synapse-orch-ai 1.8.0 → 1.8.2

package/backend/core/config.py

@@ -18,6 +18,36 @@ SETTINGS_FILE = os.path.join(DATA_DIR, "settings.json")
 CREDENTIALS_FILE = os.path.join(DATA_DIR, "credentials.json")
 TOKEN_FILE = os.path.join(DATA_DIR, "token.json")
 
+
+# ── Configurable timeouts ────────────────────────────────────────────────────
+# Each is read from the environment, falling back to the value hardcoded before
+# these were made configurable. Unset env → identical behavior to before.
+
+def _env_float(name: str, default: float) -> float:
+    try:
+        return float(os.getenv(name, "") or default)
+    except (TypeError, ValueError):
+        return float(default)
+
+
+def _env_int(name: str, default: int) -> int:
+    try:
+        return int(os.getenv(name, "") or default)
+    except (TypeError, ValueError):
+        return int(default)
+
+
+# Timeouts (seconds, unless the name says otherwise).
+MCP_SESSION_READ_TIMEOUT = _env_float("SYNAPSE_MCP_SESSION_READ_TIMEOUT", 60.0)
+MCP_TOOL_CALL_TIMEOUT    = _env_float("SYNAPSE_MCP_TOOL_CALL_TIMEOUT", 60.0)
+MCP_LIST_TOOLS_TIMEOUT   = _env_float("SYNAPSE_MCP_LIST_TOOLS_TIMEOUT", 15.0)
+LLM_REQUEST_TIMEOUT      = _env_float("SYNAPSE_LLM_TIMEOUT", 180.0)
+HTTP_TOOL_TIMEOUT        = _env_float("SYNAPSE_HTTP_TOOL_TIMEOUT", 30.0)
+ORCH_STEP_TIMEOUT        = _env_float("SYNAPSE_ORCH_STEP_TIMEOUT", 300.0)
+ORCH_GLOBAL_TIMEOUT_MIN  = _env_int("SYNAPSE_ORCH_GLOBAL_TIMEOUT_MINUTES", 30)
+ORCH_HUMAN_TIMEOUT       = _env_float("SYNAPSE_ORCH_HUMAN_TIMEOUT", 3600.0)
+
+
 def load_settings():
     default_settings = {
         "agent_name": "Synapse",

package/backend/core/llm_providers.py

@@ -11,6 +11,7 @@ CLI providers (cli.claude, cli.gemini, cli.codex) use locally authenticated CLI
 No API key needed — tool calling is emulated via system prompt injection + <tool_call> parsing.
 """
 import os
+import re
 import json
 import tempfile
 import asyncio
@@ -22,11 +23,50 @@ import botocore.exceptions
 from botocore import UNSIGNED as _BEDROCK_UNSIGNED
 from botocore.config import Config
 
+from core.config import LLM_REQUEST_TIMEOUT
+
 # Lock to guard the process-level AWS_BEARER_TOKEN_BEDROCK env var.
 # Multiple threads (via asyncio.to_thread) could otherwise race on set/clear.
 _aws_env_lock = threading.Lock()
 
 
+# ─── CLI auth-failure detection ──────────────────────────────────────────────
+# Specific, word-boundaried phrases only. A bare "auth" substring (the old
+# behavior) false-positives on normal model output containing "authority",
+# "authorization", "authorized", "author", etc. — which aborted otherwise
+# successful CLI runs. Keep this list specific enough that it only matches real
+# authentication failures, not incidental words in a model's response.
+_AUTH_RE = re.compile(
+    r"(?:"
+    r"not logged in"
+    r"|please log in"
+    r"|log in to"
+    r"|sign in to"
+    r"|authentication required"
+    r"|not authenticated"
+    r"|authentication failed"
+    r"|invalid api key"
+    r"|expired api key"
+    r"|api key (?:is )?(?:invalid|expired|required)"
+    r"|session (?:has )?expired"
+    r"|expired session"
+    r"|\bunauthorized\b"
+    r"|\b401\b"
+    r"|/login"
+    r")",
+    re.IGNORECASE,
+)
+
+
+def _match_auth(text: str) -> bool:
+    """Return True only if `text` contains a specific auth-failure phrase.
+
+    Deliberately avoids bare substrings like "auth"/"login"/"expired" so normal
+    model output ("authority", "authorization", ...) is never flagged.
+    """
+    return bool(text) and _AUTH_RE.search(text) is not None
+
+
 # ─── Image helpers ──────────────────────────────────────────────────────────────
 
 def _parse_data_uri(data_uri: str) -> tuple[str, str]:
@@ -343,11 +383,11 @@ async def call_cli_provider(
     Raises:
         LLMError: on timeout, auth failure, binary not found, or empty output
     """
-    import re
     from core import usage_tracker
 
     ANSI_ESCAPE = re.compile(r"\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])")
-    AUTH_PATTERNS = ["login", "authenticate", "auth", "expired", "sign in", "api key", "unauthorized"]
+    # Auth-failure detection uses the module-level _match_auth() helper (specific
+    # phrases only). Rate-limit detection keeps its broad substring list below.
     RATE_LIMIT_PATTERNS = ["429", "rate limit", "ratelimit", "quota", "too many requests", "capacity", "resource_exhausted", "ratelimitexceeded"]
 
     # Split into base ("cli.<provider>") + variant, preserving dots in the
@@ -536,7 +576,7 @@ async def call_cli_provider(
                     f"CLI provider '{cli_model}' rate limit / capacity error.\n"
                     f"Details: {stderr_text[:400]}"
                 )
-            if any(p in lower_err for p in AUTH_PATTERNS):
+            if _match_auth(stderr_text[-600:]):
                 raise LLMError(
                     f"CLI provider '{cli_model}' authentication failure detected.\n"
                     f"Run the CLI in your terminal to re-authenticate.\n"
@@ -568,8 +608,12 @@ async def call_cli_provider(
                 extracted = obj.get("result", "")
                 if isinstance(extracted, str) and extracted.strip():
                     clean = extracted.strip()
-                # Propagate JSON-level auth errors before the generic check below
-                if obj.get("is_error") and any(p in str(obj).lower() for p in AUTH_PATTERNS):
+                # Propagate JSON-level auth errors before the generic check below.
+                # Gate on the structured is_error flag and scan only the message
+                # fields — not the stringified whole object — so unrelated keys
+                # can't trip a false positive.
+                err_text = " ".join(str(obj.get(k, "")) for k in ("result", "error", "subtype"))
+                if obj.get("is_error") and _match_auth(err_text):
                     raise LLMError(
                         f"CLI provider '{cli_model}' authentication failure.\n"
                         f"Run 'claude' in your terminal to re-authenticate.\n"
@@ -584,8 +628,13 @@ async def call_cli_provider(
             sid_match = re.search(r"session[_\-]?id[:\s]+([a-zA-Z0-9_\-]{8,})", clean, re.IGNORECASE)
             new_session_id = sid_match.group(1) if sid_match else None
 
-        # Auth failure check (also catches plain-text "Not logged in" from claude)
-        if any(p in clean.lower() for p in AUTH_PATTERNS):
+        # Auth failure check (also catches plain-text "Not logged in" from claude).
+        # `clean` is the model's normal stdout on success, so only treat it as an
+        # auth failure when the process ALSO exited non-zero — a successful (exit-0)
+        # response is a valid answer, never an auth error, even if it happens to
+        # mention words like "authorization". Genuine auth failures exit non-zero
+        # (or, for claude JSON, are caught by the is_error block above).
+        if process.returncode != 0 and _match_auth(clean):
             raise LLMError(
                 f"CLI provider '{cli_model}' is not authenticated.\n"
                 f"Run the CLI in your terminal and complete the login flow, then retry.\n"
@@ -649,7 +698,7 @@ async def call_openai(model, messages, api_key, tools=None, images=None, prompt_
                     str(messages[i].get("content", "")), images
                 )
                 break
-    OPENAI_TIMEOUT = 180.0
+    OPENAI_TIMEOUT = LLM_REQUEST_TIMEOUT
     MAX_RETRIES = 5
     BACKOFF_SCHEDULE = [5, 10, 20, 40, 80]
 
@@ -833,7 +882,7 @@ async def call_anthropic(model, messages, system, api_key, tools=None, images=No
                 break
     import anthropic
 
-    ANTHROPIC_TIMEOUT = 180.0  # seconds per attempt (Claude can take >60s for complex prompts)
+    ANTHROPIC_TIMEOUT = LLM_REQUEST_TIMEOUT  # seconds per attempt (Claude can take >60s for complex prompts)
     MAX_RETRIES = 5
 
     # --- Input validation to prevent 400 errors ---
@@ -1079,7 +1128,7 @@ async def call_gemini(model, messages, system, api_key, tools=None, images=None,
     from google import genai
     from google.genai import types
 
-    GEMINI_TIMEOUT = 180.0   # seconds per attempt
+    GEMINI_TIMEOUT = LLM_REQUEST_TIMEOUT   # seconds per attempt
     MAX_RETRIES = 5
 
     if _gemini_client is None:
@@ -1169,7 +1218,7 @@ async def call_grok(model, messages, system, api_key, tools=None, images=None, p
     Returns:
         (response_text, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens)
     """
-    GROK_TIMEOUT = 180.0
+    GROK_TIMEOUT = LLM_REQUEST_TIMEOUT
     MAX_RETRIES = 5
     BACKOFF_SCHEDULE = [5, 10, 20, 40, 80]
 
@@ -1265,7 +1314,7 @@ async def call_deepseek(model, messages, system, api_key, tools=None, images=Non
     # DeepSeek does not support vision — drop images with a warning
     if images:
         print(f"DEBUG: ⚠️ DeepSeek does not support images. {len(images)} image(s) will be dropped.", flush=True)
-    DEEPSEEK_TIMEOUT = 180.0
+    DEEPSEEK_TIMEOUT = LLM_REQUEST_TIMEOUT
     MAX_RETRIES = 5
     BACKOFF_SCHEDULE = [5, 10, 20, 40, 80]
 
@@ -1371,7 +1420,7 @@ async def call_v1_compatible(model, messages, system, base_url, api_key, tools=N
     if not base_url or not base_url.strip():
         raise LLMError("V1-compatible provider: base URL is not configured.")
 
-    V1_TIMEOUT = 180.0
+    V1_TIMEOUT = LLM_REQUEST_TIMEOUT
     MAX_RETRIES = 5
     BACKOFF_SCHEDULE = [5, 10, 20, 40, 80]
 

package/backend/core/mcp_client.py

@@ -39,12 +39,12 @@ from mcp.client.stdio import stdio_client
 from mcp.client.streamable_http import streamable_http_client
 from mcp.shared.auth import OAuthClientInformationFull, OAuthClientMetadata, OAuthToken
 
-from core.config import DATA_DIR
+from core.config import DATA_DIR, MCP_SESSION_READ_TIMEOUT
 import core.mcp_oauth_state as oauth_state
 
 # ── Constants ──────────────────────────────────────────────────────────────────
 
-_SESSION_READ_TIMEOUT = timedelta(seconds=60)
+_SESSION_READ_TIMEOUT = timedelta(seconds=MCP_SESSION_READ_TIMEOUT)
 
 MCP_SERVERS_FILE = os.path.join(DATA_DIR, "mcp_servers.json")
 MCP_TOKENS_DIR   = os.path.join(DATA_DIR, "mcp_tokens")

package/backend/core/models_orchestration.py

@@ -6,6 +6,8 @@ from typing import Any
 from enum import Enum
 from pydantic import BaseModel
 
+from core.config import ORCH_GLOBAL_TIMEOUT_MIN, ORCH_HUMAN_TIMEOUT, ORCH_STEP_TIMEOUT
+
 
 class StepType(str, Enum):
     AGENT = "agent"
@@ -74,7 +76,7 @@ class StepConfig(BaseModel):
     human_prompt: str | None = None
     human_fields: list[dict[str, str]] = []  # [{name, type, label}]
     human_channel_id: str | None = None      # messaging channel to notify (optional)
-    human_timeout_seconds: int = 3600        # how long to wait for messaging response
+    human_timeout_seconds: int = int(ORCH_HUMAN_TIMEOUT)  # how long to wait for messaging response
 
     # I/O mapping
     input_keys: list[str] = []    # Keys to pull from shared state as context
@@ -85,7 +87,7 @@ class StepConfig(BaseModel):
 
     # Per-step guardrails
     max_turns: int = 15
-    timeout_seconds: int = 300
+    timeout_seconds: int = int(ORCH_STEP_TIMEOUT)
     allowed_tools: list[str] | None = None  # Override agent's tools (narrows only)
 
     # Response cache (skipped for AGENT steps — state-dependent behaviour)
@@ -126,7 +128,7 @@ class Orchestration(BaseModel):
     # Global guardrails
     max_total_turns: int = 100
     max_total_cost_usd: float | None = None
-    timeout_minutes: int = 30
+    timeout_minutes: int = ORCH_GLOBAL_TIMEOUT_MIN
 
     trigger: str = "manual"  # "manual" | "scheduled"
     created_at: str | None = None

package/backend/core/openapi_import.py

@@ -0,0 +1,207 @@
+"""
+Convert an OpenAPI 3.x / Swagger 2.0 spec into Synapse custom-tool dicts.
+
+Each spec operation (path + HTTP method) becomes one HTTP custom tool that plugs
+directly into the existing executor in react_engine.py:
+  - path parameters stay as ``{param}`` placeholders in the URL — the executor
+    substitutes them from the call arguments;
+  - query parameters and the JSON request body are described in ``inputSchema`` so
+    the LLM supplies them (the executor routes them to query params for GET/DELETE
+    or to the JSON body for POST/PUT).
+
+Header parameters are intentionally NOT surfaced as arguments: the executor cannot
+route an argument into a request header, so exposing them would mis-send them as
+query/body fields. Supply auth or other static headers via the ``headers`` argument
+(e.g. an ``Authorization`` header entered once at import time).
+"""
+import re
+from typing import Any
+
+_HTTP_METHODS = ("get", "post", "put", "patch", "delete", "head", "options")
+
+
+def _sanitize_name(raw: str) -> str:
+    """Reduce an operationId / path to a snake_case tool name (alnum + underscore)."""
+    s = re.sub(r"[^0-9a-zA-Z]+", "_", raw or "").strip("_").lower()
+    if not s:
+        s = "tool"
+    if s[0].isdigit():
+        s = f"op_{s}"
+    return s
+
+
+def _resolve_ref(spec: dict, node: Any, _seen: frozenset | None = None) -> Any:
+    """Recursively resolve local ``$ref`` pointers (``#/...``) within a schema node.
+
+    External refs (URLs / file paths) can't be resolved from the spec alone, so
+    they collapse to ``{}``. A cycle guard prevents infinite recursion on
+    self-referential schemas.
+    """
+    if _seen is None:
+        _seen = frozenset()
+    if isinstance(node, dict):
+        ref = node.get("$ref")
+        if isinstance(ref, str):
+            if not ref.startswith("#/") or ref in _seen:
+                return {}
+            target: Any = spec
+            for part in ref[2:].split("/"):
+                part = part.replace("~1", "/").replace("~0", "~")
+                if isinstance(target, dict) and part in target:
+                    target = target[part]
+                else:
+                    return {}
+            return _resolve_ref(spec, target, _seen | {ref})
+        return {k: _resolve_ref(spec, v, _seen) for k, v in node.items()}
+    if isinstance(node, list):
+        return [_resolve_ref(spec, v, _seen) for v in node]
+    return node
+
+
+def _base_url_from_spec(spec: dict, override: str | None) -> str:
+    """Resolve the server base URL: explicit override → OpenAPI 3.x → Swagger 2.0."""
+    if override:
+        return override.rstrip("/")
+    servers = spec.get("servers")
+    if isinstance(servers, list) and servers:
+        url = (servers[0] or {}).get("url", "")
+        if url:
+            return url.rstrip("/")
+    host = spec.get("host")  # Swagger 2.0
+    if host:
+        schemes = spec.get("schemes") or ["https"]
+        scheme = schemes[0] if schemes else "https"
+        base_path = spec.get("basePath", "") or ""
+        return f"{scheme}://{host}{base_path}".rstrip("/")
+    return ""
+
+
+def _param_schema(spec: dict, param: dict) -> dict:
+    """Extract the JSON-Schema for a single parameter (3.x ``schema`` or 2.0 inline)."""
+    if "schema" in param:
+        sch = _resolve_ref(spec, param["schema"])
+    else:  # Swagger 2.0 puts type fields directly on the parameter
+        sch = {k: param[k] for k in ("type", "format", "items", "enum", "default")
+               if k in param}
+    if not isinstance(sch, dict) or not sch:
+        sch = {"type": "string"}
+    if param.get("description") and "description" not in sch:
+        sch = {**sch, "description": param["description"]}
+    return sch
+
+
+def _build_input_schema(spec: dict, shared_params: list, op: dict) -> dict:
+    """Build a JSON-Schema object from an operation's path/query params + body."""
+    props: dict = {}
+    required: list = []
+    params = [_resolve_ref(spec, p) for p in (list(shared_params) + list(op.get("parameters", [])))]
+
+    for p in params:
+        if not isinstance(p, dict):
+            continue
+        loc = p.get("in")
+        name = p.get("name")
+        if loc not in ("path", "query") or not name:
+            continue  # header/cookie params can't be routed by the executor — skip
+        props[name] = _param_schema(spec, p)
+        if (p.get("required") or loc == "path") and name not in required:
+            required.append(name)
+
+    # Request body: OpenAPI 3.x (requestBody.content) then Swagger 2.0 (in: body).
+    def _merge_body(body_schema: dict, body_required: bool):
+        body_schema = _resolve_ref(spec, body_schema)
+        if not isinstance(body_schema, dict) or not body_schema:
+            return
+        if "properties" in body_schema:
+            for k, v in (body_schema.get("properties") or {}).items():
+                props[k] = v
+            for r in body_schema.get("required", []) or []:
+                if r not in required:
+                    required.append(r)
+        else:  # non-object body (array/scalar) — expose under a single 'body' field
+            props["body"] = body_schema
+            if body_required and "body" not in required:
+                required.append("body")
+
+    request_body = _resolve_ref(spec, op.get("requestBody", {})) if op.get("requestBody") else {}
+    if request_body:
+        content = request_body.get("content", {}) or {}
+        media = content.get("application/json") or (next(iter(content.values()), {}) if content else {})
+        _merge_body(media.get("schema", {}), bool(request_body.get("required")))
+
+    for p in params:  # Swagger 2.0 body parameter
+        if isinstance(p, dict) and p.get("in") == "body":
+            _merge_body(p.get("schema", {}), bool(p.get("required")))
+
+    schema: dict = {"type": "object", "properties": props}
+    if required:
+        schema["required"] = required
+    return schema
+
+
+def parse_openapi_spec(
+    spec: dict,
+    *,
+    base_url: str | None = None,
+    headers: dict | None = None,
+    name_prefix: str = "",
+) -> list[dict]:
+    """Convert an OpenAPI 3.x / Swagger 2.0 spec into a list of custom-tool dicts.
+
+    Args:
+        spec: the parsed spec (a dict, from JSON or YAML).
+        base_url: override for the server base URL (wins over ``servers``/``host``).
+        headers: static headers applied to every generated tool (e.g. auth).
+        name_prefix: prepended (sanitized) to every generated tool name.
+
+    Returns tool dicts in the same shape stored by ``POST /api/tools/custom``.
+    Raises ``ValueError`` if the document has no usable operations.
+    """
+    if not isinstance(spec, dict):
+        raise ValueError("Spec must be a JSON/YAML object.")
+    paths = spec.get("paths")
+    if not isinstance(paths, dict) or not paths:
+        raise ValueError("Spec has no 'paths' — not a valid OpenAPI/Swagger document.")
+
+    base = _base_url_from_spec(spec, base_url)
+    headers = dict(headers or {})
+    prefix = f"{_sanitize_name(name_prefix)}_" if name_prefix else ""
+
+    tools: list[dict] = []
+    used_names: set = set()
+
+    for path, path_item in paths.items():
+        if isinstance(path_item, dict) and "$ref" in path_item:
+            path_item = _resolve_ref(spec, path_item)
+        if not isinstance(path_item, dict):
+            continue
+        shared_params = path_item.get("parameters", []) or []
+
+        for method, op in path_item.items():
+            if method.lower() not in _HTTP_METHODS or not isinstance(op, dict):
+                continue
+
+            op_id = op.get("operationId")
+            name = prefix + _sanitize_name(op_id if op_id else f"{method}_{path}")
+            base_name, i = name, 2
+            while name in used_names:
+                name, i = f"{base_name}_{i}", i + 1
+            used_names.add(name)
+
+            summary = (op.get("summary") or "").strip()
+            description = (summary or op.get("description") or "").strip() or f"{method.upper()} {path}"
+
+            tools.append({
+                "name": name,
+                "generalName": (summary or name)[:80],
+                "description": description,
+                "tool_type": "http",
+                "method": method.upper(),
+                "url": f"{base}{path}",
+                "headers": dict(headers),
+                "inputSchema": _build_input_schema(spec, shared_params, op),
+            })
+
+    if not tools:
+        raise ValueError("No operations found in the spec.")
+    return tools

package/backend/core/orchestration/engine.py

@@ -8,6 +8,7 @@ from typing import AsyncGenerator, Awaitable, Callable
 
 import anyio
 
+from core.config import ORCH_GLOBAL_TIMEOUT_MIN, ORCH_STEP_TIMEOUT
 from core.models_orchestration import Orchestration, OrchestrationRun, StepConfig, StepType
 from .state import SharedState
 from .steps import STEP_EXECUTORS
@@ -100,7 +101,7 @@ class OrchestrationEngine:
         total_turns = len(run.step_history)
         logger = getattr(self, "logger", None)
         loop_start_time = time.time()
-        timeout_seconds = (self.orch.timeout_minutes or 30) * 60
+        timeout_seconds = (self.orch.timeout_minutes or ORCH_GLOBAL_TIMEOUT_MIN) * 60
 
         while run.current_step_id and run.status == "running":
             # Checkpoint between steps — ensures MCP background tasks
@@ -154,7 +155,7 @@ class OrchestrationEngine:
                 break
 
             step_start_time = time.time()
-            step_timeout = step.timeout_seconds or 300  # default 5 min
+            step_timeout = step.timeout_seconds or ORCH_STEP_TIMEOUT  # default 5 min
 
             # Build and store TransitionContext so executors can access it
             from .context import build_transition_context

package/backend/core/orchestration/steps.py

@@ -14,6 +14,7 @@ from typing import AsyncGenerator, TYPE_CHECKING
 
 import anyio
 
+from core.config import HTTP_TOOL_TIMEOUT, MCP_TOOL_CALL_TIMEOUT, ORCH_STEP_TIMEOUT
 from core.models_orchestration import StepConfig, StepType, OrchestrationRun
 
 if TYPE_CHECKING:
@@ -451,7 +452,7 @@ class ToolStepExecutor:
             session = server_module.agent_sessions.get(agent_name)
             if session:
                 result = await session.call_tool(
-                    actual_tool_name, tool_args, read_timeout_seconds=timedelta(seconds=30)
+                    actual_tool_name, tool_args, read_timeout_seconds=timedelta(seconds=MCP_TOOL_CALL_TIMEOUT)
                 )
                 return result.content[0].text if result.content else ""
         # Custom tools — Python or HTTP
@@ -597,10 +598,10 @@ class ToolStepExecutor:
                 remaining_args = {k: v for k, v in tool_args.items() if k not in consumed_keys}
                 params = {k: (json.dumps(v) if isinstance(v, (dict, list)) else str(v))
                           for k, v in remaining_args.items()}
-                resp = await client.request(method, url, params=params, headers=headers, timeout=30.0)
+                resp = await client.request(method, url, params=params, headers=headers, timeout=HTTP_TOOL_TIMEOUT)
             else:
                 # POST / PUT – all args in body even if some were used in the URL
-                resp = await client.request(method, url, json=tool_args, headers=headers, timeout=30.0)
+                resp = await client.request(method, url, json=tool_args, headers=headers, timeout=HTTP_TOOL_TIMEOUT)
 
         try:
             return json.dumps(resp.json())
@@ -827,7 +828,7 @@ class ParallelStepExecutor:
                     continue
 
                 step_start = time.time()
-                sub_timeout = sub_step.timeout_seconds or 300
+                sub_timeout = sub_step.timeout_seconds or ORCH_STEP_TIMEOUT
                 print(f"DEBUG PARALLEL:   ▶ sub-step '{sub_step.name}' ({sub_step.id}) timeout={sub_timeout}s", flush=True)
                 yield {"type": "step_start", "orch_step_id": sub_step.id,
                        "step_name": sub_step.name, "step_type": sub_step.type.value}
@@ -942,7 +943,7 @@ class LoopStepExecutor:
                     continue
 
                 step_start = time.time()
-                sub_timeout = sub_step.timeout_seconds or 300
+                sub_timeout = sub_step.timeout_seconds or ORCH_STEP_TIMEOUT
                 yield {"type": "step_start", "orch_step_id": sub_step.id,
                        "step_name": sub_step.name, "step_type": sub_step.type.value}
 

package/backend/core/react_engine.py

@@ -10,7 +10,7 @@ import time
 
 import httpx
 
-from core.config import load_settings
+from core.config import load_settings, HTTP_TOOL_TIMEOUT, MCP_TOOL_CALL_TIMEOUT
 from core.vault import maybe_vault, expand_vault_mentions
 from core.compaction import maybe_compact
 from core.session import (
@@ -1330,10 +1330,10 @@ async def run_agent_step(
                                 remaining_args = {k: v for k, v in tool_args.items() if k not in consumed_keys}
                                 params = {k: (json.dumps(v) if isinstance(v, (dict, list)) else str(v))
                                           for k, v in remaining_args.items()}
-                                resp = await client.request(method, url, params=params, headers=headers, timeout=30.0)
+                                resp = await client.request(method, url, params=params, headers=headers, timeout=HTTP_TOOL_TIMEOUT)
                             else:
                                 # POST / PUT – all args in body even if some were used in the URL
-                                resp = await client.request(method, url, json=tool_args, headers=headers, timeout=30.0)
+                                resp = await client.request(method, url, json=tool_args, headers=headers, timeout=HTTP_TOOL_TIMEOUT)
 
                             json_resp = None
                             try:
@@ -1416,7 +1416,7 @@ async def run_agent_step(
 
                     print(f"DEBUG MCP: ✓ ping OK [{round(time.time()-_mcp_t0,2)}s] — call_tool starting", flush=True)
 
-                    _timeout = timedelta(seconds=60)
+                    _timeout = timedelta(seconds=MCP_TOOL_CALL_TIMEOUT)
 
                     # Checkpoint again right before the actual call_tool —
                     # gives background transport tasks one more scheduling

package/backend/core/routes/tools.py

@@ -15,6 +15,7 @@ from pydantic import BaseModel
 from core.models import AddMCPServerRequest
 from core.config import DATA_DIR
 from core.json_store import JsonStore
+from core.openapi_import import parse_openapi_spec
 import core.mcp_oauth_state as oauth_state
 
 router = APIRouter()
@@ -105,17 +106,89 @@ async def get_available_tools():
     return {"tools": all_tools}
 
 
-@router.post("/api/tools/custom")
-async def create_custom_tool(tool: dict):
+def _upsert_custom_tools(new_tools: list[dict]) -> None:
+    """Upsert tools by name into the custom-tools store, preserving existing order."""
     tools = load_custom_tools()
-    if any(t['name'] == tool['name'] for t in tools):
-        tools = [t if t['name'] != tool['name'] else tool for t in tools]
-    else:
-        tools.append(tool)
+    for nt in new_tools:
+        if any(t['name'] == nt['name'] for t in tools):
+            tools = [t if t['name'] != nt['name'] else nt for t in tools]
+        else:
+            tools.append(nt)
     save_custom_tools(tools)
+
+
+@router.post("/api/tools/custom")
+async def create_custom_tool(tool: dict):
+    _upsert_custom_tools([tool])
     return {"status": "success", "tool": tool}
 
 
+@router.post("/api/tools/custom/bulk")
+async def create_custom_tools_bulk(payload: dict):
+    """Upsert many tools at once. Body: {"tools": [ {tool}, ... ]}."""
+    tools = payload.get("tools")
+    if not isinstance(tools, list) or not tools:
+        raise HTTPException(status_code=400, detail="Body must include a non-empty 'tools' list.")
+    for t in tools:
+        if not isinstance(t, dict) or not t.get("name"):
+            raise HTTPException(status_code=400, detail="Each tool must be an object with a 'name'.")
+    _upsert_custom_tools(tools)
+    return {"status": "success", "imported": len(tools)}
+
+
+class OpenAPIImportRequest(BaseModel):
+    spec: str                          # raw JSON or YAML text of the spec
+    base_url: Optional[str] = None     # override the server base URL
+    headers: Optional[dict] = None     # static headers applied to every tool (e.g. auth)
+    name_prefix: str = ""              # prepended to every generated tool name
+    save: bool = False                 # False → preview only; True → upsert all generated tools
+
+
+def _parse_spec_text(text: str) -> dict:
+    """Parse spec text as JSON, falling back to YAML (if PyYAML is available)."""
+    text = (text or "").strip()
+    if not text:
+        raise HTTPException(status_code=400, detail="Empty spec.")
+    try:
+        return json.loads(text)
+    except json.JSONDecodeError:
+        pass
+    try:
+        import yaml  # optional dependency; specs are often YAML
+    except ImportError:
+        raise HTTPException(
+            status_code=400,
+            detail="Spec is not valid JSON and PyYAML is not installed to parse YAML. Paste JSON instead.",
+        )
+    try:
+        data = yaml.safe_load(text)
+    except Exception as e:
+        raise HTTPException(status_code=400, detail=f"Could not parse spec as JSON or YAML: {e}")
+    if not isinstance(data, dict):
+        raise HTTPException(status_code=400, detail="Spec did not parse to an object.")
+    return data
+
+
+@router.post("/api/tools/import/openapi")
+async def import_openapi(req: OpenAPIImportRequest):
+    """Convert an OpenAPI 3.x / Swagger 2.0 spec into HTTP custom tools.
+
+    With save=False (default) returns the generated tools as a preview so the user
+    can pick a subset; with save=True upserts all of them.
+    """
+    spec = _parse_spec_text(req.spec)
+    try:
+        generated = parse_openapi_spec(
+            spec, base_url=req.base_url, headers=req.headers, name_prefix=req.name_prefix,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+    if req.save:
+        _upsert_custom_tools(generated)
+    return {"tools": generated, "count": len(generated), "saved": req.save}
+
+
 @router.delete("/api/tools/custom/{tool_name}")
 async def delete_custom_tool(tool_name: str):
     tools = load_custom_tools()