@unoverse-platform/studio 0.1.103 → 0.1.105

package/vendor/base/src/auth/auth.ts

@@ -172,7 +172,12 @@ async function verifyJWT(token: string): Promise<AuthUser | null> {
       const aud = payload.aud;
       const clientId = (payload as Record<string, unknown>).client_id;
       const values = [...(Array.isArray(aud) ? aud : aud ? [aud] : []), ...(clientId ? [clientId] : [])].map(String);
-      if (!values.includes(expected)) {
+      // A connector's token (ChatGPT, Claude) names OUR MCP ADDRESS as its audience, not our
+      // app's client: it registered its own client and asked the provider for a token for
+      // `<public url>/mcp/<org>` (RFC 8707). Only our configured public URL counts, so a token
+      // minted for anyone else's resource is refused as before. Approved by Gavin 2026-09-30.
+      const forOurMcp = Array.isArray(aud) ? aud.some(isOurMcpResource) : typeof aud === "string" && isOurMcpResource(aud);
+      if (!values.includes(expected) && !forOurMcp) {
         console.error(
           `[auth] JWT validation failed: audience mismatch (expected ${expected}, token had ${values.join(", ") || "none"})`,
         );
@@ -187,6 +192,11 @@ async function verifyJWT(token: string): Promise<AuthUser | null> {
       raw: payload,
     };
   } catch (error) {
+    // An expired token is routine (a held tab, a host replaying an old tool result): one line, no stack.
+    if ((error as { code?: string }).code === "ERR_JWT_EXPIRED") {
+      console.warn(`[auth] JWT expired (sub ${(error as { payload?: { sub?: string } }).payload?.sub ?? "?"})`);
+      return null;
+    }
     console.error("[auth] JWT validation failed:", error);
     return null;
   }
@@ -265,9 +275,44 @@ function resourceBase(host: string): string {
   return `${protocol}://${host}`;
 }
 
-/** The 401 challenge — points clients at the RFC 9728 protected-resource-metadata. */
-export function unauthorizedResponse(host: string): Response {
-  const resourceMetadataUrl = `${resourceBase(host)}/.well-known/oauth-protected-resource`;
+/**
+ * WAS THIS TOKEN ISSUED TO AN OUTSIDE CONNECTOR? (the MCP Action is the front door, 2026-09-30)
+ *
+ * A connector (ChatGPT, Claude) signs in through the provider and asks for a token FOR OUR MCP
+ * ADDRESS, so its `aud` is `<public url>/mcp` or `<public url>/mcp/<org>` (RFC 8707). Our own
+ * hosts (Canvas, Studio, the builder) sign in as our app and never carry that audience. The
+ * answer decides only WHICH TOOLS the session is offered: a connector gets the MCP Actions and
+ * nothing else, signed in or not. It grants nothing. Call it only on a token `authorize` has
+ * already accepted; the payload is read, not verified, here.
+ */
+export function isConnectorToken(token: string): boolean {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    const aud: unknown[] = Array.isArray(payload?.aud) ? payload.aud : payload?.aud ? [payload.aud] : [];
+    return aud.some(isOurMcpResource);
+  } catch {
+    return false;
+  }
+}
+
+/** `<UNOVERSE_PUBLIC_URL>/mcp` or `<UNOVERSE_PUBLIC_URL>/mcp/<org>`: the resource a connector's token is for. */
+function isOurMcpResource(value: unknown): boolean {
+  const base = process.env.UNOVERSE_PUBLIC_URL?.replace(/\/$/, "");
+  if (!base || typeof value !== "string") return false;
+  if (!value.startsWith(base)) return false;
+  return /^\/mcp(\/[A-Za-z0-9._-]+)?$/.test(value.slice(base.length));
+}
+
+/**
+ * The 401 challenge — points clients at the RFC 9728 protected-resource-metadata.
+ *
+ * `path` is the MCP door that was called (`/mcp/sab`). The challenge must name THAT door's
+ * metadata: a connector follows this header and sends the `resource` it finds there to the
+ * provider, which issues a token only for a resource indicator it knows. Pointing every door
+ * at the root document made ChatGPT ask for the bare origin and fail at the callback.
+ */
+export function unauthorizedResponse(host: string, path = ""): Response {
+  const resourceMetadataUrl = `${resourceBase(host)}/.well-known/oauth-protected-resource${path}`;
   return new Response(
     JSON.stringify({ jsonrpc: "2.0", error: { code: -32001, message: "Unauthorized" }, id: null }),
     {
@@ -280,22 +325,36 @@ export function unauthorizedResponse(host: string): Response {
   );
 }
 
-/** OAuth Authorization Server Metadata (for MCP Inspector / discovery). */
-export function getOAuthAuthorizationServerMetadata(): object {
-  const issuer = process.env.AUTH_ISSUER;
-  const audience = process.env.AUTH_AUDIENCE;
-  return {
-    issuer,
-    authorization_endpoint: audience
-      ? `${issuer}/authorize?audience=${encodeURIComponent(audience)}`
-      : `${issuer}/authorize`,
-    token_endpoint: `${issuer}/oauth/token`,
-    registration_endpoint: `${issuer}/oidc/register`,
-    scopes_supported: ["openid", "profile", "email", "offline_access"],
-    response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code", "refresh_token"],
-    code_challenge_methods_supported: ["S256"],
-  };
+/**
+ * OAuth Authorization Server Metadata: THE PROVIDER'S OWN DOCUMENT, passed through.
+ *
+ * This used to be written here, with Auth0's paths (`/authorize?audience=`, `/oauth/token`,
+ * `/oidc/register`) on whatever issuer was configured. On WorkOS AuthKit none of those exist
+ * (`/oauth2/authorize`, `/oauth2/token`, `/oauth2/register`), and ChatGPT, which reads this
+ * copy on our host, was sent to a token address that is not there: sign-in succeeded and the
+ * connector failed at the callback (2026-09-30). Cognito has no registration endpoint at all,
+ * yet this advertised one. The provider says where its endpoints are, so we repeat what it
+ * says and add nothing. RFC 8414 first, OIDC discovery second (Cognito publishes only that).
+ * Held for five minutes, so a change made in the provider's dashboard shows up without a
+ * restart. Null when the provider cannot be reached: the caller answers 502, never a guess.
+ */
+let asMetadata: { doc: object; at: number } | null = null;
+export async function getOAuthAuthorizationServerMetadata(): Promise<object | null> {
+  const base = getIssuerBase();
+  if (!base) return null;
+  if (asMetadata && Date.now() - asMetadata.at < 5 * 60_000) return asMetadata.doc;
+  for (const path of ["/.well-known/oauth-authorization-server", "/.well-known/openid-configuration"]) {
+    try {
+      const res = await fetch(`${base}${path}`, { signal: AbortSignal.timeout(5000) });
+      if (!res.ok) continue;
+      const doc = (await res.json()) as object;
+      asMetadata = { doc, at: Date.now() };
+      return doc;
+    } catch {
+      // try the next discovery location
+    }
+  }
+  return null;
 }
 
 /**
@@ -331,10 +390,18 @@ export function getPublicAuthConfig(): object {
   };
 }
 
-/** OAuth 2.0 Protected Resource Metadata (RFC 9728); canonical URL preferred over Host. */
-export function getOAuthProtectedResourceMetadata(host: string): object {
+/**
+ * OAuth 2.0 Protected Resource Metadata (RFC 9728); canonical URL preferred over Host.
+ *
+ * `path` is the resource the client asked about (RFC 9728 §3.1 inserts it after the
+ * well-known prefix: `/.well-known/oauth-protected-resource/mcp/sab` describes `/mcp/sab`).
+ * The client sends `resource` back to the provider as the resource indicator, and the
+ * provider only issues a token for an indicator it knows, so it must be the address the
+ * connector was given, not the bare origin.
+ */
+export function getOAuthProtectedResourceMetadata(host: string, path = ""): object {
   return {
-    resource: resourceBase(host),
+    resource: `${resourceBase(host)}${path}`,
     authorization_servers: [process.env.AUTH_ISSUER],
     scopes_supported: ["openid", "profile", "email"],
     bearer_methods_supported: ["header"],

package/vendor/base/src/definitions/load/compile/sections.ts

@@ -46,3 +46,82 @@ export function expandTemplateSections(
   for (const [k2, v] of Object.entries(n)) o[k2] = expandTemplateSections(v, templateName, out);
   return o;
 }
+
+/** One component a template HOLDS: which component, and the path of item arrays it is
+ *  drawn over (`["courses", "dishes"]` is one instance per dish of every course). */
+export interface HeldSpec {
+  component: string;
+  items: string[];
+}
+
+/** HOLD THE TEMPLATE'S OWN COMPONENTS (docs/design/templates.md "Holding a component"). A
+ *  `Ref` to a component whose states name places, drawn inside an `Each` over the template's
+ *  data, is not drawn flat: each item is its own instance of that component, keeping its own
+ *  state, and the layout keeps a slot for it in its spot. `holds` resolves a ref to the
+ *  component's name when it is one to hold, and to nothing otherwise, so this stays pure. */
+export function expandHeldRefs(node: unknown, holds: (ref: string) => string | undefined, out: HeldSpec[], scope: string[] = []): unknown {
+  if (Array.isArray(node)) return node.map((c) => expandHeldRefs(c, holds, out, scope));
+  if (!node || typeof node !== "object") return node;
+  const n = node as Record<string, unknown>;
+  if (scope.length && n.type === "Ref" && typeof n.ref === "string" && !n.ref.startsWith(PART_PREFIX)) {
+    const component = holds(n.ref);
+    if (component) {
+      // One entry per component and path: a layout drawn in two branches holds it once.
+      if (!out.some((h) => h.component === component && h.items.join("/") === scope.join("/"))) out.push({ component, items: [...scope] });
+      const { type: _t, ref: _r, ...rest } = n;
+      return { type: "ComponentSlot", hold: { type: component, items: [...scope] }, ...rest };
+    }
+  }
+  // An `Each` over a bound field draws one item of it; an `Each` over literal `items` draws
+  // the author's own content, which holds nothing.
+  const itemsField = n.type === "Each" ? (n.bind as { items?: unknown } | undefined)?.items : undefined;
+  const itemScope = n.type !== "Each" ? scope : typeof itemsField === "string" && !Array.isArray(n.items) ? [...scope, itemsField] : [];
+  const o: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(n)) o[k] = expandHeldRefs(v, holds, out, k === "item" ? itemScope : scope);
+  return o;
+}
+
+type Data = Record<string, unknown>;
+
+/** A held instance's node id: its template's, the component, and the item's own id. The SDK
+ *  builds the same id to find it (web/sdk core/apps.ts `heldPointer`), so this is the one place
+ *  it is spelled on the server side. */
+export function heldNodeId(host: string, component: string, key: string): string {
+  return `${host}:${component}:${key}`;
+}
+
+/** An item's own id: the row's id when it carries one, else its position in its own list,
+ *  which is the `index` the client's `Each` gives it. */
+function keyOfItem(item: Data, index: number): string {
+  const id = item.universal_id ?? item.ref ?? item.id;
+  return typeof id === "string" || typeof id === "number" ? String(id) : String(index);
+}
+
+/** Every item a held spec is drawn over, walking its path of arrays (`courses` then `dishes`).
+ *  Undefined when the data does not carry the path's first field: a partial update that leaves
+ *  the held data alone holds nothing new. */
+function itemsAt(data: Data, path: string[]): { item: Data; index: number }[] | undefined {
+  if (!(path[0] in data)) return undefined;
+  let level: { item: unknown; index: number }[] = [{ item: data, index: 0 }];
+  for (const field of path)
+    level = level.flatMap(({ item: o }) => {
+      const list = o && typeof o === "object" ? (o as Data)[field] : undefined;
+      return Array.isArray(list) ? list.map((item, index) => ({ item, index })) : [];
+    });
+  return level.filter((i): i is { item: Data; index: number } => !!i.item && typeof i.item === "object" && !Array.isArray(i.item));
+}
+
+/** The instances a template holds, from data written to it: one per item of each held spec,
+ *  each keyed by the item's own id and carrying the item's fields as its props. */
+export function heldInstances(held: HeldSpec[], data: Data): { key: string; component: string; props: Data }[] {
+  const seen = new Set<string>();
+  const out: { key: string; component: string; props: Data }[] = [];
+  for (const spec of held)
+    itemsAt(data, spec.items)?.forEach(({ item, index }) => {
+      const key = keyOfItem(item, index);
+      if (seen.has(`${spec.component}:${key}`)) return;
+      seen.add(`${spec.component}:${key}`);
+      out.push({ key, component: spec.component, props: { ...item } });
+    });
+  return out;
+}

package/vendor/base/src/definitions/load/compile/template.ts

@@ -8,7 +8,7 @@
 import type { UnoverseDefinition } from "../../model.js";
 import { loadDefinition } from "../load.js";
 import { composeIncludes } from "../expand/index.js";
-import { expandTemplateSections } from "./sections.js";
+import { expandHeldRefs, expandTemplateSections, heldInstances, type HeldSpec } from "./sections.js";
 import { placesOfStates, pointStepsAtStep, STEP } from "./component.js";
 
 /**
@@ -105,19 +105,37 @@ export function synthesizeTemplateRoot(def: UnoverseDefinition, folderDir?: stri
   }
   const layouts: Record<string, unknown> = {};
   const sections: NonNullable<UnoverseDefinition["sections"]> = {};
+  const held: Record<string, HeldSpec[]> = {};
+  // A component is HELD when its states name places: it can open somewhere of its own.
+  const holds = (ref: string): string | undefined => {
+    const c = loadDefinition(ref, "component", "expanded", def.org) as { statePlaces?: Record<string, string>; org?: string } | null;
+    if (!c?.statePlaces || !Object.keys(c.statePlaces).length) return undefined;
+    return ref.includes("/") || !c.org ? ref : `${c.org}/${ref}`;
+  };
   const compiledPreview: Record<string, string[]> = {};
   for (const name of shapeNames) {
     const st = (states[name] ?? {}) as Record<string, unknown>;
     if (typeof st.layout !== "string") continue;
     const secs: NonNullable<UnoverseDefinition["sections"]>[string] = [];
     const authored = composeIncludes({ $include: st.layout }, folderDir);
-    layouts[name] = expandTemplateSections(steps.size ? pointStepsAtStep(authored, steps) : authored, def.name, secs);
+    const heldHere: HeldSpec[] = [];
+    const holding = expandHeldRefs(authored, holds, heldHere);
+    layouts[name] = expandTemplateSections(steps.size ? pointStepsAtStep(holding, steps) : holding, def.name, secs);
     sections[name] = secs;
+    if (heldHere.length) held[name] = heldHere;
     // MOCK VALUES TRAVEL WITH THE SECTION — a preview host seeds instances from the wire.
     seedSections(secs, def.org, compiledPreview);
   }
   if (!Object.keys(layouts).length) return;
   def.layouts = layouts;
+  if (Object.keys(held).length) {
+    def.held = held;
+    // THE HELD INSTANCES' STAND-INS: one per item of the template's own preview data, so a
+    // preview host seeds them the way it seeds parts and the arrangement draws finished.
+    const props = (def.props ?? {}) as Record<string, { preview?: unknown; default?: unknown } | null>;
+    const mock = Object.fromEntries(Object.entries(props).map(([k, v]) => [k, v?.preview ?? v?.default]));
+    def.heldSeeds = Object.fromEntries(Object.entries(held).map(([layout, specs]) => [layout, heldInstances(specs, mock)]));
+  }
   def.defaultLayout = shapeNames[0];
   def.stateOrder = shapeNames.slice(1);
   // THE FACE IT ARRIVES WEARING (2026-08-30). A template's states compiled into
@@ -140,10 +158,13 @@ export function synthesizeTemplateRoot(def: UnoverseDefinition, folderDir?: stri
     const names = subs && typeof subs === "object" ? Object.keys(subs) : [];
     // A state that takes the whole screen says so; the SDK takes the browser fullscreen for it.
     const full = (states[n] as { fullscreen?: unknown } | null)?.fullscreen === true ? { fullscreen: true } : {};
+    // A state whose steps the arrow keys move says so; no other template answers the keys.
+    const arrows = (states[n] as { arrows?: unknown } | null)?.arrows === true ? { arrows: true } : {};
     if (!names.length) return { name: n, ...full };
     return {
       name: n,
       ...full,
+      ...arrows,
       on: STEP,
       initial: names[0],
       states: names.map((sub) => ({ name: sub, ...(typeof subs![sub]?.layout === "string" ? { layout: subs![sub]!.layout as string } : {}) })),

package/vendor/base/src/definitions/model.ts

@@ -38,6 +38,13 @@ export interface UnoverseDefinition {
       seeds?: Record<string, Record<string, unknown>>;
     }[]
   >;
+  /** TEMPLATES: the components each state's layout HOLDS, one instance per item of the
+   *  data it is drawn over (docs/design/templates.md "Holding a component"). The wire layout
+   *  carries a ComponentSlot with `hold` in each one's spot. */
+  held?: Record<string, { component: string; items: string[] }[]>;
+  /** TEMPLATES: the held instances' preview stand-ins per state, from the template's own prop
+   *  previews. Studio seeds them under its template instance; never used at runtime. */
+  heldSeeds?: Record<string, { key: string; component: string; props: Record<string, unknown> }[]>;
   /** TEMPLATES: Studio preview mocks per slot — interface refs, each rendering its
    *  own defaults (the interface-model rule: mocks are the interface's OWN defaults,
    *  never authored preview data). From the template's manifest.yaml. */
@@ -155,6 +162,8 @@ export interface UnoverseDefinition {
     states?: { name: string; layout?: string }[];
     /** The state takes the whole screen (the authored `fullscreen: true`). */
     fullscreen?: boolean;
+    /** The arrow keys step this state's steps (the authored `arrows: true`). */
+    arrows?: boolean;
   }[];
 }
 

package/vendor/base/src/definitions/registry/catalog.ts

@@ -163,13 +163,12 @@ export interface AppManifest {
    *  (`isPublicEntry`). The org URL picks WHICH SET a connector sees; this picks what is in
    *  that set at all. */
   makeMCP?: boolean;
-  /** Asset origins this app's content loads (images, media) — e.g. the org's image CDN.
-   *  Authored per app in manifest.yaml; the server UNIONS them across the connector's
-   *  published apps into the MCP-app shell's CSP (`ui.csp.resourceDomains`). A sandboxed
-   *  host builds its img-src from that list and blocks everything else, so an origin
-   *  missing here renders as broken images in ChatGPT/Claude while working in our own
-   *  hosts. Full origins with scheme, wildcards allowed: "https://*.datocms-assets.com". */
-  assetDomains?: string[];
+  /** The outbound hosts this folder may reach (lifecycle-hooks.md): a hook's server-side
+   *  calls, and the pictures its content loads. The server UNIONS them across the
+   *  connector's org into the MCP-app shell's CSP (`ui.csp.resourceDomains`), because a
+   *  sandboxed host builds its img-src from that list and blocks everything else. Bare
+   *  hosts, the node package grammar: "www.sab.com", "*.datocms-assets.com". */
+  allowedHosts?: string[];
   /** Render lifetime (docs/design/04 §Two lifetimes). Default "turn": the instance returns
    *  to inline/retires on the next user turn (the universal reset). "conversation" = a
    *  DURABLE conversation-scoped surface (a cart, an itinerary, a composed page): keyed by

package/vendor/base/src/executor.ts

@@ -5,6 +5,7 @@
 import type { NodeDefinition } from "./types.js";
 import { getNode } from "./registry.js";
 import { buildExecutionContext } from "./platform/index.js";
+import { recordCall } from "./manifests/runtime/tools/toolloop.js";
 
 /**
  * Create a logger for a node type - outputs structured JSON for Loki/Promtail
@@ -251,7 +252,30 @@ export async function executeServiceCall(
   }
 
   const executionContext = buildExecutionContext(nodeType, {}, config, context);
-  return await executor.handleServiceCall(method, params, config, executionContext);
+
+  /**
+   * THE METHOD RECORDS ITS OWN CALL (packages/docs/nodes/mcp-services.md, "Who records a call"),
+   * nested under the node that called it (`callingNodeId`; `nodeId` is this node's own by now),
+   * whoever that is, so the caller
+   * records nothing. Only a method the node offers as a tool: `getSchema` is discovery, not a
+   * call anybody chose. Taken from the caller's own context, never the fallbacks
+   * buildExecutionContext invents, so a call outside a run records nothing.
+   */
+  const offered = (Array.isArray(nodeDef.serviceConnectors) ? nodeDef.serviceConnectors : []).some(
+    (c: any) => Array.isArray(c?.methods) && c.methods.includes(method),
+  );
+  const startTime = Date.now();
+  const record = (result: unknown, success: boolean) =>
+    offered &&
+    recordCall({ executionId: context?.executionId, parentNodeId: context?.callingNodeId, toolName: method, args: params, result, startTime, success, who: nodeType });
+  try {
+    const result = await executor.handleServiceCall(method, params, config, executionContext);
+    record(result, true);
+    return result;
+  } catch (err: any) {
+    record({ error: err?.message ?? String(err) }, false);
+    throw err;
+  }
 }
 
 /**

package/vendor/base/src/lint/design/index.mjs

@@ -924,6 +924,15 @@ function componentNamesForFile(file) {
   const org = projectSegs.join("/");
   const cached = componentNamesCache.get(org);
   if (cached !== undefined) return cached;
+  // A PARTIAL SET IS WORSE THAN NO SET (the app-sizes trap below, same cause). A developer's
+  // project has no design system on disk, so DS falls back to DESIGN_ROOT and only the org's
+  // own names would be left: every marketplace name a preview uses (`card`) then reads as
+  // unknown, and a fresh Studio workspace failed lint on its own sample. Unverifiable here,
+  // so not asserted.
+  if (DS === DESIGN_ROOT) {
+    componentNamesCache.set(org, null);
+    return null;
+  }
   const dirs = [
     join(DS, "components"),
     join(DESIGN_ROOT, ...projectSegs, "components"),

package/vendor/base/src/manifests/executor/toolBridge.ts

@@ -11,6 +11,7 @@
  */
 import type { ToolBridge } from "../runtime/index.js";
 import { engineUrl } from "./context.js";
+import { saveAvailableTools } from "../../platform/serviceCalls.js";
 
 /** The screen's verbs on an app with places (docs/unoverse/design/screen/UNOVERSE_SCREEN.md §3.3). */
 const SCREEN_VERBS = {
@@ -60,6 +61,13 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
     chatId: pub?.chatId,
     accessToken: executionContext?.auth?.accessToken,
   };
+  /**
+   * THE CALLER, for a tool the MODEL calls: each records its own call on the trace under this
+   * run and this node (packages/docs/nodes/mcp-services.md, "Who records a call"). Kept apart
+   * from `identity`, which also travels on calls no model made.
+   */
+  const caller = { executionId: executionContext?.executionId, nodeId: executionContext?.nodeId };
+  const called = { ...identity, trace: caller };
 
   /**
    * Discovered PATH-B component apps, by tool name.
@@ -83,11 +91,6 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
    */
   const discoveredApps = new Set<string>();
 
-  /**
-   * TOOLS MINTED FROM A TASK ROW, by minted name. A call to one of these is a task step on
-   * the execution timeline, not a bare tool call; `kindOf` answers from this set.
-   */
-  const taskTools = new Set<string>();
   /**
    * TOOLS WHOSE CALL HANDS THE TURN OFF: a workflow-bound app fired through the service
    * lane (`workflow@trigger`, fire-and-forget). Only these can end the loop; a component
@@ -120,7 +123,11 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
     appInvokers.set(name, async (input) => {
       const { client, close } = await harness.connectPlatformMcp({ accessToken: identity.accessToken });
       try {
-        const r = (await client.callTool({ name, arguments: { ...((input ?? {}) as Record<string, unknown>), userId: identity.userId, conversationId: identity.conversationId, chatId: identity.chatId } })) as { content?: Array<{ type: string; text?: string }> };
+        const r = (await client.callTool({
+          name,
+          arguments: { ...((input ?? {}) as Record<string, unknown>), userId: identity.userId, conversationId: identity.conversationId, chatId: identity.chatId },
+          ...(caller.executionId && caller.nodeId ? { _meta: { [harness.TRACE_META]: caller } } : {}),
+        })) as { content?: Array<{ type: string; text?: string }> };
         return r.content?.find((c) => c.type === "text")?.text ?? "";
       } finally {
         await close();
@@ -150,7 +157,7 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
             schema: { methods: {} },
           };
           const def = await harness.resolveToolDefNative(mcp, { accessToken: identity.accessToken });
-          appInvokers.set(def.name, harness.componentAppInvoker(mcp, identity));
+          appInvokers.set(def.name, harness.componentAppInvoker(mcp, called));
           discoveredApps.add(mcp.component);
           preMinted.push({
             ...def,
@@ -171,7 +178,7 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
 
   return {
     async discover() {
-      return [
+      const tools = [
         ...Object.entries<any>(schema.methods).map(([name, m]) => ({
           name,
           description: m.description || `Execute ${name}`,
@@ -179,6 +186,9 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
         })),
         ...preMinted,
       ];
+      // Everything the model starts with, the screen and open pages included.
+      if (caller.executionId && caller.nodeId) saveAvailableTools(caller.executionId, caller.nodeId, tools.map((t) => t.name));
+      return tools;
     },
 
     async call(name, args) {
@@ -220,9 +230,8 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
           // carry no schema copy. For a BRIEFED component that schema is the instruction
           // channel, so the model hydrates real fields instead of following prose.
           const def = await harness.resolveToolDefNative(mcp, { accessToken: identity.accessToken });
-          const invoke = harness.componentAppInvoker(mcp, identity);
+          const invoke = harness.componentAppInvoker(mcp, called);
           appInvokers.set(def.name, invoke);
-          if (mcp.task) taskTools.add(def.name);
 
           /**
            * A TASK OPENS WHEN THE LLM CALLS IT (UNOVERSE_RENDER_PIPELINE §4, locked
@@ -255,7 +264,7 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
             const def = harness.toolDefFromDiscoveredMCP(mcp);
             // A WORKFLOW TASK (2026-09-06) is called NATIVELY: the held call runs the Agent
             // and returns its result. Registered by the minted name, like a component app.
-            if (harness.isWorkflowTask(mcp)) appInvokers.set(def.name, harness.workflowTaskInvoker(mcp, identity));
+            if (harness.isWorkflowTask(mcp)) appInvokers.set(def.name, harness.workflowTaskInvoker(mcp, called));
             else if (mcp.workflowId) {
               // A WORKFLOW-BOUND APP (path A) OPENS, then ends the turn. It used to only end
               // the turn: nothing registered an invoker, so the model's call fell through to
@@ -263,11 +272,10 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
               // success and the screen stayed blank (SAB, 2026-09-07). Both, in this order —
               // the app tool renders the surface and fires no workflow itself (server
               // mcp/server/tools.ts), so the handoff that follows is not a second run.
-              appInvokers.set(def.name, harness.workflowAppInvoker(mcp, identity));
+              appInvokers.set(def.name, harness.workflowAppInvoker(mcp, called));
               handoffTools.add(def.name);
             }
-            if (mcp.task) taskTools.add(def.name);
-            minted.push({ name: def.name, description: def.description, parameters: def.parameters, ...(def.outputSchema ? { outputSchema: def.outputSchema } : {}) });
+              minted.push({ name: def.name, description: def.description, parameters: def.parameters, ...(def.outputSchema ? { outputSchema: def.outputSchema } : {}) });
           }
 
       /**
@@ -280,7 +288,7 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
        */
       for (const fn of harness.parseOfferedFunctions(toolName, resultContent)) {
         const def = harness.objectFunctionToolDef(fn);
-        appInvokers.set(def.name, harness.objectFunctionInvoker(fn, engineUrl()));
+        appInvokers.set(def.name, harness.objectFunctionInvoker(fn, engineUrl(), caller));
         minted.push({ name: def.name, description: def.description, parameters: def.parameters });
       }
 
@@ -291,15 +299,13 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
        */
       const skills = harness.parseRegionSkills(resultContent);
 
+      // The model's choice has grown: each call from here records the tools it really had.
+      if (minted.length && caller.executionId && caller.nodeId) saveAvailableTools(caller.executionId, caller.nodeId, minted.map((m) => m.name));
       return { content, minted, skills };
     },
 
     endsTurn(calls) {
       return harness.isTurnEndingHandoff(calls, handoffTools);
     },
-
-    kindOf(toolName) {
-      return taskTools.has(toolName) ? "task" : "tool";
-    },
   };
 }

package/vendor/base/src/manifests/runtime/channels/final.ts

@@ -148,7 +148,10 @@ export async function runFinal(
     const res = await sendRequest(node, call, ctx, node.type);
     const transport = call.transport;
 
-    if (transport === "json" || transport === "text") {
+    // Every SETTLED transport readSettled knows, not only json and text: a node may end on a
+    // file download (binary) or an xml body just as it may on a json one. binary as the final
+    // call threw here while working everywhere else (VeoVideo's download, 2026-09-29).
+    if (transport === "json" || transport === "text" || transport === "binary" || transport === "xml") {
       const payload = await readSettled(res, transport, call.encoding);
       await assertOk(node, call, payload, node.type);
       // Token usage: a settled vendor body carries it inline (Chat Completions puts it

package/vendor/base/src/manifests/runtime/duplex/session.ts

@@ -68,7 +68,7 @@ const IDLE_TIMEOUT_MS = 30_000;
 const SILENCE_TIMEOUT_MS = 60_000;
 const MAX_SESSION_MS = 30 * 60_000;
 
-import { offerDiscovered, parseMaybeJson, recordToolTrace, type ToolBridge } from "../tools/toolloop.js";
+import { offerDiscovered, parseMaybeJson, type ToolBridge } from "../tools/toolloop.js";
 import { applyInForce, renderSkillsText, type InForceSkill } from "../tools/regionSkills.js";
 import { registerLiveInput, liveInputKey } from "../../../platform/liveInput.js";
 
@@ -750,10 +750,6 @@ export async function runDuplexSession(opts: {
               // A lookup takes 8-9s, and silence on a call reads as a dropped line. The client,
               // the lookup-indicator and the docs all had this wired already; nothing ever sent it.
               sendState("tool", "TOOL_USE", { toolName: name });
-              // Started BEFORE the call, so the timeline bar measures the wait the caller
-              // actually sat through, not the bookkeeping after it.
-              const toolStart = Date.now();
-              let toolOk = true;
               try {
                 const args = JSON.parse(rawArgs || "{}");
                 /**
@@ -825,12 +821,10 @@ export async function runDuplexSession(opts: {
               } catch (err: any) {
                 // Reported TO THE MODEL rather than thrown. A failed tool on a live call should let
                 // the assistant say it could not do the thing, not drop the conversation.
-                toolOk = false;
                 output = `Tool "${name}" failed: ${err?.message ?? err}`;
               }
-              // The same timeline row an HTTP agent's tool call draws. `runToolLoop` has recorded
-              // these since the migration; the socket never called it, so voice tools were invisible.
-              recordToolTrace(node, ctx, name, parseMaybeJson(rawArgs), output, toolStart, toolOk, tools.kindOf?.(name) ?? "tool");
+              // The timeline row is the tool's own (packages/docs/nodes/mcp-services.md, "Who records
+              // a call"), so a voice Agent's calls read the same as a text Agent's.
               // After the catch, so a tool that THREW still stops the dots. Spinning forever is
               // worse than no indicator: it promises something still coming.
               sendState("tool", "TOOL_USE_COMPLETED");