n8n 2.35.4 → 2.36.2

package/dist/modules/instance-ai/instance-ai.service.js

@@ -10,6 +10,8 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.InstanceAiService = exports.QuotaExhaustedStreamError = exports.QUOTA_EXHAUSTED_USER_MESSAGE = void 0;
+exports.buildContextResourcesBlock = buildContextResourcesBlock;
+exports.isAttachmentRejectedByProviderError = isAttachmentRejectedByProviderError;
 exports.getUserFacingErrorMessage = getUserFacingErrorMessage;
 exports.isMaskedStreamFailure = isMaskedStreamFailure;
 const agents_1 = require("@n8n/agents");
@@ -32,9 +34,9 @@ const forbidden_error_1 = require("../../errors/response-errors/forbidden.error"
 const event_service_1 = require("../../events/event.service");
 const instance_ai_builder_delegate_adapter_1 = require("../../modules/agents/instance-ai-builder-delegate.adapter");
 const check_access_1 = require("../../permissions.ee/check-access");
-const source_control_preferences_service_ee_1 = require("../../modules/source-control.ee/source-control-preferences.service.ee");
 const publisher_service_1 = require("../../scaling/pubsub/publisher.service");
 const ai_service_1 = require("../../services/ai.service");
+const instance_write_access_service_1 = require("../../services/instance-write-access.service");
 const proxy_token_manager_1 = require("../../services/proxy-token-manager");
 const url_service_1 = require("../../services/url.service");
 const telemetry_2 = require("../../telemetry");
@@ -42,6 +44,8 @@ const utils_1 = require("../../utils");
 const agent_preview_handoff_1 = require("./agent-preview-handoff");
 const composite_local_mcp_server_1 = require("./browser/composite-local-mcp-server");
 const instance_ai_browser_session_service_1 = require("./browser/instance-ai-browser-session.service");
+const canvas_node_context_flag_gate_1 = require("./canvas-node-context-flag-gate");
+const drop_rejected_attachments_1 = require("./drop-rejected-attachments");
 const thread_credential_allowlist_service_1 = require("./eval/thread-credential-allowlist.service");
 const durable_event_log_1 = require("./event-bus/durable-event-log");
 const in_process_event_bus_1 = require("./event-bus/in-process-event-bus");
@@ -70,6 +74,7 @@ const db_iteration_log_storage_1 = require("./storage/db-iteration-log-storage")
 const db_snapshot_storage_1 = require("./storage/db-snapshot-storage");
 const typeorm_agent_checkpoint_store_1 = require("./storage/typeorm-agent-checkpoint-store");
 const typeorm_agent_memory_1 = require("./storage/typeorm-agent-memory");
+const stream_transport_error_1 = require("./stream-transport-error");
 const suspended_run_restorer_service_1 = require("./suspended-run-restorer.service");
 const suspended_thread_persistence_service_1 = require("./suspended-thread-persistence.service");
 const tracing_1 = require("./tracing");
@@ -92,10 +97,33 @@ function buildSuspensionTraceOutputs(runId, suspension) {
         ...(message ? { message } : {}),
     };
 }
+function buildNodesAttachmentLine(attachment) {
+    const setLines = attachment.sets.map((set) => {
+        const names = set.nodes.map((node) => node.name ?? node.id);
+        const label = names.length === 1
+            ? `Node "${names[0]}"`
+            : `A chain of connected nodes: ${names.join(' → ')}`;
+        const input = set.inputNode ? `, preceded by "${set.inputNode.name ?? set.inputNode.id}"` : '';
+        const output = set.outputNode
+            ? `, followed by "${set.outputNode.name ?? set.outputNode.id}"`
+            : '';
+        const group = set.canvasGroupName
+            ? `, part of canvas group "${set.canvasGroupName}"`
+            : set.canvasGroupId
+                ? `, part of canvas group \`${set.canvasGroupId}\``
+                : '';
+        return `  - ${label}${input}${output}${group}.`;
+    });
+    return `- Selected nodes in workflow \`${attachment.workflowId}\`:\n${setLines.join('\n')}`;
+}
 function buildContextResourcesBlock(contextAttachments) {
-    if (contextAttachments.length === 0)
+    if (contextAttachments.length === 0) {
         return '';
+    }
     const lines = contextAttachments.map((attachment) => {
+        if (attachment.type === 'nodes') {
+            return buildNodesAttachmentLine(attachment);
+        }
         const name = attachment.name ? ` "${attachment.name}"` : '';
         if (attachment.type === 'agent') {
             if (attachment.pending) {
@@ -124,6 +152,9 @@ function buildContextResourcesBlock(contextAttachments) {
         .join('\n');
     return `${internal_messages_1.EDITOR_CONTEXT_OPEN_TAG}\n${JSON.stringify(contextAttachments)}\n\n${prose}\n${internal_messages_1.EDITOR_CONTEXT_CLOSE_TAG}`;
 }
+function isNamedResourceAttachment(attachment) {
+    return attachment.type !== 'nodes' && Boolean(attachment.name);
+}
 function buildHandoffContextBlock(context) {
     if (!context || context.source !== 'credential-modal')
         return '';
@@ -181,16 +212,41 @@ function isSandboxEndpointNotAllowedError(error) {
 function isStaleResumeError(error) {
     return error instanceof Error && error.name === 'StaleResumeError';
 }
+const ATTACHMENT_SUBJECT_PATTERN = /image|attachment/;
+const ATTACHMENT_REFUSAL_PATTERN = /exceed|too large|maximum|max allowed|could not process/;
+function collectErrorText(value, depth = 0) {
+    if (depth > 4 || value === null || value === undefined)
+        return [];
+    if (typeof value === 'string')
+        return [value];
+    if (Array.isArray(value))
+        return value.flatMap((item) => collectErrorText(item, depth + 1));
+    if (value instanceof Error) {
+        return [value.message, ...collectErrorText(Reflect.get(value, 'cause'), depth + 1)];
+    }
+    if (typeof value === 'object') {
+        const record = value;
+        return ['message', 'error', 'responseBody', 'data', 'cause', 'errors'].flatMap((key) => collectErrorText(record[key], depth + 1));
+    }
+    return [];
+}
+function isAttachmentRejectedByProviderError(error) {
+    const haystack = [getErrorMessage(error), ...collectErrorText(error)].join(' ').toLowerCase();
+    return ATTACHMENT_SUBJECT_PATTERN.test(haystack) && ATTACHMENT_REFUSAL_PATTERN.test(haystack);
+}
 exports.QUOTA_EXHAUSTED_USER_MESSAGE = "You've run out of AI credits. Upgrade your plan to continue using the AI assistant.";
 const OPERATIONAL_ERROR_USER_MESSAGE = 'I hit an operational error before I could finish that response. Please try again.';
 const GENERIC_ERROR_USER_MESSAGE = 'Something went wrong before I could finish that response. Please try again.';
 function getUserFacingErrorCode(error) {
     return (0, instance_ai_1.isQuotaExhaustedError)(error) ? 'quota_exhausted' : undefined;
 }
-function getUserFacingErrorMessage(error, fallback = GENERIC_ERROR_USER_MESSAGE) {
+function getUserFacingErrorMessage(error, fallback = GENERIC_ERROR_USER_MESSAGE, opts = {}) {
     if ((0, instance_ai_1.isQuotaExhaustedError)(error)) {
         return exports.QUOTA_EXHAUSTED_USER_MESSAGE;
     }
+    if ((0, stream_transport_error_1.isStreamTransportError)(error)) {
+        return 'The connection to the AI provider dropped before I could finish that response. Please try again.';
+    }
     if (error instanceof n8n_workflow_1.UserError) {
         return error.message;
     }
@@ -200,6 +256,16 @@ function getUserFacingErrorMessage(error, fallback = GENERIC_ERROR_USER_MESSAGE)
     if (isSandboxEndpointNotAllowedError(error)) {
         return "I couldn't finish preparing the workspace sandbox. Please try again in a moment.";
     }
+    if (opts.attachmentRemoved !== undefined || isAttachmentRejectedByProviderError(error)) {
+        const sizeAdvice = isAttachmentRejectedByProviderError(error)
+            ? ` Keep it under ${(0, api_types_1.formatAttachmentSizeLimit)()}, and for images no more than 8000x8000 pixels.`
+            : '';
+        return opts.attachmentRemoved === false
+            ? 'I could not read one of the attached files, and I could not remove it from this ' +
+                `conversation either. Start a new chat and attach it again.${sizeAdvice}`
+            : 'I could not read one of the attached files, so I left it out. Attach it again — ' +
+                `ideally a smaller version.${sizeAdvice}`;
+    }
     if (error instanceof n8n_workflow_1.OperationalError) {
         return OPERATIONAL_ERROR_USER_MESSAGE;
     }
@@ -212,6 +278,18 @@ function isMaskedStreamFailure(error) {
         return true;
     return error.name === 'TypeError' && error.message === 'terminated';
 }
+const GENERATION_STAGE_ERROR_CODES = new Set([
+    'missing_captured_fields',
+    'unresolved_field',
+    'gateway_context_missing',
+]);
+function failureStageForErrorCode(errorCode) {
+    if (errorCode && GENERATION_STAGE_ERROR_CODES.has(errorCode))
+        return 'generation';
+    if (errorCode === 'credential_create_failed')
+        return 'persistence';
+    return 'unknown';
+}
 class QuotaExhaustedStreamError extends n8n_workflow_1.UserError {
     constructor(maskedError) {
         super(`AI credits exhausted (${maskedError.name}: ${maskedError.message})`, {
@@ -266,15 +344,21 @@ function toConfirmationData(request) {
         case 'credentialSelection':
             return { approved: true, credentials: request.credentials };
         case 'credentialAutoSetup':
-            return { approved: true, autoSetup: { credentialType: request.credentialType } };
+            return {
+                approved: true,
+                autoSetup: { credentialType: request.credentialType, attemptId: request.attemptId },
+            };
         case 'resourceDecision':
             return { approved: true, resourceDecision: request.resourceDecision };
+        case 'mcpConnect':
+            return { approved: request.approved, connectedSlugs: request.connectedSlugs };
         case 'setupWorkflowApply':
             return {
                 approved: true,
                 action: 'apply',
                 nodeCredentials: request.nodeCredentials,
                 nodeParameters: request.nodeParameters,
+                skippedNodes: request.skippedNodes,
             };
         case 'setupWorkflowTestTrigger':
             return {
@@ -293,7 +377,7 @@ let InstanceAiService = class InstanceAiService {
         }
         return this._mcpClientManager;
     }
-    constructor(logger, globalConfig, instanceSettings, adapterService, eventBus, eventLog, interruptedRunSweeper, settingsService, gatewayService, browserSessionService, memoryService, agentMemory, checkpointStore, aiService, threadGrantRepo, pendingConfirmationRepo, urlService, dbSnapshotStorage, dbIterationLogStorage, sourceControlPreferencesService, telemetry, mcpRegistryService, userRepository, temporaryWorkflowService, errorReporter, ssrfProtectionConfig, ssrfProtectionService, eventService, evalCredentialAllowlists, runProbe, modelService, creditService, publisher, instanceAiErrorReporter) {
+    constructor(logger, globalConfig, instanceSettings, adapterService, eventBus, eventLog, interruptedRunSweeper, settingsService, gatewayService, browserSessionService, memoryService, agentMemory, checkpointStore, aiService, threadGrantRepo, pendingConfirmationRepo, urlService, dbSnapshotStorage, dbIterationLogStorage, instanceWriteAccess, telemetry, mcpRegistryService, userRepository, temporaryWorkflowService, errorReporter, ssrfProtectionConfig, ssrfProtectionService, eventService, evalCredentialAllowlists, runProbe, modelService, creditService, publisher, instanceAiErrorReporter, canvasNodeContextFlagGate) {
         this.instanceSettings = instanceSettings;
         this.adapterService = adapterService;
         this.eventBus = eventBus;
@@ -311,7 +395,7 @@ let InstanceAiService = class InstanceAiService {
         this.urlService = urlService;
         this.dbSnapshotStorage = dbSnapshotStorage;
         this.dbIterationLogStorage = dbIterationLogStorage;
-        this.sourceControlPreferencesService = sourceControlPreferencesService;
+        this.instanceWriteAccess = instanceWriteAccess;
         this.telemetry = telemetry;
         this.mcpRegistryService = mcpRegistryService;
         this.userRepository = userRepository;
@@ -323,11 +407,13 @@ let InstanceAiService = class InstanceAiService {
         this.creditService = creditService;
         this.publisher = publisher;
         this.instanceAiErrorReporter = instanceAiErrorReporter;
+        this.canvasNodeContextFlagGate = canvasNodeContextFlagGate;
         this.runState = new instance_ai_1.RunStateRegistry();
         this.backgroundTasks = new instance_ai_1.BackgroundTaskManager(MAX_CONCURRENT_BACKGROUND_TASKS_PER_THREAD);
         this.memoryTaskRegistry = new instance_ai_1.MemoryTaskRegistry();
         this.domainAccessTrackersByThread = new Map();
         this.threadPushRef = new Map();
+        this.pendingBrowserCredentialSetups = new Map();
         this.planRequestsByThread = new Map();
         this.schedulerLocks = new Map();
         this.failedInternalFollowUpStreaks = new Map();
@@ -404,6 +490,7 @@ let InstanceAiService = class InstanceAiService {
             dbSnapshotStorage: this.dbSnapshotStorage,
             agentMemory: this.agentMemory,
             telemetry: this.telemetry,
+            errorReporter: this.instanceAiErrorReporter,
             logger: this.logger,
             runState: this.runState,
             suspendedThreads: this.suspendedThreads,
@@ -494,6 +581,18 @@ let InstanceAiService = class InstanceAiService {
             });
         }
     }
+    async revokeThreadSessionGrant(threadId, userId, key) {
+        try {
+            await this.threadGrantRepo.revoke(threadId, userId, key);
+        }
+        catch (error) {
+            this.logger.warn('Failed to revoke Instance AI session grant', {
+                threadId,
+                key,
+                error: getErrorMessage(error),
+            });
+        }
+    }
     isProxyEnabled() {
         return this.modelService.isProxyEnabled();
     }
@@ -502,6 +601,15 @@ let InstanceAiService = class InstanceAiService {
         const credits = await this.modelService.getCredits(user);
         return (0, instance_ai_credit_display_1.maskCreditsForDisplay)(credits, this.settingsService.isActivationCapped());
     }
+    async dropTurnAttachments(args) {
+        const outcome = await (0, drop_rejected_attachments_1.dropRejectedAttachmentsFromHistory)(this.agentMemory, { threadId: args.threadId, resourceId: args.resourceId }, this.logger);
+        if (outcome === 'no-attachments')
+            return undefined;
+        return outcome === 'removed';
+    }
+    shouldDropTurnAttachments(args) {
+        return args.turnHadAttachments && args.producedNoOutput;
+    }
     async reclassifyMaskedStreamFailure(error, user, context) {
         if (!isMaskedStreamFailure(error))
             return error;
@@ -563,7 +671,9 @@ let InstanceAiService = class InstanceAiService {
     }
     subscribeToAgentErrors(agent, threadId, runId) {
         agent.on("error", (event) => {
-            if (event.type !== "error" || !event.source)
+            if (event.type !== "error")
+                return;
+            if (!event.source)
                 return;
             const severity = (0, instance_ai_error_reporter_service_1.getAgentErrorSeverity)(event.source);
             this.instanceAiErrorReporter.report(event.error, {
@@ -1331,9 +1441,10 @@ let InstanceAiService = class InstanceAiService {
         const userGateway = this.gatewayService.findGateway(user.id);
         await this.creditService.ensureQuotaLockApplied(user);
         const { searchProxyConfig, tracingProxyConfig, tokenManager, proxyBaseUrl } = proxyRunConfig ?? (await this.createProxyRunConfig(user));
+        const proxyContext = { runId, threadId };
         const modelId = proxyBaseUrl && tokenManager
-            ? await this.modelService.resolveProxyModel(user, proxyBaseUrl, tokenManager)
-            : await this.modelService.resolveAgentModelConfig(user);
+            ? await this.modelService.resolveProxyModel(user, proxyBaseUrl, tokenManager, proxyContext)
+            : await this.modelService.resolveAgentModelConfig(user, proxyContext);
         const configEvalsEnabled = await this.adapterService.isConfigEvalsEnabled(user);
         const mcpConnectionsEnabled = await this.adapterService.isMcpConnectionsEnabled(user);
         const context = this.adapterService.createContext(user, {
@@ -1357,11 +1468,12 @@ let InstanceAiService = class InstanceAiService {
             context.localMcpServer = localMcpServer;
         }
         context.permissions = this.settingsService.getPermissions();
-        if (this.sourceControlPreferencesService.getPreferences().branchReadOnly) {
+        if (this.instanceWriteAccess.isReadOnly()) {
             context.permissions = (0, api_types_1.applyBranchReadOnlyOverrides)(context.permissions);
             context.branchReadOnly = true;
         }
         context.runId = runId;
+        context.browserCredentialSetup = this.createBrowserCredentialSetupTracker(runId, user.id);
         const sessionGrants = await this.loadThreadSessionGrants(threadId, user.id);
         context.sessionApprovedToolKeys = sessionGrants;
         const grantSessionToolApproval = async (key) => {
@@ -1369,6 +1481,10 @@ let InstanceAiService = class InstanceAiService {
             sessionGrants.add(key);
         };
         context.grantSessionToolApproval = grantSessionToolApproval;
+        context.revokeSessionToolApproval = async (key) => {
+            await this.revokeThreadSessionGrant(threadId, user.id, key);
+            sessionGrants.delete(key);
+        };
         const domainTracker = (0, instance_ai_1.createDomainAccessTracker)({
             grantedKeys: sessionGrants,
             persistGrant: grantSessionToolApproval,
@@ -1451,7 +1567,7 @@ let InstanceAiService = class InstanceAiService {
                     if (!workspace)
                         return undefined;
                     const root = await (0, instance_ai_1.getWorkspaceRoot)(workspace);
-                    return (0, instance_ai_1.createScopedWorkspace)(workspace, root);
+                    return (0, agents_1.createScopedWorkspace)(workspace, root);
                 };
                 runtimeWorkspace = (0, instance_ai_1.createLazyRuntimeWorkspace)({
                     sandboxInstructions: '',
@@ -2079,14 +2195,21 @@ let InstanceAiService = class InstanceAiService {
             });
         }
     }
-    async executeRun(user, threadId, runId, message, abortController, attachments, handoffContext, messageGroupId, timeZone, isReplanFollowUp = false, checkpoint, resumeReason, plannedBuild) {
-        const fileAttachments = (attachments ?? []).filter((attachment) => attachment.type === 'file');
-        const workflowAttachments = (attachments ?? []).filter((attachment) => attachment.type === 'workflow');
-        const agentAttachments = (attachments ?? []).filter((attachment) => attachment.type === 'agent');
-        const contextAttachments = [
+    async resolveContextAttachments(attachments, user) {
+        const attachmentsOrEmpty = attachments ?? [];
+        const workflowAttachments = attachmentsOrEmpty.filter((attachment) => attachment.type === 'workflow');
+        const agentAttachments = attachmentsOrEmpty.filter((attachment) => attachment.type === 'agent');
+        const nodeAttachments = attachmentsOrEmpty.filter((attachment) => attachment.type === 'nodes');
+        const canvasNodeContextEnabled = nodeAttachments.length > 0 && (await this.canvasNodeContextFlagGate.isEnabled(user));
+        return [
             ...workflowAttachments,
             ...agentAttachments,
+            ...(canvasNodeContextEnabled ? nodeAttachments : []),
         ];
+    }
+    async executeRun(user, threadId, runId, message, abortController, attachments, handoffContext, messageGroupId, timeZone, isReplanFollowUp = false, checkpoint, resumeReason, plannedBuild) {
+        const fileAttachments = (attachments ?? []).filter((attachment) => attachment.type === 'file');
+        const contextAttachments = await this.resolveContextAttachments(attachments, user);
         const signal = abortController.signal;
         let tracing;
         let messageTraceFinalization;
@@ -2094,6 +2217,7 @@ let InstanceAiService = class InstanceAiService {
         let activeSnapshotStorage;
         let messageId = '';
         let streamReached = false;
+        let turnHadFileAttachments = false;
         const turnStartedAt = new Date();
         let errorReporterExecutionToken;
         try {
@@ -2108,6 +2232,9 @@ let InstanceAiService = class InstanceAiService {
             }
             if (contextAttachments.length) {
                 traceInput.resourceAttachments = contextAttachments.map((attachment) => {
+                    if (attachment.type === 'nodes') {
+                        return { type: attachment.type, id: attachment.workflowId };
+                    }
                     const resource = {
                         type: attachment.type,
                         id: attachment.id,
@@ -2283,8 +2410,7 @@ let InstanceAiService = class InstanceAiService {
             }
             const thread = await memory.getThread(threadId);
             if (thread && !thread.title) {
-                const handoffTitle = contextAttachments.find((attachment) => attachment.name)?.name ??
-                    agentPreviewTitleFallback;
+                const handoffTitle = contextAttachments.find(isNamedResourceAttachment)?.name ?? agentPreviewTitleFallback;
                 await (0, instance_ai_1.patchThread)(memory, {
                     threadId,
                     update: ({ metadata }) => handoffTitle
@@ -2310,6 +2436,7 @@ let InstanceAiService = class InstanceAiService {
             if (fileAttachments.length > 0) {
                 const classifiedAttachments = (0, instance_ai_1.classifyAttachments)(fileAttachments);
                 nonStructuredAttachments = fileAttachments.filter((attachment) => !(0, instance_ai_1.isParseableAttachment)(attachment));
+                turnHadFileAttachments = nonStructuredAttachments.length > 0;
                 hasParseableAttachment = classifiedAttachments.some((attachment) => attachment.parseable);
                 attachmentManifest = (0, instance_ai_1.buildAttachmentManifest)(classifiedAttachments);
             }
@@ -2533,6 +2660,7 @@ let InstanceAiService = class InstanceAiService {
             if (result.status === 'errored') {
                 this.instanceAiErrorReporter.report(terminalError ?? new Error('Instance AI stream errored'), {
                     component: 'instance-ai-stream',
+                    providerStream: true,
                     threadId,
                     runId,
                     tracing,
@@ -2542,7 +2670,15 @@ let InstanceAiService = class InstanceAiService {
                     messageId,
                 });
             }
-            const userFacingErrorMessage = result.status === 'errored' ? getUserFacingErrorMessage(terminalError) : undefined;
+            const attachmentRemoved = this.shouldDropTurnAttachments({
+                turnHadAttachments: turnHadFileAttachments,
+                producedNoOutput: result.status === 'errored' && outputText.length === 0,
+            })
+                ? await this.dropTurnAttachments({ threadId, resourceId: user.id })
+                : undefined;
+            const userFacingErrorMessage = result.status === 'errored'
+                ? getUserFacingErrorMessage(terminalError, undefined, { attachmentRemoved })
+                : undefined;
             const userFacingErrorCode = result.status === 'errored' ? getUserFacingErrorCode(terminalError) : undefined;
             if (runControl.shouldEmitTerminalOutcome(result.stopReason)) {
                 await this.terminalOutcome.evaluateTerminalResponse(threadId, runId, result.status, {
@@ -2640,8 +2776,16 @@ let InstanceAiService = class InstanceAiService {
                 threadId,
                 runId,
             });
+            const attachmentRemoved = this.shouldDropTurnAttachments({
+                turnHadAttachments: turnHadFileAttachments,
+                producedNoOutput: true,
+            })
+                ? await this.dropTurnAttachments({ threadId, resourceId: user.id })
+                : undefined;
             const errorMessage = getErrorMessage(terminalError);
-            const userFacingErrorMessage = getUserFacingErrorMessage(terminalError);
+            const userFacingErrorMessage = getUserFacingErrorMessage(terminalError, undefined, {
+                attachmentRemoved,
+            });
             const userFacingErrorCode = getUserFacingErrorCode(terminalError);
             const errCtx = {
                 threadId,
@@ -3052,7 +3196,7 @@ let InstanceAiService = class InstanceAiService {
             throw new forbidden_error_1.ForbiddenError('You do not have permission to load or edit agent previews in this project.');
         }
     }
-    async rebuildAgentForAutoSetupResume(user, threadId, runId, abortController, tracing, runHandoff, messageGroupId) {
+    async rebuildAgentForResume(user, threadId, runId, abortController, tracing, runHandoff, messageGroupId) {
         try {
             const rebuilt = await this.buildFreshInstanceAgent(user, threadId, runId, abortController.signal, tracing, messageGroupId, this.threadPushRef.get(threadId));
             (0, instance_ai_1.createOrchestratorRunControl)(rebuilt.orchestrationContext, runHandoff ?? {});
@@ -3063,7 +3207,7 @@ let InstanceAiService = class InstanceAiService {
             };
         }
         catch (error) {
-            this.logger.warn('Failed to rebuild agent for credential auto-setup resume', {
+            this.logger.warn('Failed to rebuild agent for resume', {
                 threadId,
                 runId,
                 error: getErrorMessage(error),
@@ -3116,11 +3260,14 @@ let InstanceAiService = class InstanceAiService {
             ...(data.domainAccessAction ? { domainAccessAction: data.domainAccessAction } : {}),
             ...(data.action ? { action: data.action } : {}),
             ...(data.nodeParameters ? { nodeParameters: data.nodeParameters } : {}),
+            ...(data.skippedNodes ? { skippedNodes: data.skippedNodes } : {}),
             ...(data.testTriggerNode ? { testTriggerNode: data.testTriggerNode } : {}),
             ...(data.answers ? { answers: data.answers } : {}),
             ...(data.resourceDecision ? { resourceDecision: data.resourceDecision } : {}),
             ...(data.scope ? { scope: data.scope } : {}),
             ...(data.autoSetup ? { autoSetup: data.autoSetup } : {}),
+            ...(data.denied ? { denied: true } : {}),
+            ...(data.connectedSlugs ? { connectedSlugs: data.connectedSlugs } : {}),
         };
         const resumeTracing = await this.tracing.createOrchestratorResumeTraceContext({
             baseTracing: tracing,
@@ -3159,8 +3306,8 @@ let InstanceAiService = class InstanceAiService {
         let resumeAgent = agent;
         let resumeModelId = modelId;
         let resumeOrchestrationContext = orchestrationContext;
-        if (data.autoSetup) {
-            const rebuilt = await this.rebuildAgentForAutoSetupResume(activeUser, threadId, runId, abortController, effectiveTracing, runHandoff, messageGroupId);
+        if (data.autoSetup || data.connectedSlugs?.length) {
+            const rebuilt = await this.rebuildAgentForResume(activeUser, threadId, runId, abortController, effectiveTracing, runHandoff, messageGroupId);
             if (!rebuilt) {
                 const rebuildFailure = 'Agent rebuild failed';
                 await this.tracing.finalizeDetachedTraceRun(`resume-rebuild:${runId}`, unregisteredResumeTracing, {
@@ -3217,6 +3364,7 @@ let InstanceAiService = class InstanceAiService {
         let resumeClaimed = false;
         let resumeTraceRegistered = false;
         let errorReporterExecutionToken;
+        let resumedRunProducedOutput = false;
         const onResumeClaimed = async () => {
             if (resumeClaimed)
                 return;
@@ -3389,6 +3537,7 @@ let InstanceAiService = class InstanceAiService {
                 return;
             }
             const outputText = await (result.text ?? Promise.resolve(''));
+            resumedRunProducedOutput = outputText.length > 0;
             const messageGroupId = this.tracing.getMessageGroupId(opts.runId);
             const terminalError = result.status === 'errored'
                 ? await this.reclassifyMaskedStreamFailure(result.error, opts.user, {
@@ -3399,6 +3548,7 @@ let InstanceAiService = class InstanceAiService {
             if (result.status === 'errored') {
                 this.instanceAiErrorReporter.report(terminalError ?? new Error('Instance AI resumed stream errored'), {
                     component: 'instance-ai-stream',
+                    providerStream: true,
                     threadId: opts.threadId,
                     runId: opts.runId,
                     tracing: opts.tracing,
@@ -3407,7 +3557,18 @@ let InstanceAiService = class InstanceAiService {
                     messageGroupId,
                 });
             }
-            const userFacingErrorMessage = result.status === 'errored' ? getUserFacingErrorMessage(terminalError) : undefined;
+            const attachmentRemoved = this.shouldDropTurnAttachments({
+                turnHadAttachments: true,
+                producedNoOutput: result.status === 'errored' && outputText.length === 0,
+            })
+                ? await this.dropTurnAttachments({
+                    threadId: opts.threadId,
+                    resourceId: opts.user.id,
+                })
+                : undefined;
+            const userFacingErrorMessage = result.status === 'errored'
+                ? getUserFacingErrorMessage(terminalError, undefined, { attachmentRemoved })
+                : undefined;
             const userFacingErrorCode = result.status === 'errored' ? getUserFacingErrorCode(terminalError) : undefined;
             if (runControl.shouldEmitTerminalOutcome(result.stopReason)) {
                 await this.terminalOutcome.evaluateTerminalResponse(opts.threadId, opts.runId, result.status, {
@@ -3505,8 +3666,19 @@ let InstanceAiService = class InstanceAiService {
                 threadId: opts.threadId,
                 runId: opts.runId,
             });
+            const attachmentRemoved = this.shouldDropTurnAttachments({
+                turnHadAttachments: true,
+                producedNoOutput: !resumedRunProducedOutput,
+            })
+                ? await this.dropTurnAttachments({
+                    threadId: opts.threadId,
+                    resourceId: opts.user.id,
+                })
+                : undefined;
             const errorMessage = getErrorMessage(terminalError);
-            const userFacingErrorMessage = getUserFacingErrorMessage(terminalError);
+            const userFacingErrorMessage = getUserFacingErrorMessage(terminalError, undefined, {
+                attachmentRemoved,
+            });
             const userFacingErrorCode = getUserFacingErrorCode(terminalError);
             const messageGroupId = this.tracing.getMessageGroupId(opts.runId);
             const errCtx = {
@@ -3897,6 +4069,8 @@ let InstanceAiService = class InstanceAiService {
         const inputThreadId = (0, nanoid_1.nanoid)();
         payload.inputThreadId = inputThreadId;
         const inputType = payload.inputType;
+        const mcpConnectServers = api_types_1.mcpConnectRequestSchema.safeParse(payload.mcpConnectRequest).data
+            ?.servers;
         let type;
         if (inputType) {
             type = inputType;
@@ -3907,6 +4081,9 @@ let InstanceAiService = class InstanceAiService {
         else if (Array.isArray(payload.credentialRequests) && payload.credentialRequests.length > 0) {
             type = 'credential-setup';
         }
+        else if (mcpConnectServers) {
+            type = 'mcp-connect';
+        }
         else {
             type = 'approval';
         }
@@ -3920,6 +4097,9 @@ let InstanceAiService = class InstanceAiService {
         else if (Array.isArray(payload.credentialRequests)) {
             numSteps = payload.credentialRequests.length;
         }
+        else if (mcpConnectServers) {
+            numSteps = mcpConnectServers.length;
+        }
         if (inputType === 'plan-review') {
             const planCount = (this.planRequestsByThread.get(threadId) ?? 0) + 1;
             this.planRequestsByThread.set(threadId, planCount);
@@ -4004,6 +4184,7 @@ let InstanceAiService = class InstanceAiService {
             status: effectiveStatus,
             ...(userId ? { user_id: userId } : {}),
         });
+        this.emitBrowserCredentialSetupOutcomes(threadId, runId, status, reason);
         if (status === 'errored') {
             this.telemetry.track('Builder generation errored', {
                 thread_id: threadId,
@@ -4014,6 +4195,86 @@ let InstanceAiService = class InstanceAiService {
             });
         }
     }
+    createBrowserCredentialSetupTracker(runId, userId) {
+        const getOrCreateAttempts = () => {
+            let pending = this.pendingBrowserCredentialSetups.get(runId);
+            if (!pending) {
+                pending = { userId, attempts: [] };
+                this.pendingBrowserCredentialSetups.set(runId, pending);
+            }
+            return pending.attempts;
+        };
+        const resolveOpenAttempt = (credentialType) => {
+            const attempts = getOrCreateAttempts();
+            let attempt = attempts.findLast((a) => a.credentialType === credentialType && !a.created);
+            if (!attempt) {
+                attempt = {
+                    credentialType,
+                    setupMethod: 'conversation',
+                    startedAt: Date.now(),
+                    created: false,
+                };
+                attempts.push(attempt);
+            }
+            return attempt;
+        };
+        return {
+            markPending: (credentialType, attemptId) => {
+                const attempts = getOrCreateAttempts();
+                if (attemptId && attempts.some((attempt) => attempt.attemptId === attemptId)) {
+                    return;
+                }
+                attempts.push({
+                    credentialType,
+                    setupMethod: 'setup_card',
+                    attemptId,
+                    startedAt: Date.now(),
+                    created: false,
+                });
+            },
+            markCreated: (credentialType) => {
+                const attempt = resolveOpenAttempt(credentialType);
+                attempt.created = true;
+                attempt.errorCode = undefined;
+            },
+            markCreateFailed: (credentialType, errorCode) => {
+                resolveOpenAttempt(credentialType).errorCode = errorCode;
+            },
+        };
+    }
+    emitBrowserCredentialSetupOutcomes(threadId, runId, runStatus, runFinishReason) {
+        const browserSetup = this.pendingBrowserCredentialSetups.get(runId);
+        if (!browserSetup)
+            return;
+        this.pendingBrowserCredentialSetups.delete(runId);
+        const terminalErrorCode = runStatus === 'completed'
+            ? 'not_attempted'
+            : runStatus === 'errored'
+                ? 'run_errored'
+                : runFinishReason === liveness_1.INSTANCE_AI_RUN_TIMEOUT_REASON
+                    ? 'run_timed_out'
+                    : 'run_cancelled';
+        for (const attempt of browserSetup.attempts) {
+            this.telemetry.track('Instance AI Browser Use credential setup completed', {
+                user_id: browserSetup.userId,
+                credential_type: attempt.credentialType,
+                status: attempt.created ? 'success' : 'failure',
+                ...(attempt.created
+                    ? {}
+                    : {
+                        failure_stage: failureStageForErrorCode(attempt.errorCode),
+                        error_code: attempt.errorCode ?? terminalErrorCode,
+                    }),
+                is_valid: null,
+                is_new: true,
+                setup_method: attempt.setupMethod,
+                thread_id: threadId,
+                run_id: runId,
+                ...(attempt.attemptId ? { credential_setup_attempt_id: attempt.attemptId } : {}),
+                duration_ms: Date.now() - attempt.startedAt,
+            });
+        }
+    }
     async finalizeRun(threadId, runId, status, snapshotStorage, options) {
         this.publishRunFinish(threadId, runId, status, options?.errorReason, options?.archivedWorkflowIds, options?.userId, options?.errorInfo);
         this.emitRunMetrics(threadId, status, options);
@@ -4242,6 +4503,6 @@ __decorate([
 ], InstanceAiService.prototype, "stopCheckpointPruning", null);
 exports.InstanceAiService = InstanceAiService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [backend_common_1.Logger, config_1.GlobalConfig, n8n_core_1.InstanceSettings, instance_ai_adapter_service_1.InstanceAiAdapterService, in_process_event_bus_1.InProcessEventBus, durable_event_log_1.DurableEventLog, interrupted_run_sweeper_1.InterruptedRunSweeper, instance_ai_settings_service_1.InstanceAiSettingsService, instance_ai_gateway_service_1.InstanceAiGatewayService, instance_ai_browser_session_service_1.InstanceAiBrowserSessionService, instance_ai_memory_service_1.InstanceAiMemoryService, typeorm_agent_memory_1.TypeORMAgentMemory, typeorm_agent_checkpoint_store_1.TypeORMAgentCheckpointStore, ai_service_1.AiService, instance_ai_thread_grant_repository_1.InstanceAiThreadGrantRepository, instance_ai_pending_confirmation_repository_1.InstanceAiPendingConfirmationRepository, url_service_1.UrlService, db_snapshot_storage_1.DbSnapshotStorage, db_iteration_log_storage_1.DbIterationLogStorage, source_control_preferences_service_ee_1.SourceControlPreferencesService, telemetry_2.Telemetry, mcp_1.InstanceAiMcpRegistryService, db_1.UserRepository, instance_ai_temporary_workflow_service_1.InstanceAiTemporaryWorkflowService, n8n_core_1.ErrorReporter, config_1.SsrfProtectionConfig, backend_network_1.SsrfProtectionService, event_service_1.EventService, thread_credential_allowlist_service_1.EvalThreadCredentialAllowlistService, instance_ai_run_probe_1.InstanceAiRunProbe, instance_ai_model_service_1.InstanceAiModelService, instance_ai_credit_service_1.InstanceAiCreditService, publisher_service_1.Publisher, instance_ai_error_reporter_service_1.InstanceAiErrorReporterService])
+    __metadata("design:paramtypes", [backend_common_1.Logger, config_1.GlobalConfig, n8n_core_1.InstanceSettings, instance_ai_adapter_service_1.InstanceAiAdapterService, in_process_event_bus_1.InProcessEventBus, durable_event_log_1.DurableEventLog, interrupted_run_sweeper_1.InterruptedRunSweeper, instance_ai_settings_service_1.InstanceAiSettingsService, instance_ai_gateway_service_1.InstanceAiGatewayService, instance_ai_browser_session_service_1.InstanceAiBrowserSessionService, instance_ai_memory_service_1.InstanceAiMemoryService, typeorm_agent_memory_1.TypeORMAgentMemory, typeorm_agent_checkpoint_store_1.TypeORMAgentCheckpointStore, ai_service_1.AiService, instance_ai_thread_grant_repository_1.InstanceAiThreadGrantRepository, instance_ai_pending_confirmation_repository_1.InstanceAiPendingConfirmationRepository, url_service_1.UrlService, db_snapshot_storage_1.DbSnapshotStorage, db_iteration_log_storage_1.DbIterationLogStorage, instance_write_access_service_1.InstanceWriteAccessService, telemetry_2.Telemetry, mcp_1.InstanceAiMcpRegistryService, db_1.UserRepository, instance_ai_temporary_workflow_service_1.InstanceAiTemporaryWorkflowService, n8n_core_1.ErrorReporter, config_1.SsrfProtectionConfig, backend_network_1.SsrfProtectionService, event_service_1.EventService, thread_credential_allowlist_service_1.EvalThreadCredentialAllowlistService, instance_ai_run_probe_1.InstanceAiRunProbe, instance_ai_model_service_1.InstanceAiModelService, instance_ai_credit_service_1.InstanceAiCreditService, publisher_service_1.Publisher, instance_ai_error_reporter_service_1.InstanceAiErrorReporterService, canvas_node_context_flag_gate_1.CanvasNodeContextFlagGate])
 ], InstanceAiService);
 //# sourceMappingURL=instance-ai.service.js.map