chore: version packages

[gram-bot]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

server@2.0.0

Major Changes

• 0809b17: Remove MCP collections. The collections service and its /rpc/collections.* endpoints are gone, along with the Collections pages and sidebar entry, the Publishing section on MCP server settings, the collection group panel in access grant rules, the "Catalog kind" filter on Sources, and the Collection origin label on catalog sources. Collection audit actions are no longer recorded or rendered. The backing tables and the organization_mcp_collection_registry_id column are dropped in a follow-up migration.

Minor Changes

• a2105d0: Add organization-authorized APIs for managing project-scoped data export destinations with transport-specific configuration and routes.
• 0442bce: Stamp gateway (meta MCP) identity on tool-call telemetry and emit gateway discovery events and dispatch metrics
• 6793315: Add gateway telemetry query support: observability overview meta MCP filter, gateway usage endpoint (funnel + member breakdown), and gateway rows in MCP activity
• 1d49919: MCP endpoints now validate the Origin header and answer cross-origin browser requests with 403, as the MCP specification requires, and MCP POSTs must be sent with Content-Type: application/json or are rejected with 415. Native MCP clients are unaffected because they send neither Sec-Fetch-Site nor Origin, and Gram Elements keeps working through the chat-session token's audience claim.
• aca4e5e: OpenClaw is now a first-class agent source. It appears as a single entry in the agent-type filter, and its sessions participate in prompt-to-response turn correlation using OpenClaw's own per-run identifier.
• ddbb145: OpenClaw sessions now contribute to the usage summaries. The per-turn usage and completed tool-call predicates in the attribute-metrics and chat-session materialized views previously counted only Codex, Cursor and OpenCode, so OpenClaw rows were ingested but skipped by every token, cost and tool-call aggregate. The change applies from deployment onward and does not retroactively aggregate existing OpenClaw sessions.
• 90f2703: Generate high-confidence skill improvement recommendations passively during efficacy analysis and feed them into the existing edit-suggestion workflow. New plugin packages and managed assistants no longer expose the active skill-feedback tool, while the ingestion endpoint remains available for previously installed clients.
• fa05d58: Tunneled MCP servers can record an RFC 9728 resource identifier (never dialed), at creation or later through the update form, which gateway consent stamps as the RFC 8707 resource on the grants its members mint. A tunneled backend is routed by its own derived provider issuer, accepting that grant when it is unqualified or names the recorded identifier — never a credential minted through another authorization server, since a tunnel's dial target is decoupled from the resource its identifier claims. Remote backends continue to match on recorded resource across the session's credentials. The lone-token routing fallback is removed on both surfaces: an unmatched credential is never forwarded.
• fa05d58: tunneledMcp.updateServer no longer requires name: like allow_public and resource_identifier, an omitted name leaves the stored value unchanged. Dashboard sections that edit a single field no longer send the cached display name alongside it, so saving one setting can never revert a rename that landed in between.
• 4988249: Toolset-backed MCP servers resolved through mcp_endpoints are now served under their mcp_servers row's configuration: visibility, issuer gating, the RBAC resource id for mcp:connect (per-server, per-tool, and the consent tool picker), and the variation-group override all come from the wrapper, and the toolset's own mcp_is_public / user_session_issuer_id columns are no longer consulted on that path. Bearer validation on toolset-backed wrappers accepts the legacy toolset-URN audience as a counted fallback (mcp.legacy_audience_accepted). A resolvable mcp_endpoints address whose backend is disabled or dangling is now a terminal not-found on every surface instead of falling back to the legacy toolsets.mcp_slug lookup, and every remaining legacy fallback resolution increments mcp.toolset_slug_fallback by entry point. No production traffic changes on deploy: no toolset-backed mcp_servers rows exist yet.

Patch Changes

• ec94eae: Report per-user usage and audit actors accurately. The per-user metrics summary now counts Claude Code and Codex usage, which report tokens and cost on their own attributes rather than the generic gen_ai.usage.* path it read — someone working through either surface showed zero tokens and zero spend while the cost dashboard billed them in full. Audit log actors resolve against the directory at read time, in the feed, its actor filter and the admin activity list alike: every writer stores the acting user's email, so all three read as columns of addresses.

• 5419c11: Authz challenge logging now writes to ClickHouse in batches rather than one insert per event. The previous per-row insert held a pooled ClickHouse connection for the duration of a server-side flush, capping the subscriber's throughput and exhausting the connection pool shared with the other ClickHouse writers, so challenge, event feed, and risk finding ingestion could all fall behind a growing Pub/Sub backlog under sustained challenge volume.

• ddebe22: The remote MCP connect page now matches the dashboard and asks for less. A server whose single required service is not linked yet goes straight to that provider instead of showing an interstitial with one button; on a server fronting several providers, Connect is a full-page step so each provider stays its own decision. The header names the requesting client and the MCP server side by side, so a slug carrying the organization prefix is still readable. Tool access leads with "All tools" and reveals the picker only when the grant is narrowed, and request details sit behind a disclosure — except the local-address warning, which stays visible.

• 12f11ca: Gateway endpoints: fix issues found in prod E2E testing. Removing a gateway member now unbinds that member's upstream identity provider from the gateway's user-session issuer once no remaining consumer of that issuer still fronts the upstream, so a removed member's provider no longer lingers on the consent screen (correct even when an issuer is shared across gateways). A malformed (unparseable) JSON-RPC request body now returns the spec's parse-error code (-32700) rather than invalid-request (-32600). The consent screen shows a helper line explaining that access is disabled until a service is connected.

• 54fdd25: Hosted (toolset-backed) MCP servers resolved through mcp_endpoints now derive their identity from the resolved endpoint and mcp_servers wrapper instead of the toolset columns. The well-known OAuth documents key the OAuth slug and resource URL on the endpoint the request arrived at; session mint accepts any issuer-gated mcp_server_id and builds the issuer URL from the server's primary endpoint, with toolset_id mints resolving to the wrapper when one exists; the install page takes publicness and security mode from the wrapper (the toolset's external OAuth reference remains the only toolset input) and the install URL from the endpoint; instance MCP URLs come from the wrapper's primary endpoint. Legacy toolset paths are unchanged for servers without a wrapper, and no toolset-backed wrappers exist in production yet, so no traffic changes on deploy.

• ec94eae: Identity page widgets now honour the selected time range. The audit trail, authorization challenges and per-person shadow MCP servers were reading their whole history regardless of the picker, so a 7-day view could report 233 findings alongside a device's worth of activity from a year ago and give no sign the two were counted over different periods. auditlogs.list, access.listChallenges and access.listShadowMCPInventoryServersForUser take optional from/to bounds — half-open, and absent bounds still return the whole history for every existing caller — and the Overview, Activity, Access and Security tabs pass the window they are showing.

  Managed devices deliberately stay outside the range: it is the current MDM inventory rather than a stream of events, and a machine that has been quietly missing its agent for a month is exactly the one worth seeing. The panel and the Overview tile now say so instead of leaving the reader to assume the picker applied.

  Each widget also shows a skeleton shaped like what it is loading rather than its empty state, so a panel that has not answered yet no longer claims there is nothing to report, and the detail page keeps room below the last panel instead of ending flush with the viewport.

  A failed read is now told apart from a quiet window everywhere on these pages. Panels whose request errored say so and offer a retry instead of rendering "no roles assigned", "no managed device assigned" or "not enrolled" off data that never arrived, and the Cost and Usage tiles show a dash rather than $0 when the metrics request fails or the identity carries no identifier the endpoint can key on. Two narrower cases go with it: an address claimed by more than one member no longer resolves to whichever came first, so the Access panels cannot show a stranger's roles; and the shadow-MCP lookup deduplicates and bounds the identifiers it sends, since an over-long list was rejected outright and read on screen as "no shadow servers".

  Audit actor names resolve through the reading organization's memberships rather than straight at the global directory, so an actor id that never belonged to the organization falls back to the stored value instead of naming someone from another tenant. Soft-deleted memberships still resolve — a departed member is exactly the actor whose name the feed is meant to keep.

  Retrying a failed panel now re-runs only the reads that actually failed. A query held behind a permission or a missing identifier never errors, but an explicit refetch runs it anyway, so a blanket retry could have asked for audit logs with no actor filter or for the viewer's own chats without chat:read and rendered either under the subject's name. A failed refresh also keeps the rows it already had — those were really returned — and says above them that they are no longer current, rather than blanking a panel that still has something true to show. The Overview stat row picks up the dash treatment the Cost and Usage tiles already had.

  Identity links are gated on org:read, matching the page they lead to: previously an org reader lost the link while a project reader got one to a page they cannot open. Authorization challenges fall back to the Gram user id rather than the WorkOS one, which is what the authz engine records principals against — the WorkOS id matched nothing, so the panel reported a clean history for people who may not have one.

• 4299484: Fixed MCP Origin validation rejecting the OAuth callback routes registered under /mcp/ and /x/mcp/. idp_callback and remote_login_callback sit in the same path position as a server slug, so they were treated as MCP endpoints and answered with 403 when the browser followed the upstream identity provider's redirect back to Gram. The hashed consent and install page scripts were misclassified the same way. Origin validation on the MCP JSON-RPC endpoints themselves is unchanged.

• 858f8e7: Key MCP server management authorization on the server's grant resource id instead of the project id, aligning it with the toolsets surface and the serving path. Get, update, delete, and tool-filter reads now check mcp:read/mcp:write against the toolset id (toolset-backed) or mcp_servers row id (remote/tunneled), and listing filters to the servers the caller holds a grant for — so role grants scoped to a single server now unlock managing exactly that server. Project-wide (project_id dimension) and wildcard grants behave as before. Listing with no matching grants now returns an empty list instead of forbidden, and get/update/delete on a server the caller lacks now return forbidden after the project-scoped row lookup (404 for rows that don't exist in the project).

• f6c8887: Add meta_mcp_server_id attribution columns to ClickHouse telemetry ahead of gateway telemetry emission

• 424d211: New organizations now have Enable Logs, Record Tool I/O, and Agent Session Capture on by default. Existing organizations are unchanged, and org admins can still turn the settings off.

• 89ec359: The generated observability plugin package now includes OpenClaw install instructions, covering the plugin install, the conversation-access setting that must be enabled for prompt and usage capture, and the model-auth modes that determine how much of a session OpenClaw can report.

• 81e2a93: Unify MCP slug availability across toolsets and mcp_endpoints into a single namespace per address scope. A shared check (spanning both toolsets.mcp_slug and mcp_endpoints.slug) now backs toolsets.checkMCPSlugAvailability, mcpEndpoints.checkMcpEndpointSlugAvailability, toolset MCP slug updates, and MCP endpoint create/update, so an endpoint can no longer be created with a slug a live hosted (toolset-backed) server still resolves under, and vice versa. Owner exclusions let a hosted server's mirrored address validate against itself. The dashboard endpoint-slug validation hook drops its second RPC now that the endpoint check covers both tables.

• 731557d: Test fixtures stop sharing one toolset across live mcp_servers wrappers.

dashboard@0.114.0

Minor Changes

• 0570bd9: Add project-scoped data export configuration under the organization Data navigation.
• 0809b17: Remove MCP collections. The collections service and its /rpc/collections.* endpoints are gone, along with the Collections pages and sidebar entry, the Publishing section on MCP server settings, the collection group panel in access grant rules, the "Catalog kind" filter on Sources, and the Collection origin label on catalog sources. Collection audit actions are no longer recorded or rendered. The backing tables and the organization_mcp_collection_registry_id column are dropped in a follow-up migration.
• fa05d58: Tunneled MCP source settings gain a Resource Identifier section for recording the server's RFC 9728 protected resource identifier, which routes user credentials to the server by exact match. Clearing the field unsets it. The creation form also accepts the identifier upfront, for operators who already know it.

Patch Changes

• 2ac3d62: Keep Explore demo org reachable from the account menu after the trial welcome banner no longer shows it.

• b8d1eea: Show gateway activity on the Gateway Endpoint overview (usage scoped to the gateway, discovery funnel, calls by member) and activity markers on gateway cards in the MCP listing

• 12f11ca: Gateway endpoints: fix dashboard issues found in prod E2E testing. Deleting a tunneled MCP source no longer leaves its confirm dialog stuck on "Deleting…" — the mutation no longer blocks on refetching the just-deleted resource, so the dialog closes and navigates on success. The gateway add-member sheet no longer implies unproxied or slugless servers can be added: the copy is corrected and their Add button is disabled (the backend rejects them), while disabled servers can still be added but stay excluded from serving.

• b2defd1: Polish the gateway UX on the MCP listing and detail pages: gateway cards show their member servers' logos and a status dot consistent with server rows, the listing copy and table columns account for gateways, member management (reorder, add, remove) moves onto the Overview tab and the separate Members tab is removed (its URL redirects to overview), detail-page tab switches scroll back to the top, the gateway sidebar URL truncates instead of wrapping mid-token, absent MCP metadata no longer replays 404 requests on every remount, and team-access rows (gateways and MCP servers alike) click through to the Access page's pre-filled grant dialog — "No access" cells deep-link the specific missing scope. Clickable table rows across the dashboard now highlight more strongly on hover.

• 6793315: Add gateway telemetry query support: observability overview meta MCP filter, gateway usage endpoint (funnel + member breakdown), and gateway rows in MCP activity

• 54fdd25: Hosted (toolset-backed) MCP servers resolved through mcp_endpoints now derive their identity from the resolved endpoint and mcp_servers wrapper instead of the toolset columns. The well-known OAuth documents key the OAuth slug and resource URL on the endpoint the request arrived at; session mint accepts any issuer-gated mcp_server_id and builds the issuer URL from the server's primary endpoint, with toolset_id mints resolving to the wrapper when one exists; the install page takes publicness and security mode from the wrapper (the toolset's external OAuth reference remains the only toolset input) and the install URL from the endpoint; instance MCP URLs come from the wrapper's primary endpoint. Legacy toolset paths are unchanged for servers without a wrapper, and no toolset-backed wrappers exist in production yet, so no traffic changes on deploy.

• ec94eae: Add Identities as an org-level section: an index of every person and agent the organization has seen, whether or not they have an account here, and a page per identity gathering their access, usage, security, cost, devices and activity from every subsystem. Each tab answers its own question rather than repeating a list — tool calls carry their failure share, cost shows where the tokens went and what came from cache, activity plots the rhythm a row list cannot — and figures are ranked against peers for the same window, since a bare number cannot be read without one. Overview flags anyone working through a personal AI account rather than the team one.

  Person references across the dashboard link here, including the budgets tables, project home top-user cards, chat transcripts and killswitch detail; names on row-click surfaces are now real anchors, so they support cmd+click and copy-link. Employee Enrollment folds into the index and its old URL redirects.

  Also fixes shared chrome this surfaced: avatar tints follow the theme instead of always emitting light-theme values, and the sidebar's current page keeps its own marker so hovering elsewhere no longer hides where you are.

  The Usage tab filters by AI account class — all, team, or personal — so the work someone puts through a subscription the organization does not govern can be read on its own, and the choice rides in the URL. Linked accounts and managed devices carry their provider and platform marks, and ranked figures are written compactly so a ten-digit token count no longer overruns its column onto the bar beside it.

• ec94eae: Identity page widgets now honour the selected time range. The audit trail, authorization challenges and per-person shadow MCP servers were reading their whole history regardless of the picker, so a 7-day view could report 233 findings alongside a device's worth of activity from a year ago and give no sign the two were counted over different periods. auditlogs.list, access.listChallenges and access.listShadowMCPInventoryServersForUser take optional from/to bounds — half-open, and absent bounds still return the whole history for every existing caller — and the Overview, Activity, Access and Security tabs pass the window they are showing.

  Managed devices deliberately stay outside the range: it is the current MDM inventory rather than a stream of events, and a machine that has been quietly missing its agent for a month is exactly the one worth seeing. The panel and the Overview tile now say so instead of leaving the reader to assume the picker applied.

  Each widget also shows a skeleton shaped like what it is loading rather than its empty state, so a panel that has not answered yet no longer claims there is nothing to report, and the detail page keeps room below the last panel instead of ending flush with the viewport.

  A failed read is now told apart from a quiet window everywhere on these pages. Panels whose request errored say so and offer a retry instead of rendering "no roles assigned", "no managed device assigned" or "not enrolled" off data that never arrived, and the Cost and Usage tiles show a dash rather than $0 when the metrics request fails or the identity carries no identifier the endpoint can key on. Two narrower cases go with it: an address claimed by more than one member no longer resolves to whichever came first, so the Access panels cannot show a stranger's roles; and the shadow-MCP lookup deduplicates and bounds the identifiers it sends, since an over-long list was rejected outright and read on screen as "no shadow servers".

  Audit actor names resolve through the reading organization's memberships rather than straight at the global directory, so an actor id that never belonged to the organization falls back to the stored value instead of naming someone from another tenant. Soft-deleted memberships still resolve — a departed member is exactly the actor whose name the feed is meant to keep.

  Retrying a failed panel now re-runs only the reads that actually failed. A query held behind a permission or a missing identifier never errors, but an explicit refetch runs it anyway, so a blanket retry could have asked for audit logs with no actor filter or for the viewer's own chats without chat:read and rendered either under the subject's name. A failed refresh also keeps the rows it already had — those were really returned — and says above them that they are no longer current, rather than blanking a panel that still has something true to show. The Overview stat row picks up the dash treatment the Cost and Usage tiles already had.

  Identity links are gated on org:read, matching the page they lead to: previously an org reader lost the link while a project reader got one to a page they cannot open. Authorization challenges fall back to the Gram user id rather than the WorkOS one, which is what the authz engine records principals against — the WorkOS id matched nothing, so the panel reported a clean history for people who may not have one.

• 424d211: New organizations now have Enable Logs, Record Tool I/O, and Agent Session Capture on by default. Existing organizations are unchanged, and org admins can still turn the settings off.

• 81e2a93: Unify MCP slug availability across toolsets and mcp_endpoints into a single namespace per address scope. A shared check (spanning both toolsets.mcp_slug and mcp_endpoints.slug) now backs toolsets.checkMCPSlugAvailability, mcpEndpoints.checkMcpEndpointSlugAvailability, toolset MCP slug updates, and MCP endpoint create/update, so an endpoint can no longer be created with a slug a live hosted (toolset-backed) server still resolves under, and vice versa. Owner exclusions let a hosted server's mirrored address validate against itself. The dashboard endpoint-slug validation hook drops its second RPC now that the endpoint check covers both tables.

• 12b280d: The Watchdog page now explains the org risk score with an info tooltip: each signal's score is inherited from its policy, and the overall score weights the most severe signal, the average of the top signals, and the total number of findings rather than a plain average.

[blacksmith-sh]

Found 13 test failures on Blacksmith runners:

Failures

Test	View Logs
github.com/speakeasy-api/gram/server/cmd/tools/migrations/openrouterdisablecauses/ TestMain	View Logs
github.com/speakeasy-api/gram/server/cmd/tools/migrations/riskfindings/TestMain	View Logs
github.com/speakeasy-api/gram/server/internal/access/TestMain	View Logs
github.com/speakeasy-api/gram/server/internal/agent/TestMain	View Logs
github.com/speakeasy-api/gram/server/internal/aiintegrations/TestMain	View Logs
github.com/speakeasy-api/gram/server/internal/auth/assistanttokens/TestMain	View Logs
github.com/speakeasy-api/gram/server/internal/auth/chatsessions/TestMain	View Logs
github.com/speakeasy-api/gram/server/internal/cliauth/TestMain	View Logs
github.com/speakeasy-api/gram/server/internal/demoseed/TestMain	View Logs
github.com/speakeasy-api/gram/server/internal/environments/TestMain	View Logs

...and 3 more test failures. View all on Blacksmith

^{Need help on this PR? Tag @codesmith-bot with what you need.}