[github-actions]

Cherry-pick to main

This PR cherry-picks stack #1121, merged to release/1.11.x: one commit per PR, bottom to top.

Pull requests

• fix(adapters,plugins,edge): an older saas bundle, pulled or pushed, doesn't roll the server back #1119 fix(adapters,plugins,edge): an older saas bundle, pulled or pushed, doesn't roll the server back (@frontegg-david)
• fix(sdk,plugins): an @App's Skilled OpenAPI credential resolver reaches execute_action and this.callTool() of an operation #1120 fix(sdk,plugins): an @app's Skilled OpenAPI credential resolver reaches execute_action and this.callTool() of an operation (@frontegg-david)
• fix(adapters,plugins,edge): a push token replayed to another replica or Worker isolate is refused #1122 fix(adapters,plugins,edge): a push token replayed to another replica or Worker isolate is refused (@frontegg-david)
• fix(plugins): a skill a skills:filter hook hides can't be run by naming its actions #1123 fix(plugins): a skill a skills:filter hook hides can't be run by naming its actions (@frontegg-david)
• fix(sdk): a plugin listed twice in one plugins list is refused at startup instead of keeping only its last entry #1127 fix(sdk): a plugin listed twice in one plugins list is refused at startup instead of keeping only its last entry (@frontegg-david)
• fix(plugins,edge): a Cron run that doesn't apply its bundle fails, and /readyz says the bundle served is stale #1128 fix(plugins,edge): a Cron run that doesn't apply its bundle fails, and /readyz says the bundle served is stale (@frontegg-david)
• fix(sdk): connect() with an authToken connects an anonymous caller again on a server without auth #1129 fix(sdk): connect() with an authToken connects an anonymous caller again on a server without auth (@frontegg-david)
• fix(auth,adapters,plugins,edge): operators can tell why a pull or push token was refused, while callers still get the generic answer #1130 fix(auth,adapters,plugins,edge): operators can tell why a pull or push token was refused, while callers still get the generic answer (@frontegg-david)
• fix(sdk,auth,plugins): this.authProviders works: the SDK wires the AuthProviders vault from a new authProvidersVault option #1131 fix(sdk,auth,plugins): this.authProviders works: the SDK wires the AuthProviders vault from a new authProvidersVault option (@frontegg-david)
• fix(sdk,auth): /oauth/connect connects a verified caller who has no vault yet, and asks an anonymous one to sign in #1132 fix(sdk,auth): /oauth/connect connects a verified caller who has no vault yet, and asks an anonymous one to sign in (@frontegg-david)
• fix(sdk,plugins): the SDK skill surfaces say a plugin's skills haven't loaded yet, retryable, and carry bundleVersion #1133 fix(sdk,plugins): the SDK skill surfaces say a plugin's skills haven't loaded yet, retryable, and carry bundleVersion (@frontegg-david)
• fix(sdk,auth,cli,plugins): the credentials-required error keeps its connect link out of the message, and asks through URL elicitation where the client supports it #1134 fix(sdk,auth,cli,plugins): the credentials-required error keeps its connect link out of the message, and asks through URL elicitation where the client supports it (@frontegg-david)
• fix(sdk): a health check registered after startup runs in /readyz, and registerHealthProbe returns a remover #1135 fix(sdk): a health check registered after startup runs in /readyz, and registerHealthProbe returns a remover (@frontegg-david)
• fix(sdk,plugins): a bundle swap sends one list_changed per list it changed, not one per entry #1136 fix(sdk,plugins): a bundle swap sends one list_changed per list it changed, not one per entry (@frontegg-david)
• fix(adapters,plugins,edge): a restarted server serves its cached bundle in place of an older or refused pull, and doesn't write it back #1137 fix(adapters,plugins,edge): a restarted server serves its cached bundle in place of an older or refused pull, and doesn't write it back (@frontegg-david)
• fix(sdk,adapters,plugins,edge): a push token with a body_sha256 claim can't carry another bundle #1138 fix(sdk,adapters,plugins,edge): a push token with a body_sha256 claim can't carry another bundle (@frontegg-david)
• fix(plugins,edge): managed mode takes confirm, and the audit log says whether the user confirmed a call #1139 fix(plugins,edge): managed mode takes confirm, and the audit log says whether the user confirmed a call (@frontegg-david)
• fix(cli): the generated CLI says unknown command, prints an MCP error prefix once, and offers load_skill only the run lines it has #1140 fix(cli): the generated CLI says unknown command, prints an MCP error prefix once, and offers load_skill only the run lines it has (@frontegg-david)
• fix(plugins): load_skill's outputSchema describes a loaded skill once #1141 fix(plugins): load_skill's outputSchema describes a loaded skill once (@frontegg-david)
• fix(sdk,cli): skills/load's default answer sends formattedContent again, as 1.11.0 did; format: 'markdown' is the opt-in for the smaller one #1142 fix(sdk,cli): skills/load's default answer sends formattedContent again, as 1.11.0 did; format: 'markdown' is the opt-in for the smaller one (@frontegg-david)

Action Required

Please review this cherry-pick to ensure it applies correctly to main.

If the changes are NOT needed in main, close this PR.

---

This PR was automatically created by the cherry-pick workflow.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: agentfront/frontmcp
• Branch: main
• File: .coderabbit.yaml
• Commit: ada87d5
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: c08cce1b-8e93-4e1d-9d0c-f5bc9c8f2276

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts