@truefoundry/trueforge 0.1.1 → 0.1.3

package/dist/main.js

@@ -380,14 +380,14 @@ function toStoredOAuthPendingAuthorizationData(pending) {
   return {
     mcp_server_url: pending.mcpServerUrl,
     code_verifier: pending.codeVerifier,
-    redirect_url: pending.redirectUrl
+    return_to: pending.returnTo
   };
 }
 function fromStoredOAuthPendingAuthorizationData(stored) {
   return {
     mcpServerUrl: stored.mcp_server_url,
     codeVerifier: stored.code_verifier,
-    redirectUrl: stored.redirect_url
+    returnTo: stored.return_to
   };
 }
 var McpServerNameConflictError, PENDING_AUTHORIZATION_TTL_MS;
@@ -655,9 +655,7 @@ var init_sqlExpressions2 = __esm({
 });
 
 // src/db/sqlite/session-store/queries/turns.ts
-import {
-  CancellationReason as CancellationReason4
-} from "@truefoundry/trueforge-core/agent-session/schemas/turn";
+import "@truefoundry/trueforge-core/agent-session/schemas/turn";
 import { assertCreateTurnThreadDelta } from "@truefoundry/trueforge-core/agent-session/store/assertCreateTurnThreadDelta";
 import {
   PreviousTurnRunningError,
@@ -666,7 +664,7 @@ import {
   SessionStoreInvariantError as SessionStoreInvariantError2,
   SessionStoreNotFoundError as SessionStoreNotFoundError3,
   TurnAlreadyExistsError,
-  TurnNotFoundError,
+  TurnNotFoundError as TurnNotFoundError2,
   TurnNotRunningError
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { getEmptyCurrentContextUsage } from "@truefoundry/trueforge-core/core/runtime/contextUsage";
@@ -700,14 +698,14 @@ async function loadTurnState(db, keys) {
 async function classifyTurnFenceWriteFailure(db, keys) {
   const state = await loadTurnState(db, keys);
   if (!state) {
-    throw new TurnNotFoundError(keys.turn_id);
+    throw new TurnNotFoundError2(keys.turn_id);
   }
   throw new TurnNotRunningError(keys.turn_id, terminalTurnState(state, keys.turn_id));
 }
 async function classifyTurnThreadWriteFailure(db, keys, thread_id) {
   const state = await loadTurnState(db, keys);
   if (!state) {
-    throw new TurnNotFoundError(keys.turn_id);
+    throw new TurnNotFoundError2(keys.turn_id);
   }
   if (state.status !== "running") {
     throw new TurnNotRunningError(keys.turn_id, terminalTurnState(state, keys.turn_id));
@@ -717,7 +715,7 @@ async function classifyTurnThreadWriteFailure(db, keys, thread_id) {
 async function assertTurnRunning(db, keys) {
   const state = await loadTurnState(db, keys);
   if (!state) {
-    throw new TurnNotFoundError(keys.turn_id);
+    throw new TurnNotFoundError2(keys.turn_id);
   }
   if (state.status !== "running") {
     throw new TurnNotRunningError(keys.turn_id, terminalTurnState(state, keys.turn_id));
@@ -1048,7 +1046,7 @@ async function freezeAndGetTurn(db, input) {
   return await db.transaction().execute(async (trx) => {
     const cancelledState = {
       status: "cancelled",
-      reason: CancellationReason4.CancelledForNextTurn,
+      reason: input.reason,
       completed_at: nowIso()
     };
     const updateResult = await trx.updateTable("turn").set({
@@ -1066,7 +1064,7 @@ async function freezeAndGetTurn(db, input) {
     }
     const record = await assembleTurnRecord(trx, input);
     if (!record) {
-      throw new TurnNotFoundError(input.turn_id);
+      throw new TurnNotFoundError2(input.turn_id);
     }
     return record;
   });
@@ -1116,7 +1114,7 @@ async function updateTurnState(db, input) {
     if (numUpdated === 0) {
       const existing = await trx.selectFrom("turn").select([jsonText(sql2.ref("state")).as("state")]).where("session_id", "=", input.session_id).where("turn_id", "=", input.turn_id).executeTakeFirst();
       if (!existing) {
-        throw new TurnNotFoundError(input.turn_id);
+        throw new TurnNotFoundError2(input.turn_id);
       }
       throw new TurnNotRunningError(input.turn_id, terminalTurnState(existing.state, input.turn_id));
     }
@@ -1182,7 +1180,7 @@ import {
 } from "@truefoundry/trueforge-core/agent-session/store/SessionEventPageToken";
 import {
   SessionNotFoundError as SessionNotFoundError2,
-  TurnNotFoundError as TurnNotFoundError2
+  TurnNotFoundError as TurnNotFoundError3
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { sql as sql4 } from "kysely";
 async function appendToEvents(db, input) {
@@ -1217,7 +1215,7 @@ async function listTurnEvents(db, input) {
     (join) => join.onRef("e.session_id", "=", "t.session_id").onRef("e.turn_id", "=", "t.turn_id")
   ).select(["t.turn_id", "e.event"]).where("t.session_id", "=", input.session_id).where("t.turn_id", "=", input.turn_id).orderBy("e.event_id", eventOrder).execute();
   if (rows.length === 0) {
-    throw new TurnNotFoundError2(input.turn_id);
+    throw new TurnNotFoundError3(input.turn_id);
   }
   const events = [];
   for (const row of rows) {
@@ -1265,7 +1263,7 @@ async function listSessionEvents(db, input) {
   };
   const anchor = await db.selectFrom("turn").select(["turn_id", jsonText(sql4.ref("ancestor_ids")).as("ancestor_ids")]).where("session_id", "=", input.session_id).where("turn_id", "=", cursor.last_turn_id).executeTakeFirst();
   if (!anchor) {
-    throw new TurnNotFoundError2(cursor.last_turn_id);
+    throw new TurnNotFoundError3(cursor.last_turn_id);
   }
   const chainIds = await resolveAncestorChain(db, input.session_id, {
     turn_id: anchor.turn_id,
@@ -2104,6 +2102,9 @@ async function consumePendingAuthorization(db, params) {
     ...fromStoredOAuthPendingAuthorizationData(row.auth_data)
   };
 }
+async function deletePendingAuthorizationsForServer(db, params) {
+  await db.deleteFrom("oauth_pending_authorization").where("oauth_server_id", "=", params.id).execute();
+}
 var init_pendingAuthorization = __esm({
   "src/db/sqlite/token-store/queries/pendingAuthorization.ts"() {
     "use strict";
@@ -2141,6 +2142,9 @@ async function getTokens(db, params) {
 async function deleteToken(db, params) {
   await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).where("user_id", "=", params.userRef).execute();
 }
+async function deleteTokensForServer(db, params) {
+  await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).execute();
+}
 var init_token = __esm({
   "src/db/sqlite/token-store/queries/token.ts"() {
     "use strict";
@@ -2189,6 +2193,12 @@ var init_SqliteOAuthTokenStore = __esm({
       deleteToken(params, transaction) {
         return deleteToken(transaction ?? this.db, params);
       }
+      deleteTokensForServer(params, transaction) {
+        return deleteTokensForServer(transaction ?? this.db, params);
+      }
+      deletePendingAuthorizationsForServer(params, transaction) {
+        return deletePendingAuthorizationsForServer(transaction ?? this.db, params);
+      }
     };
   }
 });
@@ -2522,12 +2532,12 @@ var redis_exports = {};
 __export(redis_exports, {
   connectRedis: () => connectRedis
 });
-import { extractErrorLogFields as extractErrorLogFields7 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields8 } from "@truefoundry/trueforge-core/core";
 import { createClient } from "redis";
 async function connectRedis(input) {
   const client = createClient({ url: input.url });
   client.on("error", (error) => {
-    input.logger.error("[Redis] Client error", extractErrorLogFields7(error));
+    input.logger.error("[Redis] Client error", extractErrorLogFields8(error));
   });
   await client.connect();
   return client;
@@ -2589,9 +2599,7 @@ var init_sqlExpressions4 = __esm({
 });
 
 // src/db/postgres/session-store/queries/turns.ts
-import {
-  CancellationReason as CancellationReason5
-} from "@truefoundry/trueforge-core/agent-session/schemas/turn";
+import "@truefoundry/trueforge-core/agent-session/schemas/turn";
 import { assertCreateTurnThreadDelta as assertCreateTurnThreadDelta2 } from "@truefoundry/trueforge-core/agent-session/store/assertCreateTurnThreadDelta";
 import {
   PreviousTurnRunningError as PreviousTurnRunningError2,
@@ -2600,7 +2608,7 @@ import {
   SessionStoreInvariantError as SessionStoreInvariantError4,
   SessionStoreNotFoundError as SessionStoreNotFoundError4,
   TurnAlreadyExistsError as TurnAlreadyExistsError2,
-  TurnNotFoundError as TurnNotFoundError3,
+  TurnNotFoundError as TurnNotFoundError4,
   TurnNotRunningError as TurnNotRunningError2
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { getEmptyCurrentContextUsage as getEmptyCurrentContextUsage2 } from "@truefoundry/trueforge-core/core/runtime/contextUsage";
@@ -2633,14 +2641,14 @@ function turnRunningFence(db, keys) {
 async function classifyTurnFenceWriteFailure2(db, keys) {
   const row = await db.selectFrom("turn").select("state").where("session_id", "=", keys.session_id).where("turn_id", "=", keys.turn_id).executeTakeFirst();
   if (!row) {
-    throw new TurnNotFoundError3(keys.turn_id);
+    throw new TurnNotFoundError4(keys.turn_id);
   }
   throw new TurnNotRunningError2(keys.turn_id, terminalTurnState2(row.state, keys.turn_id));
 }
 async function classifyTurnThreadWriteFailure2(db, keys, thread_id) {
   const row = await db.selectFrom("turn").select("state").where("session_id", "=", keys.session_id).where("turn_id", "=", keys.turn_id).executeTakeFirst();
   if (!row) {
-    throw new TurnNotFoundError3(keys.turn_id);
+    throw new TurnNotFoundError4(keys.turn_id);
   }
   if (row.state.status !== "running") {
     throw new TurnNotRunningError2(keys.turn_id, terminalTurnState2(row.state, keys.turn_id));
@@ -2650,7 +2658,7 @@ async function classifyTurnThreadWriteFailure2(db, keys, thread_id) {
 async function assertTurnRunning2(db, keys) {
   const row = await db.selectFrom("turn").select("state").where("session_id", "=", keys.session_id).where("turn_id", "=", keys.turn_id).forShare().executeTakeFirst();
   if (!row) {
-    throw new TurnNotFoundError3(keys.turn_id);
+    throw new TurnNotFoundError4(keys.turn_id);
   }
   if (row.state.status !== "running") {
     throw new TurnNotRunningError2(keys.turn_id, terminalTurnState2(row.state, keys.turn_id));
@@ -2905,7 +2913,7 @@ async function freezeAndGetTurn2(db, input) {
   return await db.transaction().execute(async (trx) => {
     const cancelledState = {
       status: "cancelled",
-      reason: CancellationReason5.CancelledForNextTurn,
+      reason: input.reason,
       completed_at: (/* @__PURE__ */ new Date()).toISOString()
     };
     const updateResult = await trx.updateTable("turn").set({
@@ -2923,7 +2931,7 @@ async function freezeAndGetTurn2(db, input) {
     }
     const record = await assembleTurnRecord2(trx, input);
     if (!record) {
-      throw new TurnNotFoundError3(input.turn_id);
+      throw new TurnNotFoundError4(input.turn_id);
     }
     return record;
   });
@@ -2964,7 +2972,7 @@ async function updateTurnState2(db, input) {
     if (numUpdated === 0) {
       const existing = await trx.selectFrom("turn").select("state").where("session_id", "=", input.session_id).where("turn_id", "=", input.turn_id).executeTakeFirst();
       if (!existing) {
-        throw new TurnNotFoundError3(input.turn_id);
+        throw new TurnNotFoundError4(input.turn_id);
       }
       throw new TurnNotRunningError2(input.turn_id, terminalTurnState2(existing.state, input.turn_id));
     }
@@ -3032,7 +3040,7 @@ import {
 } from "@truefoundry/trueforge-core/agent-session/store/SessionEventPageToken";
 import {
   SessionNotFoundError as SessionNotFoundError5,
-  TurnNotFoundError as TurnNotFoundError4
+  TurnNotFoundError as TurnNotFoundError5
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { sql as sql13 } from "kysely";
 async function appendToEvents2(db, input) {
@@ -3071,7 +3079,7 @@ async function listTurnEvents2(db, input) {
     (join) => join.onRef("e.session_id", "=", "t.session_id").onRef("e.turn_id", "=", "t.turn_id")
   ).select(["t.turn_id", "e.event"]).where("t.session_id", "=", input.session_id).where("t.turn_id", "=", input.turn_id).orderBy("e.event_id", eventOrder).execute();
   if (rows.length === 0) {
-    throw new TurnNotFoundError4(input.turn_id);
+    throw new TurnNotFoundError5(input.turn_id);
   }
   const events = [];
   for (const row of rows) {
@@ -3098,7 +3106,7 @@ async function listSessionEvents2(db, input) {
   };
   const anchor = await db.selectFrom("turn").select(["turn_id", "ancestor_ids"]).where("session_id", "=", input.session_id).where("turn_id", "=", cursor.last_turn_id).executeTakeFirst();
   if (!anchor) {
-    throw new TurnNotFoundError4(cursor.last_turn_id);
+    throw new TurnNotFoundError5(cursor.last_turn_id);
   }
   const chainIds = await resolveAncestorChain2(db, input.session_id, anchor);
   const rows = await db.selectFrom(unnestWithOrdinality(chainIds, "c")).innerJoin(
@@ -3877,6 +3885,9 @@ async function consumePendingAuthorization2(db, params) {
     ...fromStoredOAuthPendingAuthorizationData(row.auth_data)
   };
 }
+async function deletePendingAuthorizationsForServer2(db, params) {
+  await db.deleteFrom("oauth_pending_authorization").where("oauth_server_id", "=", params.id).execute();
+}
 var init_pendingAuthorization2 = __esm({
   "src/db/postgres/token-store/queries/pendingAuthorization.ts"() {
     "use strict";
@@ -3914,6 +3925,9 @@ async function getTokens2(db, params) {
 async function deleteToken2(db, params) {
   await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).where("user_id", "=", params.userRef).execute();
 }
+async function deleteTokensForServer2(db, params) {
+  await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).execute();
+}
 var init_token2 = __esm({
   "src/db/postgres/token-store/queries/token.ts"() {
     "use strict";
@@ -3962,6 +3976,12 @@ var init_PostgresOAuthTokenStore = __esm({
       deleteToken(params, transaction) {
         return deleteToken2(transaction ?? this.db, params);
       }
+      deleteTokensForServer(params, transaction) {
+        return deleteTokensForServer2(transaction ?? this.db, params);
+      }
+      deletePendingAuthorizationsForServer(params, transaction) {
+        return deletePendingAuthorizationsForServer2(transaction ?? this.db, params);
+      }
     };
   }
 });
@@ -4197,12 +4217,12 @@ var init_PostgresAgentStore = __esm({
 });
 
 // src/main.ts
-import { extractErrorLogFields as extractErrorLogFields8 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields9 } from "@truefoundry/trueforge-core/core";
 import { mkdir } from "fs/promises";
 import path6 from "path";
 import { serve } from "@hono/node-server";
 import {
-  CancellationReason as CancellationReason6,
+  CancellationReason as CancellationReason4,
   Sessions
 } from "@truefoundry/trueforge-core/agent-session";
 import { RequestReplyExecutor, RequestReplyRouter } from "@truefoundry/trueforge-core/request-reply";
@@ -4210,9 +4230,9 @@ import { RequestReplyExecutor, RequestReplyRouter } from "@truefoundry/trueforge
 // src/app.ts
 import { swaggerUI } from "@hono/swagger-ui";
 import { OpenAPIHono as OpenAPIHono14, z as z24 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields6 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields7 } from "@truefoundry/trueforge-core/core";
 import { bodyLimit } from "hono/body-limit";
-import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { HTTPException as HTTPException5 } from "hono/http-exception";
 
 // src/apis/agents.ts
 init_agentStore();
@@ -4491,19 +4511,6 @@ function isOAuthAccessTokenUsable(expiresAtIso, nowMs) {
   const expiresAtMs = Date.parse(expiresAtIso);
   return !Number.isNaN(expiresAtMs) && expiresAtMs > nowMs;
 }
-function validateRedirectUris({ redirectUris }) {
-  for (const redirectUri of redirectUris) {
-    let parsed;
-    try {
-      parsed = new URL(redirectUri);
-    } catch (error) {
-      throw new McpConnectionError(`Invalid redirect URI: ${redirectUri}. Must be a valid URL.`, 400, { cause: error });
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      throw new McpConnectionError(`Invalid redirect URI: ${redirectUri}. Must be a valid URL.`, 400);
-    }
-  }
-}
 
 // src/mcp/auth/mcpDcr.ts
 var MCP_OAUTH_HTTP_TIMEOUT_MS = 15e3;
@@ -4654,7 +4661,7 @@ async function buildMcpAuthorizationUrl(params) {
     userRef: params.userRef,
     mcpServerUrl: params.mcpServerUrl,
     codeVerifier: started.codeVerifier,
-    redirectUrl: params.redirectUrl ?? null
+    returnTo: params.returnTo ?? null
   });
   return started.authorizationUrl;
 }
@@ -4697,7 +4704,7 @@ async function resolveMcpAuth(params) {
     userRef: params.userRef,
     mcpServerUrl: params.mcpServerUrl,
     mcpServerName: params.mcpServerName,
-    ...params.redirectUrl !== void 0 ? { redirectUrl: params.redirectUrl } : {}
+    ...params.returnTo !== void 0 ? { returnTo: params.returnTo } : {}
   });
   return { authUrl };
 }
@@ -5084,9 +5091,7 @@ function buildTurnSandbox(input) {
     blockDestructiveToolsInCodeMode: true,
     mcpRequestTimeoutMs: config_default.MCP_REQUEST_TIMEOUT_MS,
     mcpConnectTimeoutMs: config_default.MCP_CONNECT_TIMEOUT_MS,
-    // Sandbox reads its tenant from TFY_TENANT_NAME for the ownership check
-    // against provider-created sandbox ids (`<tenant>.<uuid>`).
-    execExtraEnv: { TFY_TENANT_NAME: input.tenantName },
+    tenantName: input.tenantName,
     ...skillMounter ? { skillMounter } : {},
     tracing: input.tracing,
     logger: input.logger
@@ -5170,10 +5175,14 @@ import {
   CancellationReason,
   SessionStoreConflictError,
   SessionStoreInvariantError,
-  SessionStoreNotFoundError
+  SessionStoreNotFoundError,
+  TurnNotFoundError
 } from "@truefoundry/trueforge-core/agent-session";
-import { NoResponderError, redisRequest, RequestTimeoutError } from "@truefoundry/trueforge-core/request-reply";
-import { HTTPException as HTTPException3 } from "hono/http-exception";
+import { extractErrorLogFields } from "@truefoundry/trueforge-core/core";
+import {
+  redisRequest,
+  RequestTimeoutError
+} from "@truefoundry/trueforge-core/request-reply";
 import { ulid as ulid2 } from "ulid";
 import { z as z11 } from "zod";
 
@@ -5594,7 +5603,8 @@ function cancelSessionTurnPeerHandler(activeTurns) {
   };
 }
 async function cancelSessionTurn(deps, input) {
-  const { sessionId, turnId, reason = CancellationReason.ClientCancelled } = input;
+  const { turnId, reason = CancellationReason.ClientCancelled } = input;
+  const sessionId = deps.session.session_id;
   const turn = await deps.sessionStore.getTurn({
     session_id: sessionId,
     turn_id: turnId
@@ -5617,33 +5627,39 @@ async function cancelSessionTurn(deps, input) {
           pollIntervalMs: config_default.REDIS_REQUEST_REPLY_POLL_INTERVAL_MS
         }
       });
-      if (reply.status !== 200 && reply.status !== 412) {
-        throw new HTTPException3(500, { message: "Failed to cancel turn on the owning executor", cause: reply });
+      if (reply.status === 200) {
+        return;
       }
     } catch (error) {
-      if (error instanceof NoResponderError) {
-        throw new HTTPException3(412, {
-          message: `Executor owning the running turn is unreachable: ${owner}`,
-          cause: error
-        });
-      }
+      const fields = {
+        sessionId,
+        turnId,
+        owner,
+        ...extractErrorLogFields(error)
+      };
       if (error instanceof RequestTimeoutError) {
-        throw new HTTPException3(424, {
-          message: "Timed out waiting for the owning executor to cancel the turn",
-          cause: error
-        });
-      }
-      if (error instanceof HTTPException3) {
-        throw error;
+        deps.logger.warn("Timed out waiting for owning executor to cancel; freezing the running turn", fields);
+      } else {
+        deps.logger.warn("Failed to reach owning executor over Redis; freezing the running turn", fields);
       }
-      throw new HTTPException3(500, {
-        message: `Unexpected error while cancelling the turn on the owning executor: ${owner}`,
-        cause: error
-      });
     }
+    await freezeTurnIgnoringMissing(deps.session, { turnId, reason });
     return;
   }
-  cancelTurnOnThisExecutor(deps.activeTurns, { sessionId, turnId, reason });
+  const aborted = cancelTurnOnThisExecutor(deps.activeTurns, { sessionId, turnId, reason });
+  if (!aborted) {
+    await freezeTurnIgnoringMissing(deps.session, { turnId, reason });
+  }
+}
+async function freezeTurnIgnoringMissing(session, input) {
+  try {
+    await session.freezeTurn({ turn_id: input.turnId, reason: input.reason });
+  } catch (error) {
+    if (error instanceof TurnNotFoundError) {
+      return;
+    }
+    throw error;
+  }
 }
 var FORBIDDEN_SESSION_ACCESS = "Only the session creator can access this session";
 function checkSessionAccess({ userRef, createdBy }) {
@@ -5773,18 +5789,18 @@ function createSessionsRouter(deps) {
   };
   const cancelSessionHandler = async (c) => {
     const { session_id: sessionId } = c.req.valid("param");
-    const record = await deps.sessionStore.getSession({ tenant_id: TENANT_ID, session_id: sessionId });
-    if (!record) {
+    const session = await deps.sessions.get({ tenant_id: TENANT_ID, session_id: sessionId });
+    if (!session) {
       return c.json({ error: { message: `Session not found: ${sessionId}` } }, 404);
     }
-    if (!checkSessionAccess({ userRef: deps.resolveUserContext(c).userRef, createdBy: record.created_by })) {
+    if (!checkSessionAccess({ userRef: deps.resolveUserContext(c).userRef, createdBy: session.record.created_by })) {
       return c.json({ error: { message: FORBIDDEN_SESSION_ACCESS } }, 403);
     }
-    const turnId = record.last_turn_id;
+    const turnId = session.record.last_turn_id;
     if (!turnId) {
       return c.json({}, 200);
     }
-    await cancelSessionTurn(deps, { sessionId, turnId });
+    await cancelSessionTurn({ ...deps, session }, { turnId });
     return c.json({}, 200);
   };
   const listSessionEventsHandler = async (c) => {
@@ -5908,7 +5924,7 @@ function createAgentsRouter(deps) {
 
 // src/apis/auth.ts
 import { OpenAPIHono as OpenAPIHono3 } from "@hono/zod-openapi";
-import { extractErrorLogFields } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields2 } from "@truefoundry/trueforge-core/core";
 
 // src/auth/cookies.ts
 init_config();
@@ -6013,6 +6029,18 @@ function buildAuthorizationRequestParams(config) {
   };
 }
 
+// src/auth/safeReturnTo.ts
+var SAFE_RETURN_TO = /^\/(?!\/|api(?:\/|$)).*/;
+function isSafeReturnTo(value) {
+  return SAFE_RETURN_TO.test(value);
+}
+function safeReturnTo(value) {
+  if (value && isSafeReturnTo(value)) {
+    return value;
+  }
+  return "/";
+}
+
 // src/auth/oidc.ts
 var CALLBACK_PATH = "/api/v1/auth/callback";
 var OAUTH_STATE_MAX_AGE_SECONDS = 10 * 60;
@@ -6049,13 +6077,6 @@ function authCallbackUrl() {
   const publicBaseUrl = getPublicBaseUrl();
   return `${publicBaseUrl}${CALLBACK_PATH}`;
 }
-var SAFE_RETURN_TO = /^\/(?!\/|api(?:\/|$)).*/;
-function safeReturnTo(value) {
-  if (value && SAFE_RETURN_TO.test(value)) {
-    return value;
-  }
-  return "/";
-}
 async function buildLoginAuthorization(params) {
   const oidcConfig = getOidcVerify()?.oidcConfig;
   if (!oidcConfig) {
@@ -6126,7 +6147,7 @@ function resolveUserContext(c) {
 }
 
 // src/auth/middleware.ts
-import { HTTPException as HTTPException4 } from "hono/http-exception";
+import { HTTPException as HTTPException3 } from "hono/http-exception";
 import { jwtVerify } from "jose";
 var AUTH_HEADER_TYPE = "Bearer";
 function readBearerIdToken(c) {
@@ -6173,14 +6194,14 @@ var authMiddleware = async (c, next) => {
   try {
     const user = await resolveAuthUser(c);
     if (!user) {
-      throw new HTTPException4(401, { message: "Authentication required" });
+      throw new HTTPException3(401, { message: "Authentication required" });
     }
     c.set("user_context", user);
   } catch (error) {
-    if (error instanceof HTTPException4) {
+    if (error instanceof HTTPException3) {
       throw error;
     }
-    throw new HTTPException4(401, { message: "Authentication required", cause: error });
+    throw new HTTPException3(401, { message: "Authentication required", cause: error });
   }
   return next();
 };
@@ -6192,17 +6213,17 @@ var adminAuthMiddleware = async (c, next) => {
   try {
     const user = await resolveAuthUser(c);
     if (!user) {
-      throw new HTTPException4(401, { message: "Authentication required" });
+      throw new HTTPException3(401, { message: "Authentication required" });
     }
     if (!isAdmin(user)) {
-      throw new HTTPException4(403, { message: "Admin access required" });
+      throw new HTTPException3(403, { message: "Admin access required" });
     }
     c.set("user_context", user);
   } catch (error) {
-    if (error instanceof HTTPException4) {
+    if (error instanceof HTTPException3) {
       throw error;
     }
-    throw new HTTPException4(401, { message: "Authentication required", cause: error });
+    throw new HTTPException3(401, { message: "Authentication required", cause: error });
   }
   return next();
 };
@@ -6222,7 +6243,7 @@ var OAuthCallbackQuerySchema = z13.object({
   error_description: z13.string().optional().describe("Human-readable error detail from the identity provider when `error` is set.")
 });
 var OAuthCallbackSuccessSchema = z13.object({
-  success: z13.literal(true).describe("Present when the OAuth callback completed without a redirect_url.")
+  success: z13.literal(true).describe("Present when the OAuth callback completed without a return_to.")
 });
 var MeResponseSchema = z13.object({
   type: z13.enum(["default", "oidc-connected"]).describe(
@@ -6308,7 +6329,7 @@ function createAuthRouter(params) {
       });
       return c.redirect(authorizationUrl, 302);
     } catch (error) {
-      params.logger.error("Failed to build login authorization", extractErrorLogFields(error));
+      params.logger.error("Failed to build login authorization", extractErrorLogFields2(error));
       return c.redirect(oauthErrorRedirect("login_failed"), 302);
     }
   });
@@ -6334,7 +6355,7 @@ function createAuthRouter(params) {
       });
       return c.redirect(safeReturnTo(pending.return_to), 302);
     } catch (error) {
-      params.logger.error("Failed to exchange authorization code", extractErrorLogFields(error));
+      params.logger.error("Failed to exchange authorization code", extractErrorLogFields2(error));
       const reason = error instanceof Error ? error.message : "login_failed";
       return c.redirect(oauthErrorRedirect(reason), 302);
     }
@@ -6356,7 +6377,7 @@ function createAuthRouter(params) {
 
 // src/apis/capabilities.ts
 import { OpenAPIHono as OpenAPIHono4 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields2 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields3 } from "@truefoundry/trueforge-core/core";
 
 // src/routes/capabilityRoutes.ts
 import { createRoute as createRoute4, z as z14 } from "@hono/zod-openapi";
@@ -6413,7 +6434,7 @@ function createCapabilitiesRouter(deps) {
       });
       status = refreshed?.status;
     } catch (error) {
-      deps.logger.warn("Sandbox image status check failed; reporting sandbox disabled", extractErrorLogFields2(error));
+      deps.logger.warn("Sandbox image status check failed; reporting sandbox disabled", extractErrorLogFields3(error));
     }
     const sandboxEnabled = status === "ready";
     const settingsEnabled = isAdmin(resolveUserContext(c));
@@ -6797,7 +6818,7 @@ function createCatalogRouter(deps) {
 
 // src/apis/mcpOAuth.ts
 import { OpenAPIHono as OpenAPIHono6 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields3, McpConnectionError as McpConnectionError3 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields4, McpConnectionError as McpConnectionError3 } from "@truefoundry/trueforge-core/core";
 
 // src/routes/mcpOAuthRoutes.ts
 import { createRoute as createRoute6 } from "@hono/zod-openapi";
@@ -6807,7 +6828,7 @@ var mcpOAuthCallbackRoute = createRoute6({
   path: "/callback",
   tags: [MCP_OAUTH_TAG],
   summary: "OAuth callback for MCP authorization",
-  description: "Browser redirect target for MCP server OAuth. The authorization server redirects here with `code`/`state` (or `error`). Exchanges the code for tokens, then either returns JSON or redirects to the `redirect_url` supplied at authorize time. Not called by the SDK \u2014 browsers hit this URL directly.",
+  description: "Browser redirect target for MCP server OAuth. The authorization server redirects here with `code`/`state` (or `error`). Exchanges the code for tokens, then either returns JSON or redirects to the `return_to` path supplied at authorize time. Not called by the SDK \u2014 browsers hit this URL directly.",
   // Browser-redirect target hit directly by the authorization server, never called by SDK.
   "x-fern-ignore": true,
   request: {
@@ -6816,10 +6837,10 @@ var mcpOAuthCallbackRoute = createRoute6({
   responses: {
     200: {
       content: { "application/json": { schema: OAuthCallbackSuccessSchema } },
-      description: "Token exchanged successfully and no `redirect_url` was given at authorize time."
+      description: "Token exchanged successfully and no `return_to` was given at authorize time."
     },
     302: {
-      description: "Redirect to the `redirect_url` given at authorize time, with `isSuccess` (and `reason` when it failed) appended to its existing query params."
+      description: "Redirect to the `return_to` path given at authorize time, with `isSuccess` (and `reason` when it failed) appended to its existing query params."
     },
     400: {
       content: { "application/json": { schema: RequestErrorResponseSchema } },
@@ -6833,25 +6854,28 @@ var mcpOAuthCallbackRoute = createRoute6({
 });
 
 // src/apis/mcpOAuth.ts
-function callbackLandingUrl(params) {
-  const url = new URL(params.redirectUrl);
+function callbackLandingPath(params) {
+  const url = new URL(params.returnTo, params.c.req.url);
   url.searchParams.set("isSuccess", String(params.isSuccess));
   if (params.reason) {
     url.searchParams.set("reason", params.reason);
   }
-  return url.href;
+  return `${url.pathname}${url.search}`;
 }
 function callbackSuccess(params) {
-  const redirectUrl = params.pending.redirectUrl;
-  if (redirectUrl) {
-    return params.c.redirect(callbackLandingUrl({ redirectUrl, isSuccess: true }), 302);
+  const returnTo = params.pending.returnTo;
+  if (returnTo) {
+    return params.c.redirect(callbackLandingPath({ c: params.c, returnTo, isSuccess: true }), 302);
   }
   return params.c.json({ success: true }, 200);
 }
 function callbackFailure(params) {
-  const redirectUrl = params.pending?.redirectUrl;
-  if (redirectUrl) {
-    return params.c.redirect(callbackLandingUrl({ redirectUrl, isSuccess: false, reason: params.message }), 302);
+  const returnTo = params.pending?.returnTo;
+  if (returnTo) {
+    return params.c.redirect(
+      callbackLandingPath({ c: params.c, returnTo, isSuccess: false, reason: params.message }),
+      302
+    );
   }
   return params.c.json({ error: { message: params.message } }, params.jsonStatus ?? 400);
 }
@@ -6879,10 +6903,10 @@ function createMcpOAuthRouter(deps) {
       });
     } catch (err) {
       if (err instanceof McpConnectionError3) {
-        deps.logger.warn("MCP OAuth callback token exchange failed", extractErrorLogFields3(err));
+        deps.logger.warn("MCP OAuth callback token exchange failed", extractErrorLogFields4(err));
         return callbackFailure({ c, pending, message: err.message });
       }
-      deps.logger.error("MCP OAuth callback unexpected failure", extractErrorLogFields3(err));
+      deps.logger.error("MCP OAuth callback unexpected failure", extractErrorLogFields4(err));
       return callbackFailure({ c, pending, message: "Internal server error", jsonStatus: 500 });
     }
     return callbackSuccess({ c, pending });
@@ -6893,10 +6917,10 @@ function createMcpOAuthRouter(deps) {
 }
 
 // src/apis/mcpServers.ts
+import { OpenAPIHono as OpenAPIHono7 } from "@hono/zod-openapi";
+import { extractErrorLogFields as extractErrorLogFields5, isAuthRequired, McpConnectionError as McpConnectionError4, RemoteMCP } from "@truefoundry/trueforge-core/core";
 init_config();
 init_mcpServerStore();
-import { OpenAPIHono as OpenAPIHono7 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields4, isAuthRequired, McpConnectionError as McpConnectionError4, RemoteMCP } from "@truefoundry/trueforge-core/core";
 
 // src/routes/mcpServerRoutes.ts
 import { createRoute as createRoute7, z as z21 } from "@hono/zod-openapi";
@@ -7069,7 +7093,9 @@ var listMcpServerToolsRoute = createRoute7({
   }
 });
 var McpAuthorizeQuerySchema = z21.object({
-  redirect_url: z21.url().optional().describe("Optional FE landing URL the OAuth callback redirects to, with `isSuccess`/`reason` appended.")
+  return_to: z21.string().optional().describe(
+    "Optional path to return to after OAuth. Must be a same-origin relative path; the OAuth callback redirects here with `isSuccess`/`reason` appended."
+  )
 });
 var authorizeMcpServerRoute = createRoute7({
   method: "get",
@@ -7078,7 +7104,7 @@ var authorizeMcpServerRoute = createRoute7({
   summary: "Start (or short-circuit) the auth flow for an MCP server",
   "x-fern-sdk-group-name": ["mcpServers"],
   "x-fern-sdk-method-name": "authorize",
-  description: "For servers without auth returns not_required, and for header credentials returns authenticated (no browser flow). For auth.type dcr, returns authenticated when a usable (or refreshable) token exists; otherwise runs DCR if needed and returns auth_required with an authorization URL. Optional redirect_url is where the OAuth callback then redirects the browser; without it the callback returns JSON.",
+  description: "For servers without auth returns not_required, and for header credentials returns authenticated (no browser flow). For auth.type dcr, returns authenticated when a usable (or refreshable) token exists; otherwise runs DCR if needed and returns auth_required with an authorization URL. Optional return_to is where the OAuth callback then redirects the browser; without it the callback returns JSON.",
   request: {
     params: McpServerNameParamsSchema,
     query: McpAuthorizeQuerySchema
@@ -7090,7 +7116,7 @@ var authorizeMcpServerRoute = createRoute7({
     },
     400: {
       content: { "application/json": { schema: RequestErrorResponseSchema } },
-      description: "Invalid redirect_url."
+      description: "Invalid return_to."
     },
     404: {
       content: { "application/json": { schema: RequestErrorResponseSchema } },
@@ -7110,13 +7136,13 @@ var authorizeMcpServerRoute = createRoute7({
     }
   }
 });
-var deleteAuthorizeMcpServerRoute = createRoute7({
+var deleteAuthorizationMcpServerRoute = createRoute7({
   method: "delete",
   path: "/{name}/authorize",
   tags: [MCP_SERVERS_TAG],
   summary: "Disconnect OAuth for an MCP server",
   "x-fern-sdk-group-name": ["mcpServers"],
-  "x-fern-sdk-method-name": "delete_authorize",
+  "x-fern-sdk-method-name": "delete_authorization",
   description: "For auth.type dcr, deletes the stored OAuth token and returns the server with auth_status auth_required, keeping the dynamically registered OAuth client so the next authorize can reuse it. No-op for header or no-auth servers (returns the server unchanged).",
   request: {
     params: McpServerNameParamsSchema
@@ -7274,7 +7300,7 @@ function createSettingsMcpServersRouter(deps) {
       } catch (error) {
         deps.logger.error(
           `DCR client registration failed for "${incomingManifest.name}"; rejecting create`,
-          extractErrorLogFields4(error)
+          extractErrorLogFields5(error)
         );
         const message = error instanceof Error ? error.message : "Failed to register OAuth client for this MCP server";
         return c.json({ error: { message } }, 422);
@@ -7330,9 +7356,9 @@ function createSettingsMcpServersRouter(deps) {
           existing: existing?.manifest
         });
         let dcrClientToSave;
+        const urlChanged = existing !== void 0 && existing.manifest.url !== manifest.url && manifest.auth?.type === "dcr";
         if (manifest.auth?.type === "dcr") {
           const existingClient = existing ? await deps.mcpServerStore.getClient({ id: existing.id }, transaction) : void 0;
-          const urlChanged = existing && existing.manifest.url !== manifest.url;
           const needsDcr = existingClient === void 0 || urlChanged;
           if (needsDcr) {
             dcrClientToSave = await createMcpOAuthClient({
@@ -7354,6 +7380,10 @@ function createSettingsMcpServersRouter(deps) {
         if (dcrClientToSave !== void 0) {
           await deps.mcpServerStore.saveClient({ id: saved.id, record: dcrClientToSave }, transaction);
         }
+        if (urlChanged) {
+          await deps.tokenStore.deleteTokensForServer({ id: saved.id }, transaction);
+          await deps.tokenStore.deletePendingAuthorizationsForServer({ id: saved.id }, transaction);
+        }
         return saved;
       });
       const token = record.manifest.auth?.type === "dcr" ? await deps.tokenStore.getToken({ id: record.id, userRef }) : void 0;
@@ -7365,7 +7395,7 @@ function createSettingsMcpServersRouter(deps) {
       if (error instanceof McpConnectionError4) {
         deps.logger.error(
           `DCR client registration failed for "${incomingManifest.name}"; rejecting upsert`,
-          extractErrorLogFields4(error)
+          extractErrorLogFields5(error)
         );
         return c.json({ error: { message: error.message } }, 422);
       }
@@ -7405,7 +7435,7 @@ function createSettingsMcpServersRouter(deps) {
       return c.json({ data }, 200);
     } catch (error) {
       if (error instanceof McpConnectionError4) {
-        deps.logger.warn(`MCP tools/list failed for "${name}"`, extractErrorLogFields4(error));
+        deps.logger.warn(`MCP tools/list failed for "${name}"`, extractErrorLogFields5(error));
         if (error.statusCode === 401) {
           return c.json({ error: { message: error.message } }, 422);
         }
@@ -7425,7 +7455,7 @@ function createSettingsMcpServersRouter(deps) {
 function createMcpServersRouter(deps) {
   const authorizeHandler = async (c) => {
     const { name } = c.req.valid("param");
-    const { redirect_url: redirectUrl } = c.req.valid("query");
+    const { return_to: returnTo } = c.req.valid("query");
     const userRef = deps.resolveUserContext(c).userRef;
     const record = await deps.mcpServerStore.getServer({ tenant_id: TENANT_ID, name });
     if (!record) {
@@ -7434,10 +7464,10 @@ function createMcpServersRouter(deps) {
     if (record.manifest.auth?.type !== "dcr") {
       return c.json(resolveMcpAuthStatus({ manifest: record.manifest }), 200);
     }
+    if (returnTo && safeReturnTo(returnTo) !== returnTo) {
+      return c.json({ error: { message: "Invalid return_to: must be a same-origin relative path" } }, 400);
+    }
     try {
-      if (redirectUrl) {
-        validateRedirectUris({ redirectUris: [redirectUrl] });
-      }
       const result = await resolveMcpAuth({
         tokenStore: deps.tokenStore,
         mcpServerStore: deps.mcpServerStore,
@@ -7446,13 +7476,13 @@ function createMcpServersRouter(deps) {
         mcpServerUrl: record.manifest.url,
         mcpServerName: record.name,
         clientName: config_default.MCP_DCR_OAUTH_CLIENT_NAME,
-        ...redirectUrl !== void 0 ? { redirectUrl } : {}
+        ...returnTo !== void 0 ? { returnTo } : {}
       });
       const authStatus = isMcpAuthRequired(result) ? { status: "auth_required", authorization_url: result.authUrl.href } : { status: "authenticated" };
       return c.json(authStatus, 200);
     } catch (error) {
       if (error instanceof McpConnectionError4) {
-        deps.logger.warn(`MCP authorize failed for "${name}"`, extractErrorLogFields4(error));
+        deps.logger.warn(`MCP authorize failed for "${name}"`, extractErrorLogFields5(error));
         if (error.statusCode === 400) {
           return c.json({ error: { message: error.message } }, 400);
         }
@@ -7464,11 +7494,11 @@ function createMcpServersRouter(deps) {
         }
         return c.json({ error: { message: error.message } }, 500);
       }
-      deps.logger.error(`MCP authorize unexpected failure for "${name}"`, extractErrorLogFields4(error));
+      deps.logger.error(`MCP authorize unexpected failure for "${name}"`, extractErrorLogFields5(error));
       return c.json({ error: { message: "Internal server error" } }, 500);
     }
   };
-  const deleteAuthorizeHandler = async (c) => {
+  const deleteAuthorizationHandler = async (c) => {
     const { name } = c.req.valid("param");
     const userRef = deps.resolveUserContext(c).userRef;
     const record = await deps.mcpServerStore.getServer({ tenant_id: TENANT_ID, name });
@@ -7494,7 +7524,7 @@ function createMcpServersRouter(deps) {
     );
   });
   router.openapi(authorizeMcpServerRoute, authorizeHandler);
-  router.openapi(deleteAuthorizeMcpServerRoute, deleteAuthorizeHandler);
+  router.openapi(deleteAuthorizationMcpServerRoute, deleteAuthorizationHandler);
   return router;
 }
 
@@ -8067,7 +8097,7 @@ import {
 } from "@truefoundry/trueforge-core/agent-session";
 import {
   AgentHarnessError,
-  extractErrorLogFields as extractErrorLogFields5,
+  extractErrorLogFields as extractErrorLogFields6,
   isAgentInputUserMessage,
   isFileContentPart,
   McpConnectionError as McpConnectionError5,
@@ -8075,7 +8105,7 @@ import {
   validateSandboxOwnedByTenant,
   VercelAILLM
 } from "@truefoundry/trueforge-core/core";
-import { HTTPException as HTTPException5 } from "hono/http-exception";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
 import { streamSSE } from "hono/streaming";
 
 // src/routes/turnRoutes.ts
@@ -8660,7 +8690,7 @@ function createTurnResolver(deps) {
         userRef
       });
       if (connection === void 0) {
-        throw new HTTPException5(422, {
+        throw new HTTPException4(422, {
           message: `Unknown MCP server "${name}" \u2014 not configured`
         });
       }
@@ -8675,14 +8705,14 @@ function createTurnResolver(deps) {
         logger
       });
       if (provider === void 0) {
-        throw new HTTPException5(422, {
+        throw new HTTPException4(422, {
           message: "no sandbox provider configured \u2014 PUT /settings/sandbox-providers"
         });
       }
       if (existingSandboxId === void 0) {
         const status = await checkSnapshotStatus({ store: sandboxProviderStore, tenant_id: TENANT_ID, logger });
         if (status?.status !== "ready") {
-          throw new HTTPException5(422, {
+          throw new HTTPException4(422, {
             message: status?.status === "failed" ? `sandbox image build failed (${status.status_reason ?? "unknown error"})` : "sandbox image is activating \u2014 retry shortly"
           });
         }
@@ -8705,7 +8735,7 @@ function createTurnResolver(deps) {
     agent: async (agentId) => {
       const record = await agentStore.getAgent({ tenant_id: TENANT_ID, id: agentId });
       if (record === void 0) {
-        throw new HTTPException5(422, { message: `Agent not found: ${agentId}` });
+        throw new HTTPException4(422, { message: `Agent not found: ${agentId}` });
       }
       return record.manifest;
     },
@@ -8757,13 +8787,13 @@ async function drainTurnEvents(input) {
       logger.warn("Turn stream ended after session/turn was removed", {
         sessionId,
         turnId,
-        ...extractErrorLogFields5(error)
+        ...extractErrorLogFields6(error)
       });
     } else {
       logger.error("Unexpected error in turn event drain", {
         sessionId,
         turnId,
-        ...extractErrorLogFields5(error)
+        ...extractErrorLogFields6(error)
       });
     }
   } finally {
@@ -8775,7 +8805,7 @@ function resolveAfterSequenceNumber(c, bodyAfterSequenceNumber) {
   if (lastEventId) {
     const sequenceNumber = Number(lastEventId);
     if (!Number.isInteger(sequenceNumber) || sequenceNumber < 0) {
-      throw new HTTPException5(400, { message: "Invalid Last-Event-Id header" });
+      throw new HTTPException4(400, { message: "Invalid Last-Event-Id header" });
     }
     return sequenceNumber;
   }
@@ -8867,7 +8897,7 @@ function createTurnsRouter(deps) {
         return c.json({ error: { message: error.message } }, error.statusCode);
       }
       deps.logger.error("Sandbox file download failed", {
-        ...extractErrorLogFields5(error),
+        ...extractErrorLogFields6(error),
         sessionId,
         turnId,
         sandboxId,
@@ -9003,7 +9033,7 @@ function createTurnsRouter(deps) {
             try {
               await stream.writeSSE(turnEventSsePayload(event, sequenceNumber));
             } catch (error) {
-              deps.logger.error("SSE stream write error", extractErrorLogFields5(error));
+              deps.logger.error("SSE stream write error", extractErrorLogFields6(error));
               shouldWriteToSSEStream = false;
             }
           }
@@ -9032,7 +9062,7 @@ function createTurnsRouter(deps) {
       await turnEventStream.assertSubscribable();
     } catch (error) {
       if (error instanceof StreamGoneError) {
-        throw new HTTPException5(412, { message: error.message, cause: error });
+        throw new HTTPException4(412, { message: error.message, cause: error });
       }
       throw error;
     }
@@ -9061,7 +9091,7 @@ function createTurnsRouter(deps) {
         }
       } catch (error) {
         if (!subscribeAbort.signal.aborted) {
-          deps.logger.error("Unexpected error in turn subscribe SSE loop", extractErrorLogFields5(error));
+          deps.logger.error("Unexpected error in turn subscribe SSE loop", extractErrorLogFields6(error));
         }
       } finally {
         clearTimeout(timeoutHandler);
@@ -9128,16 +9158,16 @@ function createAppErrorHandler(params) {
     if (error instanceof z24.ZodError) {
       return zodErrorResponse(c, error);
     }
-    if (error instanceof HTTPException6) {
+    if (error instanceof HTTPException5) {
       if (error.status >= 500) {
         params.logger.error("Server API error", {
           status: error.status,
-          ...extractErrorLogFields6(error)
+          ...extractErrorLogFields7(error)
         });
       }
       return c.json({ error: { message: error.message } }, error.status);
     }
-    params.logger.error("Unhandled error", extractErrorLogFields6(error));
+    params.logger.error("Unhandled error", extractErrorLogFields7(error));
     return c.json({ error: { message: "Internal server error" } }, 500);
   };
 }
@@ -9289,7 +9319,8 @@ function createServerApp(deps) {
         sandboxProviderStore: deps.sandboxProviderStore,
         redis: deps.redis,
         requestReplyRouter: deps.requestReplyRouter,
-        resolveUserContext
+        resolveUserContext,
+        logger: deps.logger
       })
     )
   );
@@ -10080,7 +10111,7 @@ try {
   if (redis) {
     requestReplySubscriber = redis.duplicate();
     requestReplySubscriber.on("error", (error) => {
-      logger.error("[RedisSubscriber] Client error", extractErrorLogFields8(error));
+      logger.error("[RedisSubscriber] Client error", extractErrorLogFields9(error));
     });
     await requestReplySubscriber.connect();
     requestReplyExecutor = new RequestReplyExecutor({
@@ -10120,14 +10151,14 @@ try {
           resolve();
         });
       });
-      await activeTurns.shutdownAndWait(CancellationReason6.Abandoned);
+      await activeTurns.shutdownAndWait(CancellationReason4.Abandoned);
       await closed;
       await requestReplyExecutor?.drain();
       await requestReplySubscriber?.close().catch((error) => {
-        logger.warn("[Redis] Error closing subscriber client during shutdown", extractErrorLogFields8(error));
+        logger.warn("[Redis] Error closing subscriber client during shutdown", extractErrorLogFields9(error));
       });
       await redis?.close().catch((error) => {
-        logger.warn("[Redis] Error closing client during shutdown", extractErrorLogFields8(error));
+        logger.warn("[Redis] Error closing client during shutdown", extractErrorLogFields9(error));
       });
       await destroyDb();
       process.exit(0);