@juspay/neurolink 13.8.17 → 13.8.18

package/dist/server/adapters/koaAdapter.js

@@ -6,6 +6,9 @@
 import { logger } from "../../utils/logger.js";
 import { AlreadyRunningError, ServerAdapterError, ServerStopError, wrapError, } from "../errors.js";
 import { BaseServerAdapter } from "../abstract/baseServerAdapter.js";
+import { resolveClientAddress } from "../utils/clientAddress.js";
+import { shapeRouteError } from "../utils/clientError.js";
+import { pathMatchesAny } from "../utils/pathMatch.js";
 import { isErrorResponse } from "../utils/validation.js";
 import { isRawBodyContentType, isWebResponse, parseByteLimit, RawBodyTooLargeError, readRawBody, readWebResponse, } from "../utils/rawBody.js";
 /**
@@ -20,6 +23,8 @@ export class KoaServerAdapter extends BaseServerAdapter {
     rateLimitStore = new Map();
     rateLimitCleanupInterval;
     sockets = new Set();
+    // The rate limiter counts nothing it cannot attribute, and says so once.
+    warnedNoClientAddress = false;
     // Middleware from registerMiddleware(). It runs through one dispatcher that
     // is mounted ahead of the router: app.use() after the router is mounted
     // would only ever see requests no route matched.
@@ -72,12 +77,15 @@ export class KoaServerAdapter extends BaseServerAdapter {
                 });
                 const adapterError = error instanceof ServerAdapterError ? error : undefined;
                 const statusCode = adapterError?.getHttpStatus() || err.status || err.statusCode || 500;
+                // A 4xx carries a message this server or Koa composed; any 5xx's
+                // text stays in the log.
+                const serverSide = statusCode >= 500;
                 ctx.status = statusCode;
                 ctx.body = {
                     error: {
                         code: adapterError?.code ??
-                            (statusCode === 500 ? "INTERNAL_ERROR" : `HTTP_${statusCode}`),
-                        message: statusCode === 500 ? "An internal error occurred" : err.message,
+                            (serverSide ? "INTERNAL_ERROR" : `HTTP_${statusCode}`),
+                        message: serverSide ? "An internal error occurred" : err.message,
                     },
                     metadata: {
                         requestId,
@@ -92,10 +100,13 @@ export class KoaServerAdapter extends BaseServerAdapter {
             const cors = corsModule.default;
             this.app.use(cors({
                 origin: (ctx) => {
-                    const origin = ctx.request.headers.origin || "*";
+                    // The wildcard is sent as the literal "*": reflecting the
+                    // request's Origin instead would grant any page a credentialed
+                    // allowance the wildcard itself cannot carry.
                     if (this.config.cors.origins.includes("*")) {
-                        return origin;
+                        return "*";
                     }
+                    const origin = ctx.request.headers.origin ?? "";
                     return this.config.cors.origins.includes(origin) ? origin : "";
                 },
                 allowMethods: this.config.cors.methods?.join(","),
@@ -165,18 +176,38 @@ export class KoaServerAdapter extends BaseServerAdapter {
     createRateLimiter() {
         return async (ctx, next) => {
             // Skip rate limiting for excluded paths
-            if (this.config.rateLimit.skipPaths) {
-                for (const skipPath of this.config.rateLimit.skipPaths) {
-                    if (ctx.path.startsWith(skipPath)) {
-                        await next();
-                        return;
-                    }
+            if (pathMatchesAny(ctx.path, this.config.rateLimit.skipPaths)) {
+                await next();
+                return;
+            }
+            // The TCP peer, or behind a declared proxy the client it reports. A
+            // header alone used to be the key, so a rotating X-Forwarded-For escaped
+            // the limit; a request with no attributable address is let through
+            // rather than pooled with every other such request.
+            const key = this.config.rateLimit.keyGenerator
+                ? this.config.rateLimit.keyGenerator(this.createContext({
+                    requestId: ctx.state.requestId,
+                    method: ctx.method,
+                    path: ctx.path,
+                    headers: ctx.headers,
+                    query: ctx.query,
+                    params: {},
+                    remoteAddress: ctx.req.socket?.remoteAddress,
+                }))
+                : resolveClientAddress({
+                    remoteAddress: ctx.req.socket?.remoteAddress,
+                    forwardedFor: ctx.get("x-forwarded-for") || undefined,
+                    trustProxy: this.config.rateLimit.trustProxy,
+                    trustedProxies: this.config.rateLimit.trustedProxies,
+                });
+            if (key === undefined) {
+                if (!this.warnedNoClientAddress) {
+                    this.warnedNoClientAddress = true;
+                    logger.alwaysStderr("[KoaAdapter] A request arrived with no peer address, so the rate limiter cannot count it; configure rateLimit.keyGenerator to limit by another key.");
                 }
+                await next();
+                return;
             }
-            const key = ctx.get("x-forwarded-for") ||
-                ctx.get("x-real-ip") ||
-                ctx.ip ||
-                "unknown";
             const now = Date.now();
             const windowMs = this.config.rateLimit.windowMs;
             const maxRequests = this.config.rateLimit.maxRequests;
@@ -256,12 +287,24 @@ export class KoaServerAdapter extends BaseServerAdapter {
                 query: ctx.query,
                 params: ctx.params,
                 body: ctx.request.body,
+                remoteAddress: ctx.req.socket?.remoteAddress,
             });
             // Copy response headers from middleware (stored in ctx.state by middleware)
             if (ctx.state.responseHeaders) {
                 serverCtx.responseHeaders = { ...ctx.state.responseHeaders };
             }
             this.restoreCarriedContext(serverCtx, ctx.state.carriedContext);
+            // The handler learns of a client that went away, and a request over
+            // `config.timeout` is answered 504 and its work aborted. Koa applied no
+            // request timeout at all.
+            const abort = this.attachRequestAbort(serverCtx, {
+                onClientClose: (listener) => ctx.req.on("close", () => {
+                    if (!ctx.res.writableFinished) {
+                        listener();
+                    }
+                }),
+                applyTimeout: !route.streaming?.enabled,
+            });
             // Emit request event
             this.emit("request", {
                 requestId,
@@ -269,39 +312,68 @@ export class KoaServerAdapter extends BaseServerAdapter {
                 path: serverCtx.path,
                 timestamp: new Date(),
             });
-            // Handle streaming if configured
-            if (route.streaming?.enabled) {
-                return this.handleStreamingResponse(ctx, serverCtx, route);
-            }
-            // Execute handler
-            const result = await route.handler(serverCtx);
-            const duration = Date.now() - startTime;
-            // A route that answers in its own wire format returns a web Response.
-            if (isWebResponse(result)) {
-                const raw = await readWebResponse(result);
-                this.emit("response", {
-                    requestId,
-                    statusCode: raw.status,
-                    duration,
-                    timestamp: new Date(),
-                });
-                for (const [key, value] of Object.entries({
-                    ...serverCtx.responseHeaders,
-                    ...raw.headers,
-                })) {
-                    ctx.set(key, value);
+            try {
+                // Handle streaming if configured
+                if (route.streaming?.enabled) {
+                    return await this.handleStreamingResponse(ctx, serverCtx, route);
                 }
-                ctx.status = raw.status;
-                ctx.body = raw.body;
-                return;
-            }
-            // Check if result is an error response
-            if (isErrorResponse(result)) {
-                const statusCode = result.httpStatus ?? 500;
-                // Emit response event with error status
+                // Execute handler
+                const result = abort.deadline
+                    ? await Promise.race([route.handler(serverCtx), abort.deadline])
+                    : await route.handler(serverCtx);
+                const duration = Date.now() - startTime;
+                // A route that answers in its own wire format returns a web Response.
+                if (isWebResponse(result)) {
+                    const raw = await readWebResponse(result);
+                    this.emit("response", {
+                        requestId,
+                        statusCode: raw.status,
+                        duration,
+                        timestamp: new Date(),
+                    });
+                    for (const [key, value] of Object.entries({
+                        ...serverCtx.responseHeaders,
+                        ...raw.headers,
+                    })) {
+                        ctx.set(key, value);
+                    }
+                    ctx.status = raw.status;
+                    ctx.body = raw.body;
+                    return;
+                }
+                // Check if result is an error response
+                if (isErrorResponse(result)) {
+                    const statusCode = result.httpStatus ?? 500;
+                    // Emit response event with error status
+                    this.emit("response", {
+                        requestId,
+                        statusCode,
+                        duration,
+                        timestamp: new Date(),
+                    });
+                    // Apply response headers from middleware and handler
+                    if (serverCtx.responseHeaders) {
+                        for (const [key, value] of Object.entries(serverCtx.responseHeaders)) {
+                            ctx.set(key, value);
+                        }
+                    }
+                    // Return error response with proper status code
+                    ctx.status = statusCode;
+                    ctx.body = {
+                        error: result.error,
+                        metadata: {
+                            ...result.metadata,
+                            requestId,
+                            timestamp: new Date().toISOString(),
+                            duration,
+                        },
+                    };
+                    return;
+                }
+                // Emit response event
                 this.emit("response", {
                     requestId,
-                    statusCode,
+                    statusCode: 200,
                     duration,
                     timestamp: new Date(),
                 });
@@ -311,41 +383,44 @@ export class KoaServerAdapter extends BaseServerAdapter {
                         ctx.set(key, value);
                     }
                 }
-                // Return error response with proper status code
-                ctx.status = statusCode;
+                // Return formatted response
                 ctx.body = {
-                    error: result.error,
+                    data: result,
                     metadata: {
-                        ...result.metadata,
                         requestId,
                         timestamp: new Date().toISOString(),
                         duration,
                     },
                 };
-                return;
             }
-            // Emit response event
-            this.emit("response", {
-                requestId,
-                statusCode: 200,
-                duration,
-                timestamp: new Date(),
-            });
-            // Apply response headers from middleware and handler
-            if (serverCtx.responseHeaders) {
-                for (const [key, value] of Object.entries(serverCtx.responseHeaders)) {
-                    ctx.set(key, value);
+            catch (error) {
+                // The exception's text stays in the log under this request id; the
+                // client gets a fixed message for its category.
+                const shaped = shapeRouteError("KoaAdapter", requestId, error);
+                this.emitRequestError({
+                    requestId,
+                    error: error instanceof Error ? error : new Error(String(error)),
+                    timestamp: new Date(),
+                });
+                this.emit("response", {
+                    requestId,
+                    statusCode: shaped.status,
+                    duration: Date.now() - startTime,
+                    timestamp: new Date(),
+                });
+                if (ctx.res.headersSent) {
+                    ctx.res.end();
+                    return;
                 }
+                ctx.status = shaped.status;
+                ctx.body = {
+                    error: { code: shaped.code, message: shaped.message },
+                    metadata: { requestId, timestamp: new Date().toISOString() },
+                };
+            }
+            finally {
+                abort.release();
             }
-            // Return formatted response
-            ctx.body = {
-                data: result,
-                metadata: {
-                    requestId,
-                    timestamp: new Date().toISOString(),
-                    duration,
-                },
-            };
         });
     }
     /**
@@ -382,9 +457,13 @@ export class KoaServerAdapter extends BaseServerAdapter {
             stream.end();
         }
         catch (error) {
+            const shaped = shapeRouteError("KoaAdapter", serverCtx.requestId, error);
             stream.write(`event: error\n`);
             stream.write(`data: ${JSON.stringify({
-                error: error instanceof Error ? error.message : "Stream error",
+                error: shaped.message,
+                code: shaped.code,
+                status: shaped.status,
+                requestId: serverCtx.requestId,
             })}\n\n`);
             stream.end();
         }
@@ -395,13 +474,11 @@ export class KoaServerAdapter extends BaseServerAdapter {
     registerFrameworkMiddleware(middleware) {
         this.registeredMiddleware.push(async (ctx, next) => {
             // Skip excluded paths
-            if (middleware.excludePaths?.some((p) => ctx.path.startsWith(p))) {
+            if (pathMatchesAny(ctx.path, middleware.excludePaths)) {
                 return next();
             }
             // Check if path matches
-            const paths = middleware.paths || ["/"];
-            const matches = paths.some((p) => ctx.path.startsWith(p) || p === "*");
-            if (!matches) {
+            if (!pathMatchesAny(ctx.path, middleware.paths || ["/"])) {
                 return next();
             }
             // Initialize response headers storage in ctx.state if not present
@@ -417,6 +494,7 @@ export class KoaServerAdapter extends BaseServerAdapter {
                 query: ctx.query,
                 params: ctx.params,
                 body: ctx.request.body,
+                remoteAddress: ctx.req.socket?.remoteAddress,
             });
             // Copy existing response headers to context
             serverCtx.responseHeaders = { ...ctx.state.responseHeaders };
@@ -470,6 +548,7 @@ export class KoaServerAdapter extends BaseServerAdapter {
                     this.isRunning = true;
                     this.startTime = new Date();
                     this.lifecycleState = "running";
+                    this.warnIfSensitiveRoutesUnauthenticated();
                     // Track connections for graceful shutdown
                     this.server?.on("connection", (socket) => {
                         const connectionId = `conn-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;

package/dist/server/index.d.ts

@@ -42,6 +42,8 @@ export { createAgentRoutes, createAllRoutes, createHealthRoutes, createMCPRoutes
 export { BaseDataStreamWriter, createDataStreamResponse, createDataStreamWriter, createNDJSONHeaders, createSSEHeaders, DataStreamResponse, formatSSEEvent, pipeAsyncIterableToDataStream, WebStreamWriter, } from "./streaming/index.js";
 export { ErrorCategory, ErrorSeverity, ServerAdapterErrorCode, } from "../types/index.js";
 export { createStreamRedactor, redactStreamChunk } from "./utils/redaction.js";
+export { isLoopbackAddress, resolveClientAddress, } from "./utils/clientAddress.js";
+export { clientFacingError } from "./utils/clientError.js";
 export { AgentExecuteRequestSchema, createErrorResponse, ServerNameParamSchema, SessionIdParamSchema, ToolArgumentsSchema, ToolExecuteRequestSchema, ToolNameParamSchema, ToolSearchQuerySchema, TranscribeConfigSchema, TranscribeRequestSchema, TranscribeStreamConfigSchema, validateParams, validateQuery, validateRequest, } from "./utils/validation.js";
 export { createAgentWebSocketHandler, WebSocketConnectionManager, WebSocketMessageRouter, } from "./websocket/index.js";
 export { attachTranscribeWebSocket } from "./websocket/transcribeWebSocket.js";

package/dist/server/index.js

@@ -117,6 +117,10 @@ pipeAsyncIterableToDataStream, WebStreamWriter, } from "./streaming/index.js";
 // Export error constants
 export { ErrorCategory, ErrorSeverity, ServerAdapterErrorCode, } from "../types/index.js";
 export { createStreamRedactor, redactStreamChunk } from "./utils/redaction.js";
+// The address a request is counted against (for a custom rate-limit
+// keyGenerator behind a reverse proxy) and the loopback test the adapters use.
+export { isLoopbackAddress, resolveClientAddress, } from "./utils/clientAddress.js";
+export { clientFacingError } from "./utils/clientError.js";
 // ============================================
 // Validation Utilities
 // ============================================

package/dist/server/middleware/auth.js

@@ -65,6 +65,7 @@ export function createAuthMiddleware(config) {
         name: "authentication",
         order: 10, // Run early but after request ID
         excludePaths: skipPaths,
+        authenticates: true,
         handler: async (ctx, next) => {
             // The playground header is a development convenience, so it is honoured
             // only when NODE_ENV is exactly "development". An unset NODE_ENV (the
@@ -286,12 +287,15 @@ export function createBearerAuthMiddleware(validate, options = {}) {
         name: "bearer-auth",
         order: 10,
         excludePaths: skipPaths,
+        authenticates: true,
         handler: async (ctx, next) => {
             const authHeader = ctx.headers[headerName.toLowerCase()];
-            // Extract bearer token
+            // Extract bearer token. The token must open with a non-whitespace
+            // character, as in extractToken(): with `\s+(.+)` a header that failed
+            // to match was retried at every split, quadratic in its length.
             let token = null;
             if (authHeader) {
-                const match = authHeader.match(/^Bearer\s+(.+)$/i);
+                const match = authHeader.match(/^Bearer\s+(\S.*)$/i);
                 token = match ? match[1] : null;
             }
             // Handle missing token

package/dist/server/middleware/cache.js

@@ -136,10 +136,15 @@ export function createCacheMiddleware(config) {
     };
 }
 /**
- * Default cache key generator
+ * Default cache key generator. An authenticated user's id is part of the key,
+ * so one caller's cached response is never served to another; without a user
+ * the key is the request alone, as before.
  */
 function defaultKeyGenerator(ctx) {
     const parts = [ctx.method, ctx.path];
+    if (ctx.user?.id) {
+        parts.push(`user=${ctx.user.id}`);
+    }
     // Include sorted query params
     const queryKeys = Object.keys(ctx.query).sort();
     if (queryKeys.length > 0) {

package/dist/server/middleware/rateLimit.js

@@ -2,6 +2,7 @@
  * Rate Limiting Middleware
  * Provides configurable rate limiting for server adapters
  */
+import { logger } from "../../utils/logger.js";
 import { RateLimitError as ServerRateLimitError } from "../errors.js";
 /**
  * In-memory rate limit store
@@ -86,6 +87,9 @@ export function createRateLimitMiddleware(config) {
         excludePaths: skipPaths,
         handler: async (ctx, next) => {
             const key = keyGenerator(ctx);
+            if (!key) {
+                return next(); // Nothing to attribute the request to: see defaultKeyGenerator.
+            }
             const { count, resetAt } = await store.increment(key, windowMs);
             // Set rate limit headers in responseHeaders (adapters read from here)
             ctx.responseHeaders = ctx.responseHeaders || {};
@@ -107,12 +111,27 @@ export function createRateLimitMiddleware(config) {
     };
 }
 /**
- * Default key generator using IP address
+ * Default key: the TCP peer the adapter recorded on the context. Never a
+ * header, which the client writes: keyed on `X-Forwarded-For`, one shared
+ * bucket served every direct client and a rotating header escaped the limit.
+ * Behind a reverse proxy, pass a `keyGenerator` that reads the proxy's header
+ * (see `resolveClientAddress`). An empty key means "do not count".
  */
 function defaultKeyGenerator(ctx) {
-    return (ctx.headers["x-forwarded-for"]?.split(",")[0].trim() ||
-        ctx.headers["x-real-ip"] ||
-        "unknown");
+    const address = ctx.remoteAddress?.trim();
+    if (!address) {
+        warnNoAddressOnce();
+        return "";
+    }
+    return address;
+}
+let warnedNoAddress = false;
+function warnNoAddressOnce() {
+    if (warnedNoAddress) {
+        return;
+    }
+    warnedNoAddress = true;
+    logger.alwaysStderr("[rateLimit] A request carried no peer address (ctx.remoteAddress), so the rate limiter let it through uncounted; pass a keyGenerator to limit by another key.");
 }
 /**
  * Create a sliding window rate limiter
@@ -142,6 +161,9 @@ export function createSlidingWindowRateLimitMiddleware(config) {
         excludePaths: skipPaths,
         handler: async (ctx, next) => {
             const key = keyGenerator(ctx);
+            if (!key) {
+                return next();
+            }
             const now = Date.now();
             // Get existing timestamps and filter old ones
             let timestamps = store.get(key) || [];
@@ -201,6 +223,9 @@ export function createFixedWindowRateLimitMiddleware(config, store) {
         excludePaths: skipPaths,
         handler: async (ctx, next) => {
             const key = keyGenerator(ctx);
+            if (!key) {
+                return next();
+            }
             const { count, resetAt } = await rateLimitStore.increment(key, windowMs);
             // Set rate limit headers in responseHeaders (adapters read from here)
             ctx.responseHeaders = ctx.responseHeaders || {};

package/dist/server/routes/agentRoutes.js

@@ -29,7 +29,13 @@ async function resolveRequestToolFilter(ctx, requestedTools) {
     return undefined;
 }
 import { AgentInputError, resolveAgentInput } from "../utils/agentInput.js";
+import { shapeRouteError } from "../utils/clientError.js";
 import { createStreamRedactor } from "../utils/redaction.js";
+/** The route's error response for an exception: a fixed message, the detail logged. */
+function agentFailure(ctx, error, code = "EXECUTION_FAILED") {
+    const shaped = shapeRouteError("agentRoutes", ctx.requestId, error);
+    return createError(shaped.status === 500 ? code : shaped.code, shaped.message, undefined, ctx.requestId, shaped.status);
+}
 import { AgentExecuteRequestSchema, createErrorResponse as createError, EmbedManyRequestSchema, EmbedRequestSchema, SkillCreateRequestSchema, SkillUpdateRequestSchema, validateRequest, } from "../utils/validation.js";
 /**
  * Resolve the skills manager from the server's NeuroLink instance, or a
@@ -244,6 +250,9 @@ export function createAgentRoutes(basePath = "/api", options) {
                             return input;
                         }
                         const requestToolFilter = await resolveRequestToolFilter(ctx, request.tools);
+                        // The adapter's signal: the client went away, or the request
+                        // ran past the server's timeout. Either stops the generation
+                        // instead of leaving it running for nobody.
                         const result = await ctx.neurolink.generate({
                             input,
                             provider: request.provider,
@@ -252,6 +261,7 @@ export function createAgentRoutes(basePath = "/api", options) {
                             temperature: request.temperature,
                             maxTokens: request.maxTokens,
                             ...(requestToolFilter ? { toolFilter: requestToolFilter } : {}),
+                            ...(ctx.abortSignal ? { abortSignal: ctx.abortSignal } : {}),
                             context: callerContext(ctx, request),
                         });
                         // Map tool calls from SDK format to API format
@@ -295,6 +305,7 @@ export function createAgentRoutes(basePath = "/api", options) {
                         temperature: request.temperature,
                         maxTokens: request.maxTokens,
                         ...(streamToolFilter ? { toolFilter: streamToolFilter } : {}),
+                        ...(ctx.abortSignal ? { abortSignal: ctx.abortSignal } : {}),
                         context: callerContext(ctx, request),
                     });
                     // Create redactor (no-op if redaction is not enabled)
@@ -377,9 +388,7 @@ export function createAgentRoutes(basePath = "/api", options) {
                         });
                     }
                     catch (error) {
-                        return createError("EXECUTION_FAILED", error instanceof Error
-                            ? error.message
-                            : "Embedding generation failed", undefined, ctx.requestId);
+                        return agentFailure(ctx, error);
                     }
                 },
                 description: "Generate embedding for a single text",
@@ -418,9 +427,7 @@ export function createAgentRoutes(basePath = "/api", options) {
                         });
                     }
                     catch (error) {
-                        return createError("EXECUTION_FAILED", error instanceof Error
-                            ? error.message
-                            : "Batch embedding generation failed", undefined, ctx.requestId);
+                        return agentFailure(ctx, error);
                     }
                 },
                 description: "Generate embeddings for multiple texts in a batch",
@@ -439,7 +446,7 @@ export function createAgentRoutes(basePath = "/api", options) {
                         return { skills, count: skills.length };
                     }
                     catch (error) {
-                        return createError("EXECUTION_FAILED", error instanceof Error ? error.message : "Skills listing failed", undefined, ctx.requestId);
+                        return agentFailure(ctx, error);
                     }
                 },
                 description: "List active skills (index only — no instructions). Optional ?scopeId= filter.",
@@ -461,7 +468,7 @@ export function createAgentRoutes(basePath = "/api", options) {
                         return skill;
                     }
                     catch (error) {
-                        return createError("EXECUTION_FAILED", error instanceof Error ? error.message : "Skill lookup failed", undefined, ctx.requestId);
+                        return agentFailure(ctx, error);
                     }
                 },
                 description: "Fetch one skill (by id or exact name) with instructions",
@@ -490,7 +497,7 @@ export function createAgentRoutes(basePath = "/api", options) {
                         return result;
                     }
                     catch (error) {
-                        return createError("EXECUTION_FAILED", error instanceof Error ? error.message : "Skill create failed", undefined, ctx.requestId);
+                        return agentFailure(ctx, error);
                     }
                 },
                 description: "Create a skill (routed through the host's onMutationRequest gate when configured)",
@@ -520,8 +527,12 @@ export function createAgentRoutes(basePath = "/api", options) {
                         return result;
                     }
                     catch (error) {
+                        // "not found" is this server's own wording for an unknown id, so
+                        // it may be said; anything else is reduced to its category.
                         const message = error instanceof Error ? error.message : "Skill update failed";
-                        return createError(message.includes("not found") ? "NOT_FOUND" : "EXECUTION_FAILED", message, undefined, ctx.requestId);
+                        return message.includes("not found")
+                            ? createError("NOT_FOUND", `Skill "${ctx.params.id}" not found`, undefined, ctx.requestId)
+                            : agentFailure(ctx, error);
                     }
                 },
                 description: "Update a skill (patch semantics; version is bumped)",
@@ -546,7 +557,9 @@ export function createAgentRoutes(basePath = "/api", options) {
                     }
                     catch (error) {
                         const message = error instanceof Error ? error.message : "Skill delete failed";
-                        return createError(message.includes("not found") ? "NOT_FOUND" : "EXECUTION_FAILED", message, undefined, ctx.requestId);
+                        return message.includes("not found")
+                            ? createError("NOT_FOUND", `Skill "${ctx.params.id}" not found`, undefined, ctx.requestId)
+                            : agentFailure(ctx, error);
                     }
                 },
                 description: "Soft-delete (deprecate) a skill",

package/dist/server/routes/claudeProxyRoutes.d.ts

@@ -385,6 +385,7 @@ declare function handleAnthropicNonOkResponse(args: {
     } | null;
     entitlementFailure: AnthropicEntitlementFailure | null;
     allowConfiguredModelFallback?: boolean;
+    clientSuppliedBetaForwarded?: boolean;
 }): Promise<AnthropicNonOkResult>;
 /**
  * Detect Anthropic's anti-abuse / request-construction 429.