [fetchThreads, hasMoreThreads, isLoadingMoreThreads]);
 
   // Initial load: load threads from server, then reconcile against the
   // saved active thread.
@@ -1158,10 +1203,14 @@ export function useChatThreads(
     saveThreadData,
     generateTitle,
     searchThreads,
+    loadMoreThreads,
     getThreadShareState,
     createThreadShareLink,
     revokeThreadShareLink,
     refreshThreads,
+    hasMoreThreads,
+    isLoadingMoreThreads,
+    threadsLoadError,
     isNewThread,
   };
 }

package/corpus/core/src/server/analytics.ts

@@ -3,6 +3,10 @@
  * Supported environment variables:
  * - `GA_MEASUREMENT_ID` — Google Analytics 4 measurement ID
  *
+ * Netlify configuration-file env vars are build-time only for serverless
+ * functions, so the Vite plugin also bakes this public value into SSR bundles
+ * as `__AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__`.
+ *
  * Amplitude and Sentry are initialized client-side via their npm packages
  * (see `packages/core/src/client/analytics.ts`). Only GA requires script
  * tag injection because the gtag.js loader must be a `<script src>`.
@@ -17,16 +21,36 @@
  * ```
  */
 
+declare const __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: string | undefined;
+
+function normalizeMeasurementId(value: string | undefined): string | null {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+
+function getGaMeasurementId(): string | null {
+  return (
+    normalizeMeasurementId(process.env.GA_MEASUREMENT_ID) ||
+    normalizeMeasurementId(
+      typeof __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__ === "string"
+        ? __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__
+        : undefined,
+    )
+  );
+}
+
 function getGaScript(): string | null {
-  const id = process.env.GA_MEASUREMENT_ID;
+  const id = getGaMeasurementId();
   if (!id) return null;
+  const srcId = encodeURIComponent(id);
+  const jsId = JSON.stringify(id);
   return (
-    `<script async src="https://www.googletagmanager.com/gtag/js?id=${id}"></script>` +
+    `<script async src="https://www.googletagmanager.com/gtag/js?id=${srcId}"></script>` +
     `<script>` +
     `window.dataLayer=window.dataLayer||[];` +
     `function gtag(){dataLayer.push(arguments);}` +
     `gtag('js',new Date());` +
-    `gtag('config','${id}');` +
+    `gtag('config',${jsId});` +
     `if(typeof sessionStorage!=='undefined'&&sessionStorage.getItem('__an_signin')){` +
     `sessionStorage.removeItem('__an_signin');` +
     `gtag('event','sign_in');` +

package/corpus/core/src/sharing/access.ts

@@ -71,6 +71,15 @@ export function resolveRegisteredAccessContext(
   return reg?.resolveAccessContext ? reg.resolveAccessContext(ctx) : ctx;
 }
 
+function normalizeEmailForAccess(email: string | undefined): string | null {
+  const normalized = email?.trim().toLowerCase();
+  return normalized || null;
+}
+
+function emailColumnMatches(column: any, email: string): SQL {
+  return sql`lower(${column}) = ${email}`;
+}
+
 /**
  * Build a Drizzle `WHERE` clause that admits rows the current user can see.
  * Pass the ownable resource table and its shares table; optional min role
@@ -103,15 +112,16 @@ export function accessFilter(
   const reg = findRegistrationByTable(resourceTable);
   const ctx = resolveRegisteredAccessContext(reg, rawCtx);
   const { userEmail, orgId } = ctx;
+  const normalizedUserEmail = normalizeEmailForAccess(userEmail);
   const publicAllowed = reg?.allowPublic !== false;
   const includePublic = (options.includePublic ?? false) && publicAllowed;
   const clauses: SQL[] = [];
 
-  if (userEmail) {
+  if (normalizedUserEmail) {
     clauses.push(
       and(
-        eq(resourceTable.ownerEmail, userEmail),
-        ownerScopeFilter(resourceTable, ctx),
+        emailColumnMatches(resourceTable.ownerEmail, normalizedUserEmail),
+        ownerScopeFilter(reg, resourceTable, ctx),
       )!,
     );
   }
@@ -128,13 +138,13 @@ export function accessFilter(
       );
     }
   }
-  if (userEmail) {
+  if (normalizedUserEmail) {
     const shareScope = restrictedShareScopeSql(reg, resourceTable, ctx);
     clauses.push(
       sql`exists (select 1 from ${sharesTable}
                   where ${sharesTable.resourceId} = ${resourceTable.id}
                     and ${sharesTable.principalType} = 'user'
-                    and ${sharesTable.principalId} = ${userEmail}
+                    and lower(${sharesTable.principalId}) = ${normalizedUserEmail}
                     and ${shareScope}
                     and ${minRoleSql(minRole)})`,
     );
@@ -154,7 +164,12 @@ export function accessFilter(
   return or(...clauses) ?? sql`1=0`;
 }
 
-function ownerScopeFilter(resourceTable: any, ctx: AccessContext): SQL {
+function ownerScopeFilter(
+  reg: ShareableResourceRegistration | undefined,
+  resourceTable: any,
+  ctx: AccessContext,
+): SQL {
+  if (reg?.ownerAccessIgnoresOrg === true) return sql`1=1`;
   if (ctx.orgId) {
     // Rows created before org-scoping, or in solo mode, have no org_id. Keep
     // them manageable by their owner after the owner joins or switches into an
@@ -167,7 +182,12 @@ function ownerScopeFilter(resourceTable: any, ctx: AccessContext): SQL {
   return sql`${resourceTable.orgId} IS NULL`;
 }
 
-function ownerMatchesActiveScope(resource: any, ctx: AccessContext): boolean {
+function ownerMatchesActiveScope(
+  reg: ShareableResourceRegistration | undefined,
+  resource: any,
+  ctx: AccessContext,
+): boolean {
+  if (reg?.ownerAccessIgnoresOrg === true) return true;
   const resourceOrgId = resource?.orgId ?? null;
   if (!resourceOrgId) return true;
   return ctx.orgId === resourceOrgId;
@@ -233,11 +253,12 @@ export async function resolveAccess(
   if (!resource) return null;
 
   const { userEmail, orgId } = ctx;
+  const normalizedUserEmail = normalizeEmailForAccess(userEmail);
 
   if (
-    userEmail &&
-    resource.ownerEmail === userEmail &&
-    ownerMatchesActiveScope(resource, ctx)
+    normalizedUserEmail &&
+    normalizeEmailForAccess(resource.ownerEmail) === normalizedUserEmail &&
+    ownerMatchesActiveScope(reg, resource, ctx)
   ) {
     return { role: "owner", resource };
   }
@@ -265,16 +286,17 @@ async function highestShareRole(
   resource: any,
 ): Promise<ShareRole | null> {
   const { userEmail, orgId } = ctx;
-  if (!userEmail && !orgId) return null;
+  const normalizedUserEmail = normalizeEmailForAccess(userEmail);
+  if (!normalizedUserEmail && !orgId) return null;
   if (!explicitSharesAllowedForResource(reg, resource, ctx)) return null;
   const db = reg.getDb() as any;
 
   const principalClauses: ReturnType<typeof and>[] = [];
-  if (userEmail) {
+  if (normalizedUserEmail) {
     principalClauses.push(
       and(
         eq(reg.sharesTable.principalType, "user"),
-        eq(reg.sharesTable.principalId, userEmail),
+        emailColumnMatches(reg.sharesTable.principalId, normalizedUserEmail),
       ),
     );
   }

package/corpus/core/src/sharing/actions/share-resource.ts

@@ -1,4 +1,4 @@
-import { and, eq } from "drizzle-orm";
+import { and, eq, sql, type SQL } from "drizzle-orm";
 import { z } from "zod";
 
 import { defineAction } from "../../action.js";
@@ -89,6 +89,25 @@ function nanoid(size = 12): string {
   return id;
 }
 
+function normalizePrincipalId(
+  principalType: "user" | "org",
+  principalId: string,
+): string {
+  return principalType === "user"
+    ? principalId.trim().toLowerCase()
+    : principalId;
+}
+
+function principalIdMatches(
+  sharesTable: any,
+  principalType: "user" | "org",
+  principalId: string,
+): SQL {
+  return principalType === "user"
+    ? sql`lower(${sharesTable.principalId}) = ${principalId}`
+    : eq(sharesTable.principalId, principalId);
+}
+
 /**
  * Returns true if the given email is either an active member of `orgId` or
  * has a pending invitation to `orgId`. Used by resources whose registration
@@ -163,6 +182,10 @@ export default defineAction({
     );
     const actor = getRequestUserEmail();
     if (!actor) throw new ForbiddenError("Not signed in");
+    const principalId = normalizePrincipalId(
+      args.principalType,
+      args.principalId,
+    );
     const beforeExtensionTargets = await getExtensionShareChangeTargets(
       args.resourceType,
       args.resourceId,
@@ -176,10 +199,10 @@ export default defineAction({
         );
       }
       if (args.principalType === "user") {
-        const ok = await isOrgMemberOrInvited(resourceOrgId, args.principalId);
+        const ok = await isOrgMemberOrInvited(resourceOrgId, principalId);
         if (!ok) {
           throw new ForbiddenError(
-            `${args.principalId} is not in your organization. Invite them to the organization first, then share.`,
+            `${principalId} is not in your organization. Invite them to the organization first, then share.`,
           );
         }
       } else if (args.principalType === "org") {
@@ -187,7 +210,7 @@ export default defineAction({
         // extension code in the viewer's auth context — the same threat
         // model that blocks public + cross-org user shares. Pin org-
         // principal shares to the resource's own org.
-        if (args.principalId !== resourceOrgId) {
+        if (principalId !== resourceOrgId) {
           throw new ForbiddenError(
             `${reg.displayName} can only be shared with its own organization, not a different one.`,
           );
@@ -203,7 +226,7 @@ export default defineAction({
         and(
           eq(reg.sharesTable.resourceId, args.resourceId),
           eq(reg.sharesTable.principalType, args.principalType),
-          eq(reg.sharesTable.principalId, args.principalId),
+          principalIdMatches(reg.sharesTable, args.principalType, principalId),
         ),
       );
 
@@ -225,7 +248,7 @@ export default defineAction({
       id,
       resourceId: args.resourceId,
       principalType: args.principalType,
-      principalId: args.principalId,
+      principalId,
       role: args.role,
       createdBy: actor,
       createdAt: new Date().toISOString(),
@@ -240,7 +263,7 @@ export default defineAction({
       args.notify !== false &&
       args.principalType === "user" &&
       isEmailConfigured() &&
-      !isSyntheticQaEmail(args.principalId)
+      !isSyntheticQaEmail(principalId)
     ) {
       try {
         const titleCol = reg.titleColumn ?? "title";
@@ -268,12 +291,12 @@ export default defineAction({
           heading: "You've been given access",
           paragraphs: [
             `${emailStrong(actor)} has shared the ${reg.displayName} ${emailStrong(resourceTitle)} with you as a ${emailStrong(args.role)}.`,
-            `Use the button below to open it. If prompted, sign in with ${emailStrong(args.principalId)}.`,
+            `Use the button below to open it. If prompted, sign in with ${emailStrong(principalId)}.`,
           ],
           cta: { label: `Open ${reg.displayName}`, url: notificationUrl },
           footer: `You received this because ${actor} granted you ${args.role} access.`,
         });
-        await sendEmail({ to: args.principalId, subject, html, text });
+        await sendEmail({ to: principalId, subject, html, text });
       } catch (err) {
         console.error(
           "[share-resource] failed to send share notification:",

package/corpus/core/src/sharing/actions/unshare-resource.ts

@@ -1,4 +1,4 @@
-import { and, eq } from "drizzle-orm";
+import { and, eq, sql, type SQL } from "drizzle-orm";
 import { z } from "zod";
 
 import { defineAction } from "../../action.js";
@@ -9,6 +9,25 @@ import {
   notifyExtensionShareChanged,
 } from "./extension-change.js";
 
+function normalizePrincipalId(
+  principalType: "user" | "org",
+  principalId: string,
+): string {
+  return principalType === "user"
+    ? principalId.trim().toLowerCase()
+    : principalId;
+}
+
+function principalIdMatches(
+  sharesTable: any,
+  principalType: "user" | "org",
+  principalId: string,
+): SQL {
+  return principalType === "user"
+    ? sql`lower(${sharesTable.principalId}) = ${principalId}`
+    : eq(sharesTable.principalId, principalId);
+}
+
 export default defineAction({
   description:
     "Revoke a previously granted share. Owner or admin role required.",
@@ -28,13 +47,17 @@ export default defineAction({
       args.resourceId,
     );
     const db = reg.getDb() as any;
+    const principalId = normalizePrincipalId(
+      args.principalType,
+      args.principalId,
+    );
     await db
       .delete(reg.sharesTable)
       .where(
         and(
           eq(reg.sharesTable.resourceId, args.resourceId),
           eq(reg.sharesTable.principalType, args.principalType),
-          eq(reg.sharesTable.principalId, args.principalId),
+          principalIdMatches(reg.sharesTable, args.principalType, principalId),
         ),
       );
     await notifyExtensionShareChanged(

package/corpus/core/src/sharing/registry.ts

@@ -78,6 +78,15 @@ export interface ShareableResourceRegistration {
     userEmail?: string;
     orgId?: string;
   };
+  /**
+   * When true, direct ownership is recognized by owner_email regardless of the
+   * caller's active org. Use this only for resource types where the template's
+   * own actions already treat owner_email as the cross-org authority and list
+   * views add their own org filters.
+   *
+   * Default: `false`.
+   */
+  ownerAccessIgnoresOrg?: boolean;
 }
 
 // Stash the registry on globalThis so it survives SSR bundle duplication.

package/corpus/core/src/vite/client.ts

@@ -1843,6 +1843,9 @@ function createAgentNativeConfig(
     define: {
       ...(userConfig.define ?? {}),
       ...(options.define ?? {}),
+      __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: JSON.stringify(
+        process.env.GA_MEASUREMENT_ID?.trim() || "",
+      ),
       // Framework route warmup controls how SSR `.data` routes are fetched:
       // ordinary fetches keep them CDN-cacheable, while native prefetch headers
       // can be refused before the CDN/origin sees the request. Keep this value

package/corpus/templates/analytics/actions/data-source-status.ts

@@ -151,32 +151,43 @@ export default defineAction({
     );
     const visibleKeys = new Set(results.map((result) => result.key));
     const providers = credentialProviderConfigs
-      .filter((provider) =>
-        provider.requiredKeys.every((key) => visibleKeys.has(key)),
-      )
+      .filter((provider) => {
+        const requiredMode = provider.requiredMode ?? "all";
+        return requiredMode === "any"
+          ? provider.requiredKeys.some((key) => visibleKeys.has(key))
+          : provider.requiredKeys.every((key) => visibleKeys.has(key));
+      })
       .map((provider) => {
         const optionalKeys = provider.optionalKeys ?? [];
-        const missingRequiredKeys = provider.requiredKeys.filter(
-          (key) => !configuredKeys.has(key),
-        );
+        const requiredMode = provider.requiredMode ?? "all";
+        const hasRequiredCredentials =
+          requiredMode === "any"
+            ? provider.requiredKeys.some((key) => configuredKeys.has(key))
+            : provider.requiredKeys.every((key) => configuredKeys.has(key));
+        const missingRequiredKeys = hasRequiredCredentials
+          ? []
+          : provider.requiredKeys.filter((key) => !configuredKeys.has(key));
         const configuredProviderKeys = [
           ...provider.requiredKeys,
           ...optionalKeys,
         ].filter((key) => configuredKeys.has(key));
+        const workspaceConnection =
+          workspaceProviderStatusById.get(provider.provider) ??
+          summarizeWorkspaceConnections(
+            provider.provider,
+            workspace.connections,
+            workspace.grants,
+          );
         return {
           provider: provider.provider,
           label: provider.label,
-          configured: missingRequiredKeys.length === 0,
+          configured:
+            hasRequiredCredentials ||
+            workspaceConnection.grantState === "connected",
           configuredKeys: configuredProviderKeys,
           missingRequiredKeys,
           optionalKeys,
-          workspaceConnection:
-            workspaceProviderStatusById.get(provider.provider) ??
-            summarizeWorkspaceConnections(
-              provider.provider,
-              workspace.connections,
-              workspace.grants,
-            ),
+          workspaceConnection,
         };
       });
     return {