@truefoundry/trueforge 0.1.1 → 0.1.2

package/dist/main.js

@@ -655,9 +655,7 @@ var init_sqlExpressions2 = __esm({
 });
 
 // src/db/sqlite/session-store/queries/turns.ts
-import {
-  CancellationReason as CancellationReason4
-} from "@truefoundry/trueforge-core/agent-session/schemas/turn";
+import "@truefoundry/trueforge-core/agent-session/schemas/turn";
 import { assertCreateTurnThreadDelta } from "@truefoundry/trueforge-core/agent-session/store/assertCreateTurnThreadDelta";
 import {
   PreviousTurnRunningError,
@@ -666,7 +664,7 @@ import {
   SessionStoreInvariantError as SessionStoreInvariantError2,
   SessionStoreNotFoundError as SessionStoreNotFoundError3,
   TurnAlreadyExistsError,
-  TurnNotFoundError,
+  TurnNotFoundError as TurnNotFoundError2,
   TurnNotRunningError
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { getEmptyCurrentContextUsage } from "@truefoundry/trueforge-core/core/runtime/contextUsage";
@@ -700,14 +698,14 @@ async function loadTurnState(db, keys) {
 async function classifyTurnFenceWriteFailure(db, keys) {
   const state = await loadTurnState(db, keys);
   if (!state) {
-    throw new TurnNotFoundError(keys.turn_id);
+    throw new TurnNotFoundError2(keys.turn_id);
   }
   throw new TurnNotRunningError(keys.turn_id, terminalTurnState(state, keys.turn_id));
 }
 async function classifyTurnThreadWriteFailure(db, keys, thread_id) {
   const state = await loadTurnState(db, keys);
   if (!state) {
-    throw new TurnNotFoundError(keys.turn_id);
+    throw new TurnNotFoundError2(keys.turn_id);
   }
   if (state.status !== "running") {
     throw new TurnNotRunningError(keys.turn_id, terminalTurnState(state, keys.turn_id));
@@ -717,7 +715,7 @@ async function classifyTurnThreadWriteFailure(db, keys, thread_id) {
 async function assertTurnRunning(db, keys) {
   const state = await loadTurnState(db, keys);
   if (!state) {
-    throw new TurnNotFoundError(keys.turn_id);
+    throw new TurnNotFoundError2(keys.turn_id);
   }
   if (state.status !== "running") {
     throw new TurnNotRunningError(keys.turn_id, terminalTurnState(state, keys.turn_id));
@@ -1048,7 +1046,7 @@ async function freezeAndGetTurn(db, input) {
   return await db.transaction().execute(async (trx) => {
     const cancelledState = {
       status: "cancelled",
-      reason: CancellationReason4.CancelledForNextTurn,
+      reason: input.reason,
       completed_at: nowIso()
     };
     const updateResult = await trx.updateTable("turn").set({
@@ -1066,7 +1064,7 @@ async function freezeAndGetTurn(db, input) {
     }
     const record = await assembleTurnRecord(trx, input);
     if (!record) {
-      throw new TurnNotFoundError(input.turn_id);
+      throw new TurnNotFoundError2(input.turn_id);
     }
     return record;
   });
@@ -1116,7 +1114,7 @@ async function updateTurnState(db, input) {
     if (numUpdated === 0) {
       const existing = await trx.selectFrom("turn").select([jsonText(sql2.ref("state")).as("state")]).where("session_id", "=", input.session_id).where("turn_id", "=", input.turn_id).executeTakeFirst();
       if (!existing) {
-        throw new TurnNotFoundError(input.turn_id);
+        throw new TurnNotFoundError2(input.turn_id);
       }
       throw new TurnNotRunningError(input.turn_id, terminalTurnState(existing.state, input.turn_id));
     }
@@ -1182,7 +1180,7 @@ import {
 } from "@truefoundry/trueforge-core/agent-session/store/SessionEventPageToken";
 import {
   SessionNotFoundError as SessionNotFoundError2,
-  TurnNotFoundError as TurnNotFoundError2
+  TurnNotFoundError as TurnNotFoundError3
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { sql as sql4 } from "kysely";
 async function appendToEvents(db, input) {
@@ -1217,7 +1215,7 @@ async function listTurnEvents(db, input) {
     (join) => join.onRef("e.session_id", "=", "t.session_id").onRef("e.turn_id", "=", "t.turn_id")
   ).select(["t.turn_id", "e.event"]).where("t.session_id", "=", input.session_id).where("t.turn_id", "=", input.turn_id).orderBy("e.event_id", eventOrder).execute();
   if (rows.length === 0) {
-    throw new TurnNotFoundError2(input.turn_id);
+    throw new TurnNotFoundError3(input.turn_id);
   }
   const events = [];
   for (const row of rows) {
@@ -1265,7 +1263,7 @@ async function listSessionEvents(db, input) {
   };
   const anchor = await db.selectFrom("turn").select(["turn_id", jsonText(sql4.ref("ancestor_ids")).as("ancestor_ids")]).where("session_id", "=", input.session_id).where("turn_id", "=", cursor.last_turn_id).executeTakeFirst();
   if (!anchor) {
-    throw new TurnNotFoundError2(cursor.last_turn_id);
+    throw new TurnNotFoundError3(cursor.last_turn_id);
   }
   const chainIds = await resolveAncestorChain(db, input.session_id, {
     turn_id: anchor.turn_id,
@@ -2104,6 +2102,9 @@ async function consumePendingAuthorization(db, params) {
     ...fromStoredOAuthPendingAuthorizationData(row.auth_data)
   };
 }
+async function deletePendingAuthorizationsForServer(db, params) {
+  await db.deleteFrom("oauth_pending_authorization").where("oauth_server_id", "=", params.id).execute();
+}
 var init_pendingAuthorization = __esm({
   "src/db/sqlite/token-store/queries/pendingAuthorization.ts"() {
     "use strict";
@@ -2141,6 +2142,9 @@ async function getTokens(db, params) {
 async function deleteToken(db, params) {
   await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).where("user_id", "=", params.userRef).execute();
 }
+async function deleteTokensForServer(db, params) {
+  await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).execute();
+}
 var init_token = __esm({
   "src/db/sqlite/token-store/queries/token.ts"() {
     "use strict";
@@ -2189,6 +2193,12 @@ var init_SqliteOAuthTokenStore = __esm({
       deleteToken(params, transaction) {
         return deleteToken(transaction ?? this.db, params);
       }
+      deleteTokensForServer(params, transaction) {
+        return deleteTokensForServer(transaction ?? this.db, params);
+      }
+      deletePendingAuthorizationsForServer(params, transaction) {
+        return deletePendingAuthorizationsForServer(transaction ?? this.db, params);
+      }
     };
   }
 });
@@ -2522,12 +2532,12 @@ var redis_exports = {};
 __export(redis_exports, {
   connectRedis: () => connectRedis
 });
-import { extractErrorLogFields as extractErrorLogFields7 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields8 } from "@truefoundry/trueforge-core/core";
 import { createClient } from "redis";
 async function connectRedis(input) {
   const client = createClient({ url: input.url });
   client.on("error", (error) => {
-    input.logger.error("[Redis] Client error", extractErrorLogFields7(error));
+    input.logger.error("[Redis] Client error", extractErrorLogFields8(error));
   });
   await client.connect();
   return client;
@@ -2589,9 +2599,7 @@ var init_sqlExpressions4 = __esm({
 });
 
 // src/db/postgres/session-store/queries/turns.ts
-import {
-  CancellationReason as CancellationReason5
-} from "@truefoundry/trueforge-core/agent-session/schemas/turn";
+import "@truefoundry/trueforge-core/agent-session/schemas/turn";
 import { assertCreateTurnThreadDelta as assertCreateTurnThreadDelta2 } from "@truefoundry/trueforge-core/agent-session/store/assertCreateTurnThreadDelta";
 import {
   PreviousTurnRunningError as PreviousTurnRunningError2,
@@ -2600,7 +2608,7 @@ import {
   SessionStoreInvariantError as SessionStoreInvariantError4,
   SessionStoreNotFoundError as SessionStoreNotFoundError4,
   TurnAlreadyExistsError as TurnAlreadyExistsError2,
-  TurnNotFoundError as TurnNotFoundError3,
+  TurnNotFoundError as TurnNotFoundError4,
   TurnNotRunningError as TurnNotRunningError2
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { getEmptyCurrentContextUsage as getEmptyCurrentContextUsage2 } from "@truefoundry/trueforge-core/core/runtime/contextUsage";
@@ -2633,14 +2641,14 @@ function turnRunningFence(db, keys) {
 async function classifyTurnFenceWriteFailure2(db, keys) {
   const row = await db.selectFrom("turn").select("state").where("session_id", "=", keys.session_id).where("turn_id", "=", keys.turn_id).executeTakeFirst();
   if (!row) {
-    throw new TurnNotFoundError3(keys.turn_id);
+    throw new TurnNotFoundError4(keys.turn_id);
   }
   throw new TurnNotRunningError2(keys.turn_id, terminalTurnState2(row.state, keys.turn_id));
 }
 async function classifyTurnThreadWriteFailure2(db, keys, thread_id) {
   const row = await db.selectFrom("turn").select("state").where("session_id", "=", keys.session_id).where("turn_id", "=", keys.turn_id).executeTakeFirst();
   if (!row) {
-    throw new TurnNotFoundError3(keys.turn_id);
+    throw new TurnNotFoundError4(keys.turn_id);
   }
   if (row.state.status !== "running") {
     throw new TurnNotRunningError2(keys.turn_id, terminalTurnState2(row.state, keys.turn_id));
@@ -2650,7 +2658,7 @@ async function classifyTurnThreadWriteFailure2(db, keys, thread_id) {
 async function assertTurnRunning2(db, keys) {
   const row = await db.selectFrom("turn").select("state").where("session_id", "=", keys.session_id).where("turn_id", "=", keys.turn_id).forShare().executeTakeFirst();
   if (!row) {
-    throw new TurnNotFoundError3(keys.turn_id);
+    throw new TurnNotFoundError4(keys.turn_id);
   }
   if (row.state.status !== "running") {
     throw new TurnNotRunningError2(keys.turn_id, terminalTurnState2(row.state, keys.turn_id));
@@ -2905,7 +2913,7 @@ async function freezeAndGetTurn2(db, input) {
   return await db.transaction().execute(async (trx) => {
     const cancelledState = {
       status: "cancelled",
-      reason: CancellationReason5.CancelledForNextTurn,
+      reason: input.reason,
       completed_at: (/* @__PURE__ */ new Date()).toISOString()
     };
     const updateResult = await trx.updateTable("turn").set({
@@ -2923,7 +2931,7 @@ async function freezeAndGetTurn2(db, input) {
     }
     const record = await assembleTurnRecord2(trx, input);
     if (!record) {
-      throw new TurnNotFoundError3(input.turn_id);
+      throw new TurnNotFoundError4(input.turn_id);
     }
     return record;
   });
@@ -2964,7 +2972,7 @@ async function updateTurnState2(db, input) {
     if (numUpdated === 0) {
       const existing = await trx.selectFrom("turn").select("state").where("session_id", "=", input.session_id).where("turn_id", "=", input.turn_id).executeTakeFirst();
       if (!existing) {
-        throw new TurnNotFoundError3(input.turn_id);
+        throw new TurnNotFoundError4(input.turn_id);
       }
       throw new TurnNotRunningError2(input.turn_id, terminalTurnState2(existing.state, input.turn_id));
     }
@@ -3032,7 +3040,7 @@ import {
 } from "@truefoundry/trueforge-core/agent-session/store/SessionEventPageToken";
 import {
   SessionNotFoundError as SessionNotFoundError5,
-  TurnNotFoundError as TurnNotFoundError4
+  TurnNotFoundError as TurnNotFoundError5
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { sql as sql13 } from "kysely";
 async function appendToEvents2(db, input) {
@@ -3071,7 +3079,7 @@ async function listTurnEvents2(db, input) {
     (join) => join.onRef("e.session_id", "=", "t.session_id").onRef("e.turn_id", "=", "t.turn_id")
   ).select(["t.turn_id", "e.event"]).where("t.session_id", "=", input.session_id).where("t.turn_id", "=", input.turn_id).orderBy("e.event_id", eventOrder).execute();
   if (rows.length === 0) {
-    throw new TurnNotFoundError4(input.turn_id);
+    throw new TurnNotFoundError5(input.turn_id);
   }
   const events = [];
   for (const row of rows) {
@@ -3098,7 +3106,7 @@ async function listSessionEvents2(db, input) {
   };
   const anchor = await db.selectFrom("turn").select(["turn_id", "ancestor_ids"]).where("session_id", "=", input.session_id).where("turn_id", "=", cursor.last_turn_id).executeTakeFirst();
   if (!anchor) {
-    throw new TurnNotFoundError4(cursor.last_turn_id);
+    throw new TurnNotFoundError5(cursor.last_turn_id);
   }
   const chainIds = await resolveAncestorChain2(db, input.session_id, anchor);
   const rows = await db.selectFrom(unnestWithOrdinality(chainIds, "c")).innerJoin(
@@ -3877,6 +3885,9 @@ async function consumePendingAuthorization2(db, params) {
     ...fromStoredOAuthPendingAuthorizationData(row.auth_data)
   };
 }
+async function deletePendingAuthorizationsForServer2(db, params) {
+  await db.deleteFrom("oauth_pending_authorization").where("oauth_server_id", "=", params.id).execute();
+}
 var init_pendingAuthorization2 = __esm({
   "src/db/postgres/token-store/queries/pendingAuthorization.ts"() {
     "use strict";
@@ -3914,6 +3925,9 @@ async function getTokens2(db, params) {
 async function deleteToken2(db, params) {
   await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).where("user_id", "=", params.userRef).execute();
 }
+async function deleteTokensForServer2(db, params) {
+  await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).execute();
+}
 var init_token2 = __esm({
   "src/db/postgres/token-store/queries/token.ts"() {
     "use strict";
@@ -3962,6 +3976,12 @@ var init_PostgresOAuthTokenStore = __esm({
       deleteToken(params, transaction) {
         return deleteToken2(transaction ?? this.db, params);
       }
+      deleteTokensForServer(params, transaction) {
+        return deleteTokensForServer2(transaction ?? this.db, params);
+      }
+      deletePendingAuthorizationsForServer(params, transaction) {
+        return deletePendingAuthorizationsForServer2(transaction ?? this.db, params);
+      }
     };
   }
 });
@@ -4197,12 +4217,12 @@ var init_PostgresAgentStore = __esm({
 });
 
 // src/main.ts
-import { extractErrorLogFields as extractErrorLogFields8 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields9 } from "@truefoundry/trueforge-core/core";
 import { mkdir } from "fs/promises";
 import path6 from "path";
 import { serve } from "@hono/node-server";
 import {
-  CancellationReason as CancellationReason6,
+  CancellationReason as CancellationReason4,
   Sessions
 } from "@truefoundry/trueforge-core/agent-session";
 import { RequestReplyExecutor, RequestReplyRouter } from "@truefoundry/trueforge-core/request-reply";
@@ -4210,9 +4230,9 @@ import { RequestReplyExecutor, RequestReplyRouter } from "@truefoundry/trueforge
 // src/app.ts
 import { swaggerUI } from "@hono/swagger-ui";
 import { OpenAPIHono as OpenAPIHono14, z as z24 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields6 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields7 } from "@truefoundry/trueforge-core/core";
 import { bodyLimit } from "hono/body-limit";
-import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { HTTPException as HTTPException5 } from "hono/http-exception";
 
 // src/apis/agents.ts
 init_agentStore();
@@ -5170,10 +5190,14 @@ import {
   CancellationReason,
   SessionStoreConflictError,
   SessionStoreInvariantError,
-  SessionStoreNotFoundError
+  SessionStoreNotFoundError,
+  TurnNotFoundError
 } from "@truefoundry/trueforge-core/agent-session";
-import { NoResponderError, redisRequest, RequestTimeoutError } from "@truefoundry/trueforge-core/request-reply";
-import { HTTPException as HTTPException3 } from "hono/http-exception";
+import { extractErrorLogFields } from "@truefoundry/trueforge-core/core";
+import {
+  redisRequest,
+  RequestTimeoutError
+} from "@truefoundry/trueforge-core/request-reply";
 import { ulid as ulid2 } from "ulid";
 import { z as z11 } from "zod";
 
@@ -5594,7 +5618,8 @@ function cancelSessionTurnPeerHandler(activeTurns) {
   };
 }
 async function cancelSessionTurn(deps, input) {
-  const { sessionId, turnId, reason = CancellationReason.ClientCancelled } = input;
+  const { turnId, reason = CancellationReason.ClientCancelled } = input;
+  const sessionId = deps.session.session_id;
   const turn = await deps.sessionStore.getTurn({
     session_id: sessionId,
     turn_id: turnId
@@ -5617,33 +5642,39 @@ async function cancelSessionTurn(deps, input) {
           pollIntervalMs: config_default.REDIS_REQUEST_REPLY_POLL_INTERVAL_MS
         }
       });
-      if (reply.status !== 200 && reply.status !== 412) {
-        throw new HTTPException3(500, { message: "Failed to cancel turn on the owning executor", cause: reply });
+      if (reply.status === 200) {
+        return;
       }
     } catch (error) {
-      if (error instanceof NoResponderError) {
-        throw new HTTPException3(412, {
-          message: `Executor owning the running turn is unreachable: ${owner}`,
-          cause: error
-        });
-      }
+      const fields = {
+        sessionId,
+        turnId,
+        owner,
+        ...extractErrorLogFields(error)
+      };
       if (error instanceof RequestTimeoutError) {
-        throw new HTTPException3(424, {
-          message: "Timed out waiting for the owning executor to cancel the turn",
-          cause: error
-        });
-      }
-      if (error instanceof HTTPException3) {
-        throw error;
+        deps.logger.warn("Timed out waiting for owning executor to cancel; freezing the running turn", fields);
+      } else {
+        deps.logger.warn("Failed to reach owning executor over Redis; freezing the running turn", fields);
       }
-      throw new HTTPException3(500, {
-        message: `Unexpected error while cancelling the turn on the owning executor: ${owner}`,
-        cause: error
-      });
     }
+    await freezeTurnIgnoringMissing(deps.session, { turnId, reason });
     return;
   }
-  cancelTurnOnThisExecutor(deps.activeTurns, { sessionId, turnId, reason });
+  const aborted = cancelTurnOnThisExecutor(deps.activeTurns, { sessionId, turnId, reason });
+  if (!aborted) {
+    await freezeTurnIgnoringMissing(deps.session, { turnId, reason });
+  }
+}
+async function freezeTurnIgnoringMissing(session, input) {
+  try {
+    await session.freezeTurn({ turn_id: input.turnId, reason: input.reason });
+  } catch (error) {
+    if (error instanceof TurnNotFoundError) {
+      return;
+    }
+    throw error;
+  }
 }
 var FORBIDDEN_SESSION_ACCESS = "Only the session creator can access this session";
 function checkSessionAccess({ userRef, createdBy }) {
@@ -5773,18 +5804,18 @@ function createSessionsRouter(deps) {
   };
   const cancelSessionHandler = async (c) => {
     const { session_id: sessionId } = c.req.valid("param");
-    const record = await deps.sessionStore.getSession({ tenant_id: TENANT_ID, session_id: sessionId });
-    if (!record) {
+    const session = await deps.sessions.get({ tenant_id: TENANT_ID, session_id: sessionId });
+    if (!session) {
       return c.json({ error: { message: `Session not found: ${sessionId}` } }, 404);
     }
-    if (!checkSessionAccess({ userRef: deps.resolveUserContext(c).userRef, createdBy: record.created_by })) {
+    if (!checkSessionAccess({ userRef: deps.resolveUserContext(c).userRef, createdBy: session.record.created_by })) {
       return c.json({ error: { message: FORBIDDEN_SESSION_ACCESS } }, 403);
     }
-    const turnId = record.last_turn_id;
+    const turnId = session.record.last_turn_id;
     if (!turnId) {
       return c.json({}, 200);
     }
-    await cancelSessionTurn(deps, { sessionId, turnId });
+    await cancelSessionTurn({ ...deps, session }, { turnId });
     return c.json({}, 200);
   };
   const listSessionEventsHandler = async (c) => {
@@ -5908,7 +5939,7 @@ function createAgentsRouter(deps) {
 
 // src/apis/auth.ts
 import { OpenAPIHono as OpenAPIHono3 } from "@hono/zod-openapi";
-import { extractErrorLogFields } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields2 } from "@truefoundry/trueforge-core/core";
 
 // src/auth/cookies.ts
 init_config();
@@ -6126,7 +6157,7 @@ function resolveUserContext(c) {
 }
 
 // src/auth/middleware.ts
-import { HTTPException as HTTPException4 } from "hono/http-exception";
+import { HTTPException as HTTPException3 } from "hono/http-exception";
 import { jwtVerify } from "jose";
 var AUTH_HEADER_TYPE = "Bearer";
 function readBearerIdToken(c) {
@@ -6173,14 +6204,14 @@ var authMiddleware = async (c, next) => {
   try {
     const user = await resolveAuthUser(c);
     if (!user) {
-      throw new HTTPException4(401, { message: "Authentication required" });
+      throw new HTTPException3(401, { message: "Authentication required" });
     }
     c.set("user_context", user);
   } catch (error) {
-    if (error instanceof HTTPException4) {
+    if (error instanceof HTTPException3) {
       throw error;
     }
-    throw new HTTPException4(401, { message: "Authentication required", cause: error });
+    throw new HTTPException3(401, { message: "Authentication required", cause: error });
   }
   return next();
 };
@@ -6192,17 +6223,17 @@ var adminAuthMiddleware = async (c, next) => {
   try {
     const user = await resolveAuthUser(c);
     if (!user) {
-      throw new HTTPException4(401, { message: "Authentication required" });
+      throw new HTTPException3(401, { message: "Authentication required" });
     }
     if (!isAdmin(user)) {
-      throw new HTTPException4(403, { message: "Admin access required" });
+      throw new HTTPException3(403, { message: "Admin access required" });
     }
     c.set("user_context", user);
   } catch (error) {
-    if (error instanceof HTTPException4) {
+    if (error instanceof HTTPException3) {
       throw error;
     }
-    throw new HTTPException4(401, { message: "Authentication required", cause: error });
+    throw new HTTPException3(401, { message: "Authentication required", cause: error });
   }
   return next();
 };
@@ -6308,7 +6339,7 @@ function createAuthRouter(params) {
       });
       return c.redirect(authorizationUrl, 302);
     } catch (error) {
-      params.logger.error("Failed to build login authorization", extractErrorLogFields(error));
+      params.logger.error("Failed to build login authorization", extractErrorLogFields2(error));
       return c.redirect(oauthErrorRedirect("login_failed"), 302);
     }
   });
@@ -6334,7 +6365,7 @@ function createAuthRouter(params) {
       });
       return c.redirect(safeReturnTo(pending.return_to), 302);
     } catch (error) {
-      params.logger.error("Failed to exchange authorization code", extractErrorLogFields(error));
+      params.logger.error("Failed to exchange authorization code", extractErrorLogFields2(error));
       const reason = error instanceof Error ? error.message : "login_failed";
       return c.redirect(oauthErrorRedirect(reason), 302);
     }
@@ -6356,7 +6387,7 @@ function createAuthRouter(params) {
 
 // src/apis/capabilities.ts
 import { OpenAPIHono as OpenAPIHono4 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields2 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields3 } from "@truefoundry/trueforge-core/core";
 
 // src/routes/capabilityRoutes.ts
 import { createRoute as createRoute4, z as z14 } from "@hono/zod-openapi";
@@ -6413,7 +6444,7 @@ function createCapabilitiesRouter(deps) {
       });
       status = refreshed?.status;
     } catch (error) {
-      deps.logger.warn("Sandbox image status check failed; reporting sandbox disabled", extractErrorLogFields2(error));
+      deps.logger.warn("Sandbox image status check failed; reporting sandbox disabled", extractErrorLogFields3(error));
     }
     const sandboxEnabled = status === "ready";
     const settingsEnabled = isAdmin(resolveUserContext(c));
@@ -6797,7 +6828,7 @@ function createCatalogRouter(deps) {
 
 // src/apis/mcpOAuth.ts
 import { OpenAPIHono as OpenAPIHono6 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields3, McpConnectionError as McpConnectionError3 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields4, McpConnectionError as McpConnectionError3 } from "@truefoundry/trueforge-core/core";
 
 // src/routes/mcpOAuthRoutes.ts
 import { createRoute as createRoute6 } from "@hono/zod-openapi";
@@ -6879,10 +6910,10 @@ function createMcpOAuthRouter(deps) {
       });
     } catch (err) {
       if (err instanceof McpConnectionError3) {
-        deps.logger.warn("MCP OAuth callback token exchange failed", extractErrorLogFields3(err));
+        deps.logger.warn("MCP OAuth callback token exchange failed", extractErrorLogFields4(err));
         return callbackFailure({ c, pending, message: err.message });
       }
-      deps.logger.error("MCP OAuth callback unexpected failure", extractErrorLogFields3(err));
+      deps.logger.error("MCP OAuth callback unexpected failure", extractErrorLogFields4(err));
       return callbackFailure({ c, pending, message: "Internal server error", jsonStatus: 500 });
     }
     return callbackSuccess({ c, pending });
@@ -6896,7 +6927,7 @@ function createMcpOAuthRouter(deps) {
 init_config();
 init_mcpServerStore();
 import { OpenAPIHono as OpenAPIHono7 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields4, isAuthRequired, McpConnectionError as McpConnectionError4, RemoteMCP } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields5, isAuthRequired, McpConnectionError as McpConnectionError4, RemoteMCP } from "@truefoundry/trueforge-core/core";
 
 // src/routes/mcpServerRoutes.ts
 import { createRoute as createRoute7, z as z21 } from "@hono/zod-openapi";
@@ -7274,7 +7305,7 @@ function createSettingsMcpServersRouter(deps) {
       } catch (error) {
         deps.logger.error(
           `DCR client registration failed for "${incomingManifest.name}"; rejecting create`,
-          extractErrorLogFields4(error)
+          extractErrorLogFields5(error)
         );
         const message = error instanceof Error ? error.message : "Failed to register OAuth client for this MCP server";
         return c.json({ error: { message } }, 422);
@@ -7330,9 +7361,9 @@ function createSettingsMcpServersRouter(deps) {
           existing: existing?.manifest
         });
         let dcrClientToSave;
+        const urlChanged = existing !== void 0 && existing.manifest.url !== manifest.url && manifest.auth?.type === "dcr";
         if (manifest.auth?.type === "dcr") {
           const existingClient = existing ? await deps.mcpServerStore.getClient({ id: existing.id }, transaction) : void 0;
-          const urlChanged = existing && existing.manifest.url !== manifest.url;
           const needsDcr = existingClient === void 0 || urlChanged;
           if (needsDcr) {
             dcrClientToSave = await createMcpOAuthClient({
@@ -7354,6 +7385,10 @@ function createSettingsMcpServersRouter(deps) {
         if (dcrClientToSave !== void 0) {
           await deps.mcpServerStore.saveClient({ id: saved.id, record: dcrClientToSave }, transaction);
         }
+        if (urlChanged) {
+          await deps.tokenStore.deleteTokensForServer({ id: saved.id }, transaction);
+          await deps.tokenStore.deletePendingAuthorizationsForServer({ id: saved.id }, transaction);
+        }
         return saved;
       });
       const token = record.manifest.auth?.type === "dcr" ? await deps.tokenStore.getToken({ id: record.id, userRef }) : void 0;
@@ -7365,7 +7400,7 @@ function createSettingsMcpServersRouter(deps) {
       if (error instanceof McpConnectionError4) {
         deps.logger.error(
           `DCR client registration failed for "${incomingManifest.name}"; rejecting upsert`,
-          extractErrorLogFields4(error)
+          extractErrorLogFields5(error)
         );
         return c.json({ error: { message: error.message } }, 422);
       }
@@ -7405,7 +7440,7 @@ function createSettingsMcpServersRouter(deps) {
       return c.json({ data }, 200);
     } catch (error) {
       if (error instanceof McpConnectionError4) {
-        deps.logger.warn(`MCP tools/list failed for "${name}"`, extractErrorLogFields4(error));
+        deps.logger.warn(`MCP tools/list failed for "${name}"`, extractErrorLogFields5(error));
         if (error.statusCode === 401) {
           return c.json({ error: { message: error.message } }, 422);
         }
@@ -7452,7 +7487,7 @@ function createMcpServersRouter(deps) {
       return c.json(authStatus, 200);
     } catch (error) {
       if (error instanceof McpConnectionError4) {
-        deps.logger.warn(`MCP authorize failed for "${name}"`, extractErrorLogFields4(error));
+        deps.logger.warn(`MCP authorize failed for "${name}"`, extractErrorLogFields5(error));
         if (error.statusCode === 400) {
           return c.json({ error: { message: error.message } }, 400);
         }
@@ -7464,7 +7499,7 @@ function createMcpServersRouter(deps) {
         }
         return c.json({ error: { message: error.message } }, 500);
       }
-      deps.logger.error(`MCP authorize unexpected failure for "${name}"`, extractErrorLogFields4(error));
+      deps.logger.error(`MCP authorize unexpected failure for "${name}"`, extractErrorLogFields5(error));
       return c.json({ error: { message: "Internal server error" } }, 500);
     }
   };
@@ -8067,7 +8102,7 @@ import {
 } from "@truefoundry/trueforge-core/agent-session";
 import {
   AgentHarnessError,
-  extractErrorLogFields as extractErrorLogFields5,
+  extractErrorLogFields as extractErrorLogFields6,
   isAgentInputUserMessage,
   isFileContentPart,
   McpConnectionError as McpConnectionError5,
@@ -8075,7 +8110,7 @@ import {
   validateSandboxOwnedByTenant,
   VercelAILLM
 } from "@truefoundry/trueforge-core/core";
-import { HTTPException as HTTPException5 } from "hono/http-exception";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
 import { streamSSE } from "hono/streaming";
 
 // src/routes/turnRoutes.ts
@@ -8660,7 +8695,7 @@ function createTurnResolver(deps) {
         userRef
       });
       if (connection === void 0) {
-        throw new HTTPException5(422, {
+        throw new HTTPException4(422, {
           message: `Unknown MCP server "${name}" \u2014 not configured`
         });
       }
@@ -8675,14 +8710,14 @@ function createTurnResolver(deps) {
         logger
       });
       if (provider === void 0) {
-        throw new HTTPException5(422, {
+        throw new HTTPException4(422, {
           message: "no sandbox provider configured \u2014 PUT /settings/sandbox-providers"
         });
       }
       if (existingSandboxId === void 0) {
         const status = await checkSnapshotStatus({ store: sandboxProviderStore, tenant_id: TENANT_ID, logger });
         if (status?.status !== "ready") {
-          throw new HTTPException5(422, {
+          throw new HTTPException4(422, {
             message: status?.status === "failed" ? `sandbox image build failed (${status.status_reason ?? "unknown error"})` : "sandbox image is activating \u2014 retry shortly"
           });
         }
@@ -8705,7 +8740,7 @@ function createTurnResolver(deps) {
     agent: async (agentId) => {
       const record = await agentStore.getAgent({ tenant_id: TENANT_ID, id: agentId });
       if (record === void 0) {
-        throw new HTTPException5(422, { message: `Agent not found: ${agentId}` });
+        throw new HTTPException4(422, { message: `Agent not found: ${agentId}` });
       }
       return record.manifest;
     },
@@ -8757,13 +8792,13 @@ async function drainTurnEvents(input) {
       logger.warn("Turn stream ended after session/turn was removed", {
         sessionId,
         turnId,
-        ...extractErrorLogFields5(error)
+        ...extractErrorLogFields6(error)
       });
     } else {
       logger.error("Unexpected error in turn event drain", {
         sessionId,
         turnId,
-        ...extractErrorLogFields5(error)
+        ...extractErrorLogFields6(error)
       });
     }
   } finally {
@@ -8775,7 +8810,7 @@ function resolveAfterSequenceNumber(c, bodyAfterSequenceNumber) {
   if (lastEventId) {
     const sequenceNumber = Number(lastEventId);
     if (!Number.isInteger(sequenceNumber) || sequenceNumber < 0) {
-      throw new HTTPException5(400, { message: "Invalid Last-Event-Id header" });
+      throw new HTTPException4(400, { message: "Invalid Last-Event-Id header" });
     }
     return sequenceNumber;
   }
@@ -8867,7 +8902,7 @@ function createTurnsRouter(deps) {
         return c.json({ error: { message: error.message } }, error.statusCode);
       }
       deps.logger.error("Sandbox file download failed", {
-        ...extractErrorLogFields5(error),
+        ...extractErrorLogFields6(error),
         sessionId,
         turnId,
         sandboxId,
@@ -9003,7 +9038,7 @@ function createTurnsRouter(deps) {
             try {
               await stream.writeSSE(turnEventSsePayload(event, sequenceNumber));
             } catch (error) {
-              deps.logger.error("SSE stream write error", extractErrorLogFields5(error));
+              deps.logger.error("SSE stream write error", extractErrorLogFields6(error));
               shouldWriteToSSEStream = false;
             }
           }
@@ -9032,7 +9067,7 @@ function createTurnsRouter(deps) {
       await turnEventStream.assertSubscribable();
     } catch (error) {
       if (error instanceof StreamGoneError) {
-        throw new HTTPException5(412, { message: error.message, cause: error });
+        throw new HTTPException4(412, { message: error.message, cause: error });
       }
       throw error;
     }
@@ -9061,7 +9096,7 @@ function createTurnsRouter(deps) {
         }
       } catch (error) {
         if (!subscribeAbort.signal.aborted) {
-          deps.logger.error("Unexpected error in turn subscribe SSE loop", extractErrorLogFields5(error));
+          deps.logger.error("Unexpected error in turn subscribe SSE loop", extractErrorLogFields6(error));
         }
       } finally {
         clearTimeout(timeoutHandler);
@@ -9128,16 +9163,16 @@ function createAppErrorHandler(params) {
     if (error instanceof z24.ZodError) {
       return zodErrorResponse(c, error);
     }
-    if (error instanceof HTTPException6) {
+    if (error instanceof HTTPException5) {
       if (error.status >= 500) {
         params.logger.error("Server API error", {
           status: error.status,
-          ...extractErrorLogFields6(error)
+          ...extractErrorLogFields7(error)
         });
       }
       return c.json({ error: { message: error.message } }, error.status);
     }
-    params.logger.error("Unhandled error", extractErrorLogFields6(error));
+    params.logger.error("Unhandled error", extractErrorLogFields7(error));
     return c.json({ error: { message: "Internal server error" } }, 500);
   };
 }
@@ -9289,7 +9324,8 @@ function createServerApp(deps) {
         sandboxProviderStore: deps.sandboxProviderStore,
         redis: deps.redis,
         requestReplyRouter: deps.requestReplyRouter,
-        resolveUserContext
+        resolveUserContext,
+        logger: deps.logger
       })
     )
   );
@@ -10080,7 +10116,7 @@ try {
   if (redis) {
     requestReplySubscriber = redis.duplicate();
     requestReplySubscriber.on("error", (error) => {
-      logger.error("[RedisSubscriber] Client error", extractErrorLogFields8(error));
+      logger.error("[RedisSubscriber] Client error", extractErrorLogFields9(error));
     });
     await requestReplySubscriber.connect();
     requestReplyExecutor = new RequestReplyExecutor({
@@ -10120,14 +10156,14 @@ try {
           resolve();
         });
       });
-      await activeTurns.shutdownAndWait(CancellationReason6.Abandoned);
+      await activeTurns.shutdownAndWait(CancellationReason4.Abandoned);
       await closed;
       await requestReplyExecutor?.drain();
       await requestReplySubscriber?.close().catch((error) => {
-        logger.warn("[Redis] Error closing subscriber client during shutdown", extractErrorLogFields8(error));
+        logger.warn("[Redis] Error closing subscriber client during shutdown", extractErrorLogFields9(error));
       });
       await redis?.close().catch((error) => {
-        logger.warn("[Redis] Error closing client during shutdown", extractErrorLogFields8(error));
+        logger.warn("[Redis] Error closing client during shutdown", extractErrorLogFields9(error));
       });
       await destroyDb();
       process.exit(0);