@mastra/server 1.72.0-alpha.0 → 1.72.0-alpha.10

package/dist/server/handlers/agents.cjs

@@ -125,10 +125,13 @@ function hasSuspendedToolCall(snapshot, toolCallId) {
 	};
 	return visit(snapshot.context);
 }
-async function validateDurableToolCallAccess({ mastra, agent, runId, toolCallId, requestContext }) {
+function getDurableLoopWorkflowName(agent) {
+	return agent.durableLoopWorkflowName ?? _mastra_core_agent_durable.DurableStepIds.AGENTIC_LOOP;
+}
+async function validateDurableToolCallAccess({ mastra, agent, runId, toolCallId, requestContext, threadId }) {
 	if (!(0, _mastra_core_agent.isDurableAgentLike)(agent)) return;
 	const workflowRun = await (await mastra.getStorage()?.getStore("workflows"))?.getWorkflowRunById({
-		workflowName: _mastra_core_agent_durable.DurableStepIds.AGENTIC_LOOP,
+		workflowName: getDurableLoopWorkflowName(agent),
 		runId
 	});
 	if (!workflowRun) throw new require_http_exception.HTTPException(403, { message: "Access denied: durable run belongs to a different resource" });
@@ -148,7 +151,9 @@ async function validateDurableToolCallAccess({ mastra, agent, runId, toolCallId,
 	const effectiveResourceId = require_utils$1.getEffectiveResourceId(requestContext, void 0);
 	const [persistedResourceId] = persistedResourceIds;
 	if (persistedResourceIds.size > 1 || persistedResourceId && persistedResourceId !== effectiveResourceId) throw new require_http_exception.HTTPException(403, { message: "Access denied: durable run belongs to a different resource" });
-	if (!snapshot || snapshot.status !== "suspended" || input?.agentId !== agent.id || !hasSuspendedToolCall(snapshot, toolCallId)) throw new require_http_exception.HTTPException(403, { message: "Access denied: tool call is not suspended on this durable run" });
+	const persistedThreadId = input?.state?.threadId ?? input?.messageListState?.memoryInfo?.threadId;
+	if (threadId && persistedThreadId !== threadId) throw new require_http_exception.HTTPException(403, { message: "Access denied: durable run belongs to a different thread" });
+	if (!snapshot || snapshot.status !== "suspended" || input?.agentId !== agent.id || toolCallId !== void 0 && !hasSuspendedToolCall(snapshot, toolCallId)) throw new require_http_exception.HTTPException(403, { message: "Access denied: tool call is not suspended on this durable run" });
 }
 /**
 * Providers whose apiKeyEnvVar entries are aliases for the same credential (any one
@@ -1095,35 +1100,43 @@ async function buildProvidersList(mastra) {
 	const blockExternalProviders = process.env.AUTO_BLOCK_EXTERNAL_PROVIDERS === "true" || process.env.AUTO_BLOCK_EXTERNAL_PROVIDERS === "1";
 	const defaultGatewayIds = new Set(_mastra_core_llm.defaultGateways.map((gateway) => gateway.id));
 	if (!blockExternalProviders) for (const [id, provider] of Object.entries(_mastra_core_llm.PROVIDER_REGISTRY)) allProviders[id] = provider;
-	if (mastra) {
-		const allGateways = mastra.listGateways();
-		if (allGateways) for (const gateway of Object.values(allGateways)) {
-			if (gateway.id === "models.dev") continue;
-			if (blockExternalProviders && defaultGatewayIds.has(gateway.id)) continue;
-			try {
-				const gatewayProviders = await gateway.fetchProviders();
-				for (const [providerId, config] of Object.entries(gatewayProviders)) {
-					const prefixedId = providerId === gateway.id ? gateway.id : `${gateway.id}/${providerId}`;
-					if (!(prefixedId in allProviders)) allProviders[prefixedId] = config;
-				}
-			} catch (error) {
-				console.warn(`Failed to fetch providers from gateway "${gateway.id}":`, error);
+	const gateways = mastra ? Object.values(mastra.listGateways() ?? {}) : [];
+	for (const gateway of gateways) {
+		if (gateway.id === "models.dev") continue;
+		if (blockExternalProviders && defaultGatewayIds.has(gateway.id)) continue;
+		try {
+			const gatewayProviders = await gateway.fetchProviders();
+			for (const [providerId, config] of Object.entries(gatewayProviders)) {
+				const prefixedId = providerId === gateway.id ? gateway.id : `${gateway.id}/${providerId}`;
+				if (!(prefixedId in allProviders)) allProviders[prefixedId] = config;
 			}
+		} catch (error) {
+			console.warn(`Failed to fetch providers from gateway "${gateway.id}":`, error);
 		}
 	}
 	return Object.entries(allProviders).map(([id, provider]) => {
 		return {
 			id,
 			name: provider.name,
-			label: provider.label || provider.name,
-			description: provider.description || "",
+			label: readStringField(provider, "label") || provider.name,
+			description: readStringField(provider, "description") || "",
 			envVar: provider.apiKeyEnvVar,
-			connected: isProviderConnected(id, allProviders),
+			connected: isProviderConnected(id, allProviders) || isClaimedByGateway(id, provider.models, gateways),
 			docUrl: provider.docUrl,
 			models: [...provider.models]
 		};
 	});
 }
+function isClaimedByGateway(providerId, models, gateways) {
+	const [firstModel] = models;
+	if (!firstModel) return false;
+	const routerId = `${providerId}/${firstModel}`;
+	return gateways.some((gateway) => gateway.shouldEnable?.() !== false && gateway.handlesModel?.(routerId) === true);
+}
+function readStringField(source, field) {
+	const value = source[field];
+	return typeof value === "string" ? value : void 0;
+}
 const GET_PROVIDERS_ROUTE = require_route_builder.createRoute({
 	method: "GET",
 	path: "/agents/providers",
@@ -2016,6 +2029,14 @@ const RESUME_STREAM_ROUTE = require_route_builder.createRoute({
 				...effectiveResourceId ? { resource: effectiveResourceId } : {},
 				...effectiveThreadId ? { thread: effectiveThreadId } : {}
 			};
+			await validateDurableToolCallAccess({
+				mastra,
+				agent,
+				runId,
+				toolCallId,
+				requestContext: serverRequestContext,
+				threadId: effectiveThreadId
+			});
 			await require_utils$1.validateRunOwnership(await (await mastra.getStorage()?.getStore("workflows"))?.getWorkflowRunById({
 				workflowName: "agentic-loop",
 				runId
@@ -2068,7 +2089,7 @@ const RECOVER_ROUTE = require_route_builder.createRoute({
 			});
 			if (!(0, _mastra_core_agent.isDurableAgentLike)(agent)) throw new require_http_exception.HTTPException(400, { message: "Agent does not support recover. Only durable agents (createDurableAgent) can recover runs." });
 			await require_utils$1.validateRunOwnership(await (await mastra.getStorage()?.getStore("workflows"))?.getWorkflowRunById({
-				workflowName: _mastra_core_agent_durable.DurableStepIds.AGENTIC_LOOP,
+				workflowName: getDurableLoopWorkflowName(agent),
 				runId
 			}), require_utils$1.getEffectiveResourceId(serverRequestContext, void 0));
 			return (await agent.recover(runId, { abortSignal })).fullStream;
@@ -2128,6 +2149,14 @@ const RESUME_STREAM_UNTIL_IDLE_ROUTE = require_route_builder.createRoute({
 				...effectiveResourceId ? { resource: effectiveResourceId } : {},
 				...effectiveThreadId ? { thread: effectiveThreadId } : {}
 			};
+			await validateDurableToolCallAccess({
+				mastra,
+				agent,
+				runId,
+				toolCallId,
+				requestContext: serverRequestContext,
+				threadId: effectiveThreadId
+			});
 			await require_utils$1.validateRunOwnership(await (await mastra.getStorage()?.getStore("workflows"))?.getWorkflowRunById({
 				workflowName: "agentic-loop",
 				runId