Skip to content

Email-ready release: restore reviews, honest health, reconnect and Email UI fixes - #424

Open
Maneek21 wants to merge 150 commits into
masterfrom
release/email-ready-20261104
Open

Maneek21 wants to merge 150 commits into
masterfrom
release/email-ready-20261104

Conversation

@Maneek21

@Maneek21 Maneek21 commented Nov 4, 2026 •

Copy link
Copy Markdown
Owner

Summary

This brings the Email follow-up work from Nov 2–4 into master, for the Email-ready release. It has four parts:

  1. Nov 2 integration (int/deft-20261102): restore-access review with an honest 403 next_step contract, record-mirror nominations, resumable background leases, the file transfer queue (8 MiB uploads, four slots per owner), Anthropic SDK 1.x, the react-grid-layout v2 migration, the Experience Worker source cap raised to 112 KiB, and reader and compose polish.
  2. Database restore (fix/db-restore-20261104): post-.131 migrations now apply on fresh installs and upgrades, the reviewed catalogs are pinned to the real digests, restore access goes through stored single-use reviews, and the non-unique restore-review foreign key is dropped.
  3. Health, reconnect and Email UI (fix/ui-host-20261104):
    • Background health is attached to the account catalog and scoped to the connection owner.
    • Apps can show connection_action buttons that start the Host's reconnect flow directly.
    • Fixes from six UI review rounds: compose width, reader subject wrapping on phones, wide tables, the folder overflow menu, RTL, rule editor rows, contrast, focus return and the Reply hint.
    • The experience icon set now uses Lucide geometry with a 1.5 stroke, and idle toolbar icons are muted.
  4. Review fixes (Nov 5–6), from a code review of this PR:
    • Restore access no longer offers consents that were never approved, or an action the current connection already holds. The new connection replaces the old one through migration .135, audit records use real grant ids, and freshness is checked inside the transaction.
    • Background health follows the current lease instead of the worst lease ever held, and the account list makes one grouped, bounded query.
    • A record-mirror approval that fails before confirm() can be retried. A failure during or after it is final, and raw error text never reaches users.
    • Reconnect checks the target first, puts it back if the connection fails, and re-establishes background access for an account that's still connected.
    • New cross-lane tests run these flows together through the real routes.

The four dependabot bumps (#418, #419, #421, #422) are already included here; those PRs can be closed after this merges.

Kit

This changes the public Kit contracts in packages/app-kit (experience-account, experience-core, experience-menu). The Kit version is now 0.1.0-alpha.43 and the worker cap rises from 96 to 112 KiB, so apps built for it need this Host or later. The Kit tarball is only produced from a Host tag, so Email can bump its pin once v0.3.0-preview.141 is tagged (see the Email PR).

Release order

  1. Merge this PR.
  2. Tag v0.3.0-preview.141, which publishes Kit alpha.43.
  3. Deploy the Host; schema head moves to 0.3.0-preview.135.
  4. Bump the Kit pin in Email and release it (the Email PR).
  5. Smoke-test on demo.deft.ing with a real Gmail account.

Testing

  • Web typecheck passes and the app boundary check reports 0 errors.
  • Experience, app-connection and restore-access-review suites: 643 pass and 1 fails. The failure (experience-record-form-disabled-mounted) is a timing test that also fails on the base branch.
  • New guard tests for the icon table and icon styling: 4 of 4 pass.
  • Database: 23 of 23 API restore tests pass on a freshly pushed full schema (121 versions at the time; 122 with .135).
  • Production build checked in a browser against a local fixture stack at 1440px and 390px, in light and dark: one accepted send per click, Compose survives polling, axe contrast violations 0, Compose opens in 0.83 s and Inbox in 1.84 s.
  • The items above were run before the review fixes were added. On the merged tree: boundary check 0 errors, Kit 239/239, shared 77/77, release workflow 32/32, docs 6/6, focused web 99/99, API suites for these changes 91/91 with none skipped, and upgrade-tail-db twice from a .131 clone.
  • The full API suite and versioned-upgrade are left to CI. The browser checks above haven't been repeated on the merged tree.

Known gaps

  • The sender on a sent message, the 34px Refresh jump and the 44×44 Retry target are covered by unit tests only.
  • Agent permission rows have no one-line explanation yet.
  • On phones a long subject makes the sticky reader toolbar about 150px tall.
  • A menu row whose action has no Kit icon name shows no icon.
  • Restored action consents are under review: the Host doesn't record a deliberate disconnect, so an action the owner revoked can be offered (never preselected). Its behaviour after Restore is still being tested, and this should be settled before merging.

🤖 Generated with Claude Code

dependabot Bot and others added 30 commits October 28, 2026 12:24
…update

Bumps the npm_and_yarn group with 1 update in the /examples/apps/email directory: [nodemailer](https://github.com/nodemailer/nodemailer).
Bumps the npm_and_yarn group with 1 update in the /examples/apps/email/fixtures/sdk9-consumer directory: [nodemailer](https://github.com/nodemailer/nodemailer).


Updates `nodemailer` from 10.0.10 to 10.1.4
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.0.10...v10.1.4)

Updates `nodemailer` from 10.0.10 to 10.1.4
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.0.10...v10.1.4)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 10.1.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 10.1.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) from 0.128.0 to 1.3.0.
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.128.0...sdk-v1.3.0)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [react-grid-layout](https://github.com/STRML/react-grid-layout) and [@types/react-grid-layout](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-grid-layout). These dependencies needed to be updated together.

Updates `react-grid-layout` from 1.5.4 to 2.3.0
- [Release notes](https://github.com/STRML/react-grid-layout/releases)
- [Changelog](https://github.com/react-grid-layout/react-grid-layout/blob/master/CHANGELOG.md)
- [Commits](react-grid-layout/react-grid-layout@1.5.4...2.3.0)

Updates `@types/react-grid-layout` from 1.3.6 to 2.1.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-grid-layout)

---
updated-dependencies:
- dependency-name: "@types/react-grid-layout"
  dependency-version: 2.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
- dependency-name: react-grid-layout
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…8 updates

Bumps the patch-and-minor group with 38 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [playwright](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.1` | `2.1.5` |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.4` | `18.0.9` |
| [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.3` | `0.45.4` |
| [hono](https://github.com/honojs/hono) | `4.13.11` | `4.13.14` |
| [node-ical](https://github.com/jens-maus/node-ical) | `0.27.2` | `0.27.3` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.23.0` | `8.23.1` |
| [read-excel-file](https://gitlab.com/catamphetamine/read-excel-file) | `9.3.10` | `9.3.12` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.3` | `26.6.5` |
| [@tiptap/core](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/core) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-code-block-lowlight](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-code-block-lowlight) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-details](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-details) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-document](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-document) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-highlight](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-highlight) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-image](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-image) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-link](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-link) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-paragraph](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-paragraph) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-placeholder](https://github.com/ueberdosis/tiptap/tree/HEAD/packages-deprecated/extension-placeholder) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-table](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-table-cell](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-cell) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-table-header](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-header) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-table-row](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-row) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-task-item](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-task-item) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-task-list](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-task-list) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-text](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-text) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-underline](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-underline) | `3.31.3` | `3.32.0` |
| [@tiptap/pm](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/pm) | `3.31.3` | `3.32.0` |
| [@tiptap/react](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/react) | `3.31.3` | `3.32.0` |
| [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) | `3.31.3` | `3.32.0` |
| [@tiptap/suggestion](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/suggestion) | `3.31.3` | `3.32.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.48.0` | `1.61.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.28` | `8.5.31` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@types/d3-zoom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/d3-zoom) | `3.0.8` | `3.0.9` |
| [eslint](https://github.com/eslint/eslint) | `10.11.0` | `10.13.0` |
| [@neondatabase/serverless](https://github.com/neondatabase/serverless) | `1.1.0` | `1.2.0` |
| [@modelcontextprotocol/client](https://github.com/modelcontextprotocol/typescript-sdk) | `2.3.0` | `2.4.0` |



Updates `playwright` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `@hono/node-server` from 2.1.1 to 2.1.5
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.1...v2.1.5)

Updates `dotenv` from 18.0.4 to 18.0.9
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.4...v18.0.9)

Updates `drizzle-orm` from 0.45.3 to 0.45.4
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases)
- [Commits](drizzle-team/drizzle-orm@0.45.3...0.45.4)

Updates `hono` from 4.13.11 to 4.13.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.11...v4.13.14)

Updates `node-ical` from 0.27.2 to 0.27.3
- [Release notes](https://github.com/jens-maus/node-ical/releases)
- [Commits](jens-maus/node-ical@0.27.2...0.27.3)

Updates `pg` from 8.23.0 to 8.23.1
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg)

Updates `read-excel-file` from 9.3.10 to 9.3.12
- [Changelog](https://gitlab.com/catamphetamine/read-excel-file/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/catamphetamine/read-excel-file/compare/v9.3.10...v9.3.12)

Updates `@types/node` from 26.6.3 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@tiptap/core` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/core/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/core)

Updates `@tiptap/extension-code-block-lowlight` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-code-block-lowlight/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-code-block-lowlight)

Updates `@tiptap/extension-details` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-details/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-details)

Updates `@tiptap/extension-document` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-document/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-document)

Updates `@tiptap/extension-highlight` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-highlight/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-highlight)

Updates `@tiptap/extension-image` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-image/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-image)

Updates `@tiptap/extension-link` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-link/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-link)

Updates `@tiptap/extension-paragraph` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-paragraph/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-paragraph)

Updates `@tiptap/extension-placeholder` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages-deprecated/extension-placeholder/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages-deprecated/extension-placeholder)

Updates `@tiptap/extension-table` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-table/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-table)

Updates `@tiptap/extension-table-cell` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-table-cell)

Updates `@tiptap/extension-table-header` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-table-header)

Updates `@tiptap/extension-table-row` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-table-row)

Updates `@tiptap/extension-task-item` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-task-item)

Updates `@tiptap/extension-task-list` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-task-list)

Updates `@tiptap/extension-text` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-text/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-text)

Updates `@tiptap/extension-underline` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-underline/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-underline)

Updates `@tiptap/pm` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/pm/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/pm)

Updates `@tiptap/react` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/react/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/react)

Updates `@tiptap/starter-kit` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/starter-kit/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/starter-kit)

Updates `@tiptap/suggestion` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/suggestion/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/suggestion)

Updates `lucide-react` from 1.48.0 to 1.61.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/lucide-react)

Updates `postcss` from 8.5.28 to 8.5.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.28...8.5.31)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@types/d3-zoom` from 3.0.8 to 3.0.9
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/d3-zoom)

Updates `eslint` from 10.11.0 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.11.0...v10.13.0)

Updates `@neondatabase/serverless` from 1.1.0 to 1.2.0
- [Changelog](https://github.com/neondatabase/serverless/blob/main/CHANGELOG.md)
- [Commits](neondatabase/serverless@v1.1.0...v1.2.0)

Updates `@modelcontextprotocol/client` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.3.0...@modelcontextprotocol/client@2.4.0)

---
updated-dependencies:
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: dotenv
  dependency-version: 18.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: drizzle-orm
  dependency-version: 0.45.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: hono
  dependency-version: 4.13.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: node-ical
  dependency-version: 0.27.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: pg
  dependency-version: 8.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: read-excel-file
  dependency-version: 9.3.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/core"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-code-block-lowlight"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-details"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-document"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-highlight"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-image"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-link"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-paragraph"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-placeholder"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-table"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-table-cell"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-table-header"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-table-row"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-task-item"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-task-list"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-text"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-underline"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/pm"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/react"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/starter-kit"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/suggestion"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: lucide-react
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: postcss
  dependency-version: 8.5.31
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: "@types/d3-zoom"
  dependency-version: 3.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@neondatabase/serverless"
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@modelcontextprotocol/client"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Top-level channel mentions replace conversation history with the room pack, so durable module results from approved actions were dropped for public and private channels (threads and group DMs already worked). Carry bounded result sources out of the pack and re-check Module authority through the existing approvedResultHistory path before any identifier reaches the model.

Adds a handler-level DB test proving the authorized record id survives the room-pack path for public and private channels and disappears when module access is revoked.
…e Done summary

Dashboard day buckets were computed from the server's local calendar day, so a viewer whose timezone differed from the server saw tasks in the wrong due-today / overdue / due-this-week buckets. Resolve the viewer timezone (?tz= validated, then users.timezone, then org tz, then UTC) and compute boundaries with getDayBoundaries; the web dashboard now sends the browser/profile tz.

The approval-confirmation flow appends a Done summary to the proposal message while also posting the same summary as a separate confirmation message, so approving the last card rendered the Done text twice. Strip the stale approval prompt from the proposal without repeating the outcome; the confirmation message remains the single canonical summary.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nned

CI installs examples/apps/email with --frozen-lockfile, so the nodemailer
10.1.4 manifest bump left the lockfile stale and the install failed.

Regenerate examples/apps/email/pnpm-lock.yaml for nodemailer 10.1.4 and
restore the sealed sdk9 historical consumer package.json to 10.0.10. That
fixture is byte-for-byte evidence recorded in SEALED-HISTORICAL-CONSUMER.json
(sha256 b0545b1...), not a supported consumer, so it must not drift.
formatDeftyApprovalReply returned null for module_record_update/create/etc,
so two CRM actions in one Defty message fell back to a generic summary that
triggered the 'could not create a valid approval card' clarification. Add
module-aware rendering so each proposal family gets a readable combined card
while keeping all permission/tenant/grounding checks intact.

- formatModuleActionChange helper for create/update/archive/task-link
- truncateChangeValue to avoid double punctuation and long values
- Tests: normalize/validate/render two CRM actions; mocked compiler draft

Refs W1-crm
react-grid-layout 2.x replaces the flat v1 props with composable configs and
redefines Layout as a readonly LayoutItem[]. Without migration the read-only
dashboard would have silently become draggable and resizable because v2 enables
both by default.

- Type layout items as LayoutItem[] and layout arrays as Layout.
- Map edit mode onto dragConfig/resizeConfig (helper is unit-tested).
- Keep vertical compaction explicit with verticalCompactor.
- Drop @types/react-grid-layout: 2.1.0 is a deprecated empty stub and its
  presence masked the component props from the type checker.
…urvive

The first attempt only fixed the approval summary renderer, which never
empties the action list. The real drop is that module writes reaching the
runner path carry the model's raw input with no stable idempotency_key, and
validateRegisteredProposalAction rejects every module write without one. The
compiler already derives a deterministic key via buildActionGraph; give the
runner path the same contract by backfilling a stable key before validation.

Also soften buildWriteIntentClarification so a still-empty proposal list asks
the user to retry or split changes instead of blaming the request.

Refs W1-crm2
…fallback copy

The runner path backfill (2222329) is correct, but its fallback copy told
users to "ask for each change separately", which is now wrong: two CRM writes
in one message persist as two approval cards. Restore the neutral original
message and sharpen the docstring/inline comment to name the true drop point
(the runner passing raw module input that fails the required idempotency_key
check in validateRegisteredProposalAction). Add a focused unit test for
ensureModuleWriteIdempotencyKeys (distinct stable keys, never overwrite an
existing key, non-module actions untouched).

Refs W1-crm2
…pping attachment chips

Compose opening (audit #3): drop the 'Checking browser recovery…' notice
flash while the recovery scope and opening proof run, render a structured
compose skeleton (aria-busy, four .skeleton rows) alongside the opening
status, and gate the Browser draft recovery banner so an in-flight check
never flashes above the form. Unconfirmed candidates, submissions and
genuinely failed checks still surface with their actions.

Mobile and a11y (audit #7, #9): hide the desktop width toggle below the
sm breakpoint and reserve its gutter only from sm up, left-align the
identity pill against the optional-field toggles above a ghost divider,
close the identity popover on Escape and outside pointerdown, and unify
the Review primary button on the primary-container token.

Attachment chips (audit #5): compose file rows wrap below sm with a
140px minimum filename block, and original-attachment rows style their
Include/Omit/Check status actions as Deft pills via parent selectors
while keeping the exact button markup.

Tests: mounted skeleton without recovery jargon, recovery banner gating
(candidate/submission/failure still surface), Escape and outside-click
identity dismissal, responsive chip classes, and the sm-breakpoint
surface. Repairs the stale recipient-presentation VM fixture (real
recordForm* helpers and structured-address parser) whose whole-file
computed-import digest is refreshed in the app-boundary allowlist; the
loader expression and every pinned component line are unchanged.
Use Obsidian design tokens across the shared experience renderer, wrap reader headings to two lines on phones, and show a shimmer skeleton while a document loads. Ring-frame HTML documents without shifting authored widths. Auto-open listed attachments as responsive chips, announce status/progress text, label icon buttons, and submit search on Enter.
SDK 1.0 added a system variant to MessageParam whose array content is
text-only. normalizeAgentToolHistory spread the filtered block array back
over the union, so tsc rejected the system arm and the API typecheck
failed after the bump. Tool-ordering repair only applies to
user/assistant turns, so pass system messages through unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…icy toggle defaults

Adds the app-neutral prepare_record_mirror inner operation to the Kit
schema (effect in review mode, requires action_key and a required
record_id pin), accepts it in the integration-tool inner/callback
fences, and classifies it as a write effect for installed-tool
discovery. Renders agent runtime-action policies as a single toggle
list and defaults a fresh Defty delegation to read-only.
…se 2)

Add a single app-neutral restore-access review (context/review/activate) that
re-issues every prior grant of a reconnected account at its original lifetime,
never widened, in one transaction with soft-transitioned old rows and audit
lineage. Enum-typed details.next_step (restore_access|reconnect|review_consent)
is emitted on lapsed/reauth 403s and parsed/rendered by the web layer instead
of the bare 'Outcome uncertain' dead-end.

Implements design-p2-host.md §2-§5 incl. same-account gate, subset activation,
lapsed-vs-broken defaults, audit link, and the app-neutral grant-kind registry.
…efaults

- AppRecordMirrorService.nominate lets a Defty/personal-MCP caller nominate
  a saved record for a declared record-mirror policy; it validates the agent
  principal and owner/tenant isolation and lands a pending agent_actions card,
  issuing no receipt until the human approves through the unchanged
  review()/confirm() authority.
- seedExperienceAgentPolicyDefaults seeds require_approval for nominated
  runtime actions (deny stays implicit), never overwriting a prior choice.
- seedDefaultDeftyIntegrationGrant seeds a read-only Defty delegation during
  the restore-access review; draft/send stay explicit opt-ins.
…urrent integration session

- C1: memoise the parsed deployment registry per HTTP request via an
  AsyncLocalStorage scope (still lstat-validated on every lookup so a
  replaced/removed/oversized file revokes on the very next call); hoist the
  per-entry transport digest into a constructor map.
- C3: select the single highest-revision current integration session and deny
  on tie/stale-fallthrough instead of re-running full authority per candidate.
- 2.5: DEFT_APP_DATA_TIMING=authority emits a content-free app_data_timing
  event for every authority operation and adds the new phase names.
- Add no-DB unit tests for registry-scope memoisation and revocation parity,
  plus framework-free authority-latency / statement-count harness scripts.
…y policy over on restore

Phase 3 (Host): make the app-integration-knowledge retry loop terminal when an
account grant ends, expose capture health to the app, and carry the capture
policy over to the reconnected account inside the restore-access review.

- Add retired_at/retired_reason/last_error to app_integration_capture_policies
  (migration 0.3.0-preview.132) and retire a policy on APP_ACCESS_DENIED with a
  system notification instead of retrying 5x/min forever.
- Widen capture settings() with a health object and add a POST
  /api/app-integrations/knowledge/health probe that reports grant_ended without
  a hard 403.
- Enumerate capture_policy grants in the restore review and re-enable the
  retired policy in place on activate (fresh revision + scheduled job).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reply/New compose opening issued 6 target resolves and 4 runtime invocations
before the form appeared. The opening reads (locator reserve, seed hydration,
record read) now share one in-flight target nomination for at most 5 s, and
resolveSeed's before/after-reserve phases revalidate that nomination locally
instead of buying two more Host admissions. load() also passes its target to
the seed metadata invoke and returns openingRecovery so the form never needs
the fallback recovery-scope resolve.

The cached value is a nomination, not an authority decision: every dispatch
still goes to the Host route and the Runtime still verifies current authority,
the confirm phase keeps the existing fresh proof before any save, and the
window is cleared by every mutating port and by check()/current() failures.
Recovery scope and snapshot remain fresh by design.

Reply open: 1 resolve and 2 parallel invocations (was 6/4). New compose with
a signature default: 1 resolve and 3 invocations. Synthetic-latency harness:
1932-1946 ms (< 2200 ms).
…er issued

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ness out of the repo

The highest-revision shortcut compared revision counters across different
connection sessions. Revisions are per session and restart at 0, so after a
reconnect a superseded session could win and current access would be denied.
The perf harness used computed imports the app boundary check rejects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replace the Accounts/Access/Approvals split with one Account Card that surfaces connection health, private access, inline agent-request permissions and background jobs. Un-bury connection diagnostics, summarize record-store consent, and keep long account labels wrapping at phone width.
…stead of instant 503

Raise the data-plane binary IO budget (files 4/owner 8 global, images
6/owner 12 global) and replace the instant 503 on overflow with a bounded
FIFO wait (2 s) that drains on release. Re-entrancy and the slot-held-until-
unwind guarantee are unchanged.
…ized content-length with 413

Match the advertised 8 MiB body and a 30 s transfer window, widen upload
slots to 4/owner and 16 global, and answer 413 APP_ACTION_INVALID before
reading any body byte when the declared content-length exceeds the limit.
Maneek21 and others added 30 commits November 5, 2026 11:31
…l (round 3)

- Add permanent test: unexpected error during review never leaks raw
  message into returned message or agent_actions.error.
- Add permanent test: confirm-phase failure is terminal (expired) with
  app-neutral message; second Approve does not re-invoke confirm().
- Replace console.error full-error logging with bounded name/code/action-id.
…, extract connection-action decision logic with behavioural tests
…und 4)

- Wrap the whole ELSE branch in IS TRUE so a NULL-valued body (e.g.
  callback_state_hash JSON null) is rejected, matching the production
  constraint. Only the added restore clause differs inside.
- Allow the restore marker in the credential_repair validator/branch so a
  restore on a repaired connection succeeds.
- Update upgrade-tail-db.test.ts resetToHead to revert .135.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…122 migrations

- Re-review FP-012..014 against run 42174633201: the three frame sinks are
  unchanged and moved 14 lines; only Host connection-action handling changed.
- List app-424-crosslane-db.test.ts as a custom keyring writer.
- preview.135 takes the seeded test ledger from 121 to 122.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant