mastra-ai/mastra @mastra/core@1.83.0

November 12, 2026

on GitHub

Highlights

Resumable Agent streams (now for every Agent)

Every Agent can now publish a resumable run stream with replay caching, cross-instance observe/abort (agent.observe(runId), observe().abort(), agent.abortRunStream(runId)), and ownership/TTL enforcement—so clients can reconnect without killing the run by default.

Built-in MCP server at /api/mcp + OAuth discovery

@mastra/server now ships a built-in MCP endpoint (enabled by default when server.auth is configured) so MCP clients can call your agents/workflows/tools without defining an MCPServer, plus OAuth discovery/audience checks via server.mcp.oauth and a new introspection route GET /api/mcp/builtin.

Workflow Storage Version 2 (delta writes) now supported on Postgres + libSQL

Experimental storageVersion: 2 reduces writes by persisting only per-step changes (instead of rewriting the whole run) and now works with @mastra/pg and @mastra/libsql, with results that can lazily load step history via an async steps() function.

Resumable AI SDK chat routes (useChat({ resume: true }) support)

chatRoute({ resumable: true }) now generates a POST + reconnect GET endpoint pair that replays/follows active runs via agent.observe(runId), with explicit route-array configuration support (server.apiRoutes: [routes]).

One-off and bounded schedules for agents & workflows

Schedules now support one-time execution (runAt) and bounded recurring execution (endAt), with TypeScript updates (cron is optional) across server, client, and multiple storage backends.

Breaking Changes

• Agent’s durable option now controls resumable streams only (not checkpoint-backed durable execution); migrate durable execution to createDurableAgent({ agent }), and note plain-agent disconnect behavior differs when streams are enabled.

Changelog

@mastra/core@1.83.0

Minor Changes

• Added resumable streams to every Agent, not just durable agents. An agent registered on Mastra now publishes each run on its stream topic and keeps a replay cache, so a client can reconnect after a disconnect, another reader can follow the run with agent.observe(runId), and any reader can stop it with observe().abort() or agent.abortRunStream(runId). (#28424)

  Also in: @mastra/server@1.83.0

• Avoid blocking the event loop while loading instruction files from a trusted Git ref and while discovering tool-result instruction reminders. Keep missing and untrusted-ref behavior unchanged. (#30104)

  Also in: @mastra/code-sdk@1.19.0

• Add model and provider as span query sort fields. (#30096)

• Added server.mcp.oauth (resource, requireAudience, authorizationServers, scopesSupported) to configure OAuth discovery and token audience checks for the built-in MCP server. Auth providers can implement the new optional getOAuthMetadata() and verifyAudience() methods to advertise their authorization server and check the token audience. CompositeAuth combines the authorization servers of its providers and checks the audience with the provider that accepted the token. The new CompositeAuth.getAuthenticatedProvider(user) returns that provider. (#29930)

• Added the server.mcp option for configuring the built-in MCP server at /api/mcp: turn it on or off, change its path, choose toolsets, feature agents and workflows, serve only read-only tools, and include or exclude agents, workflows, and tools by id. (#29929)

• Added memory, observability, observability_analytics, and stored_agents to the toolsets accepted by server.mcp.toolsets. (#29931)

• Chat SDK logs from channels now use your Mastra logger, so they follow its format, level, and redact settings. These logs no longer print with the [chat-sdk] console prefix. To filter them, use component: 'chat-sdk'. Use the new toChatLogger export to send adapter logs to the same logger. (#29392)

• Added experimental generativeUI option to the Slack channel adapter. When enabled, the agent gets a render_card tool that posts json-render specs as Block Kit cards: fields, tables, charts, images, and link buttons. Invalid specs are returned to the agent as a list of issues so it can fix and retry. Requires the optional @json-render/chat package. (#29820)

  Also in: @mastra/slack@1.9.0

• Added resumable AI SDK chat routes and explicit route-array inputs for server configuration. (#29549)

  Also in: @mastra/ai-sdk@1.12.0

• Add optional feedback replacement events and storage support. Keep the original feedback ID, trace ID, and timestamp when replacing a record. Storage callers can preserve existing feedback with onConflict: 'ignore': (#30059)

• Added duration ordering for completed span queries. Use orderBy: [{ field: "durationMs", direction: "desc" }] to find the slowest spans. (#30085)

  Also in: @mastra/clickhouse@1.30.0, @mastra/client-js@1.60.0, @mastra/duckdb@1.19.0, @mastra/pg@1.36.0, @mastra/server@1.83.0

• The experimental workflow storageVersion: 2 option now works with @mastra/pg and @mastra/libsql as well as in-memory storage. (#28299)

• Added buildEnv and buildEnvRevision to FactorySandboxContext. Factory uses them to pass a factory's Build environment variables to template builds and setup steps without putting the values in the template identity. A provider should include buildEnvRevision (a random id that changes whenever the values change) in its template identity so an edit rebuilds the template. Both fields are optional, so existing providers compile unchanged. (#29923)

• Add span-local error counts. (#30088)

  Also in: @mastra/client-js@1.60.0, @mastra/observability@1.24.0

• Add shared contracts for opt-in aggregated trace roots. OSS readers remain unsupported. (#30054)

  Also in: @mastra/client-js@1.60.0, @mastra/server@1.83.0

• Added shared text-search query contracts for Platform integration. (#29897)

• Add optional review-status update methods for observability exporters. Unsupported exporters skip these updates safely. (#30075)

• Added maxChunkChars to the semantic recall options. Messages longer than this many characters are split into chunks, and each chunk is stored as its own vector row, so long messages no longer fail to embed or lose the text past the embedder's input limit. The default is 16,384 characters, about 4,096 tokens of English text. Lower it for Chinese, Japanese, or Korean text, or code. (#29826)

• Scorer judges now accept the same instructions as agents, and dynamic instructions can read the run's requestContext. You can keep a large shared input, such as a report, in a cached system message and change it per run. (#29387)

• Added direct feedback lookup to observability storage. await storage.getFeedbackById(feedbackId) returns the record or null when it is missing. (#29529)

  Also in: @mastra/clickhouse@1.30.0, @mastra/duckdb@1.19.0, @mastra/pg@1.36.0

• Added diffResponseMessages and the ResponseMessagesCursor type to @mastra/core/agent/durable for durable agent integrations outside core, such as @mastra/inngest. They build the step events that carry only the response messages that changed since the previous step, which observe() and callers rebuild into the full list. (#29976)

• Added an experimental storageVersion workflow option. With storageVersion: 2, a run saves only what changed at each step instead of rewriting the whole run. This cuts storage writes for long workflows and loops, including loops whose state grows every iteration. (#27144)

• Added one-off and bounded schedules for agents and workflows. Pass runAt instead of cron to fire a schedule once, or pass endAt with cron to stop a recurring schedule after a given time. Finished schedules use the existing completed status when they have no automatic fires remaining. Declarative workflow schedules (createWorkflow({ schedule })) accept runAt and endAt too, and schedule hooks receive trigger.kind: 'once' for a scheduled fire of a one-off agent schedule. (#25131)

  Also in: @mastra/client-js@1.60.0, @mastra/convex@1.9.0, @mastra/libsql@1.30.0, @mastra/mongodb@1.27.0, @mastra/mysql@0.17.0, @mastra/pg@1.36.0, @mastra/server@1.83.0, @mastra/spanner@1.12.0

• Add optional context mode, timestamp, and response identity fields to HTTP feedback/score types. Preserve an explicit null feedback author in storage without substituting the span user; omitted legacy storage attribution remains supported. (#29289)

• Added an optional user argument to dynamic configuration callbacks. When server authentication is configured, callbacks for instructions, model, tools, memory, and other dynamic options receive the authenticated end user normalized to a stable MastraUser shape (id, name?, email?, avatarUrl?, role?), so you can personalize agents without reading auth keys from requestContext yourself. (#28612)

• Added an injectCatalog option to SkillsProcessor so agents with many skills can leave the skills list out of the system message. With injectCatalog: false, the agent gets a short instruction to find skills with the skill_search tool and load them with the skill tool. The skill, skill_read, and skill_search tools stay available for both workspace skills and skills configured on the agent. (#26316)

• Required a nonblank traceId in the feedback and score HTTP body schemas. Missing, null, empty, and whitespace-only IDs are rejected. Storage creation, batch APIs, and historical nullable records are unchanged. (#29287)

• Added an optional persistenceLocation capability to observability storage domains. Adapters can report 'local' for embedded files, in-memory databases, and local replicas, or 'remote' for database services. The built-in InMemoryStore, including Mastra's automatic fallback when no storage is configured, reports 'local'. The default is undefined for adapters that do not report a location. (#29737)

• BREAKING: On a plain Agent, durable now controls resumable streams only, not checkpoint-backed execution. Omit it for streams on registered agents and off standalone agents; use true to enable streams everywhere, false to disable them, or an object containing pubsub, cache, shouldCache, and cleanupTimeoutMs. (#29503)

Patch Changes

• Limit controller thread listings by reading an expanding newest-first storage prefix, doubling its size when forked or out-of-scope threads must be skipped. (#30090)

• Mastra.addAgent now throws MASTRA_ADD_AGENT_DUPLICATE_KEY when a different agent is registered under an occupied key instead of silently skipping it. (#29966)

• Name the agent in the missing-storage error thrown by Memory. (#30164)

• AgentsMDInjector now calls getIgnoredInstructionPaths once per model step instead of once for every instruction file the step checks. (#29551)

• Update provider registry and model documentation with latest models and providers (1a078af)

• Honor an Agent's pubsub for DurableAgent thread coordination so replicas sharing that bus can discover active runs, receive thread updates, and coordinate thread leases and Stop requests. (#30215)

• The agent controller's command_exit event now says how a command ended, so clients can show more than a failure code: killed when the process was killed, timedOut when it ran past its timeout, and error when the sandbox could not run it (its exitCode is then -1). (#29314)

• Fixed sub-agents that stopped streaming after a durable agent run was resumed with a requestContext. (#29616)

• Fixed resuming a stream from an offset silently skipping events. (#29783)

• Fixed a deleted stored agent's workspace showing up again. (#29927)

• Fixed a stale tool-approval click in one chat thread aborting a live run in another thread when both threads share a controller session. (#29478)

• Fixed structured output on Azure OpenAI models failing with Invalid schema for response_format when strict mode is on. (#29590)

• Smaller agent run streams (#29965)

• Fixed claimed-owner discovery sending one extra request right at its 1 s deadline when a timer fired a millisecond early. (#29157)

• Fixed client tools and AI SDK jsonSchema() tools losing unions (anyOf) in their input schema. (#29440)

• Fixed evented agent runs staying in running forever when the lease backend restarted while a tool was finishing. (#29430)

• The coding-agent base prompt now says that approving a submitted plan starts it as a goal. (#28037)

• Fixed background tasks that finish after their run ended going unreported or reported twice: (#29442)

• Experiment comparison now respects organization and project scoping. (#29479)

  Also in: @mastra/server@1.83.0

• With server.auth set and no server.cors.origin, the server no longer sends Access-Control-Allow-Credentials: true for every reflected origin. (#29406)

  Also in: @mastra/deployer@1.83.0

• Fixed reconnecting to a finished durable or evented agent run from a server other than the one that ran it. (#29791)

  Also in: @mastra/server@1.83.0

• Fixed streaming supervisors that delegate to a durable or evented sub-agent: (#29592)

• Fixed dynamic workflows dropping input, output, and state fields that are not listed in properties. (#29829)

• Fixed embedding models for providers whose base URL comes from an environment variable, such as Neon. (#29631)

• Fixed a nested workflow overwriting parent state that another step changed while it ran. (#29489)

• Fixed the evented workflow engine dropping the suspend() payload and resume labels when a step inside a nested workflow's .branch() or .parallel() suspends. (#29833)

• Fixed observe(runId, { offset }) on evented agents that use a cross-process PubSub such as Redis Streams with the default in-memory server cache. (#29798)

• Fixed evented durable agent runs that hung forever after the API and worker restarted together mid-tool. (#29431)

• Exported REPROCESS_PART_KEY from @mastra/core/processors, so a custom output processor can emit two chunks for one input. (#29939)

• Fixed workspace grep skipping common template, build and lock files. (#29417)

• Fixed semanticRecall.filter being ignored during agent.generate() and agent.stream(). (#29418)

• Fixed nested workflows losing their state changes after a crash. (#29308)

• Fixed the SOURCE_MAP.json file shipped with the package docs. (#29328)

  Also in: @mastra/memory@1.41.1

• Fixed untilIdle streams answering twice when the model had already answered with a background tool's result. (#29848)

• Fixed restarting a .foreach() over a nested workflow failing with "This workflow run was not active" when an item was running at the moment the process stopped. (#29308)

• Fixed .foreach() applying a finished item's state changes twice after a restart. (#29308)

• Fixed a queued message being lost when the run it was handed to, on this or another process, ended at the same moment. (#29142)

• Fixed the workspace read_file tool sending a file as an image or PDF based only on its extension. (#29469)

• Fixed long grep result lines that could contain a broken character after being shortened. (#29473)

• Fixed sub-agent delegation failing on Anthropic models with extended thinking when the supervisor delegates after calling another tool in the same run. (#29620)

• Fixed writer being undefined in processOutputResult for agents wrapped with createDurableAgent or createEventedAgent. (#29286)

• Durable and evented agents now save the same turn as other agents when a total timeout ends the run. (#29036)

• Fixed long-running agent processes (such as Mastra Code sessions left open for days) losing their thread lease mid-run with "lost its lease before publishing a terminal event". (#29723)

• The agent now logs a warning when two toolsets expose a tool with the same name, such as search from two MCP servers passed with mcp.listToolsets(). (#29415)

• Fixed agent tool calls failing when the tool's input schema transforms values, for example a string decoded into a URL (#27259). (#29555)

• Durable agents now deliver abort() requests to a tool's abortSignal even when the tool runs on another worker. (#29002)

• Fixed streamUntilIdle() on agents created with createInngestAgent closing right after background-task-completed. (#29877)

  Also in: @mastra/inngest@1.11.2

• Fixed evented workflows replacing omitted or null input with {}, matching the default engine. (#29542)

• Fixed live scorers storing data that the scored agent hides from traces. (#29174)

• Improved skill discovery through skill_search: (#26316)

• Fixed Knowledge writes slowing down for agents that hold many scopes. (#29775)

• Fixed a type error when calling a tool directly without a context. (#29419)

• Storage version 2 workflow results no longer load every step result into memory. (#29362)

  Also in: @mastra/mcp@2.9.0, @mastra/server@1.83.0

• Fixed run.timeTravel() dropping resume data that is false, 0, an empty string, or null. (#29425)

• Fixed custom stopWhen conditions on durable and evented agents receiving tool results in Mastra's internal shape. (#29426)

• Fixed unbounded shell output retention in the controller display state and the Mastra Code terminal UI. (#28808)

• Preserve explicit anonymous feedback authors and review status when forwarding persisted feedback to exporters. (#30052)

• Agent runs that hit modelSettings.timeout.totalMs on the default and filesystem engines now save the turn at the deadline: the user's message, every step that finished before the deadline, the tool call that was cut off with its abort notice, the text the model had already streamed, and the data-* parts that output processors write at the end of the turn. (#29047)

• Fixed durable and evented agents returning the original model text after an output processor rewrote the final reply. (#29849)

• Fixed TypeScript errors with zod v3 schemas and newer ai v7 messages. (#29581)

  Also in: @mastra/client-js@1.60.0, @mastra/inngest@1.11.2

• Improved how DurableAgent and EventedAgent store their run stream (agent.stream.<runId>). (#29975)

• Fixed an extra model request when a tool call failed in a response that hit the output limit or a content filter. (#29540)

• Improved the missing-storage error for memory that has not been registered with Mastra. (#29972)

• Fixed mastra.restartAllActiveWorkflowRuns() and workflow.restartAllActiveWorkflowRuns() restarting a nested workflow run on its own. (#29308)

• Fixed a nested workflow run's stored snapshot dropping its parent workflow while the run executed a step inside .parallel() or .branch(). (#29308)

• Fixed state changes being lost when a nested workflow ran at the same time as other steps, in .parallel() or in .foreach() with a concurrency above 1. (#29308)

• The submit_plan tool no longer names .mastracode/plans/ in its path example, so agents follow the plans directory their instructions give instead of a hardcoded one. (#29132)

• Agent stream chunks now carry index, their run-log position, so a client can resume observe() after a dropped connection without repeated or missing chunks. (#29520)

  Also in: @mastra/client-js@1.60.0, @mastra/server@1.83.0

• Agent.observe() and DurableAgent.observe() now share a single helper for detaching an observer's fullStream subscription, instead of each keeping its own copy. (#30111)

• Resuming a finished plain (non-durable) agent run past its last chunk now closes the stream right away. (#29520)

  Also in: @mastra/server@1.83.0

• Fixed workflow runs whose dowhile or dountil condition, or foreach concurrency function, throws. (#29850)

• Fixed tool calls released by a permission rule after a session reopens failing with "the request has no authenticated user". (#30159)

• Tool calls waiting on approval now follow the current permission rules. (#30114)

• Fixed aborting a DurableAgent run (from createDurableAgent, including evented agents) that is waiting for tool approval when your app runs on more than one server. (#29799)

  Also in: @mastra/server@1.83.0

• The workspace read_file tool now reads NDJSON and JSONL files as paginated text when the filesystem reports an NDJSON MIME type (such as application/x-ndjson) or adds a UTF-8 charset parameter, instead of refusing them as binary. (#28796)

• Fixed the conversation context a supervisor forwards when it delegates to a sub-agent: a provider-executed tool result no longer survives without its tool call. (#30134)

• Keep nested workflow questions in durable agent history when a tool pauses, so the question remains available after suspension (#29013) (#29145)

• The coding agent now ends pull request descriptions with one Fixes <ID> line for each Linear issue it worked on, such as Fixes ENG-123, so the GitHub and Linear sync links the PR and closes the issues. (#30112)

• On Linux, commands that LocalSandbox runs now raise their own out-of-memory score, so when a command uses up the memory it shares with your agent, the kernel kills the command instead of the agent. (#29485)

• Improved how fast AgentController.listAvailableModels() answers. (#29432)

• Durable agent runs now surface a publish failure immediately instead of stalling for ten seconds. (#29718)

• Fixed processor listings showing agents that were removed. (#29927)

• Tool validation failures no longer write submitted values to logs. (#29331)

  Also in: @mastra/mcp@2.9.0

• Agent traces now cover the setup before the first model call. (#30002)

• Fixed duplicate assistant messages after resuming a thread with memory. (#29537)

• Fixed run.restart() on evented workflows failing with "This workflow run was not active" when a nested workflow had already finished before the restart. (#29855)

• Fixed cached stream events on Redis Cluster falling back to non-atomic index allocation and list writes. (#30174)

• Fixed restarting a parent workflow reverting its state to a nested workflow run's copy. (#29332)

• Fixed evented workflows retrying failed steps immediately. (#29420)

• Experiments with a scorer or processor target now save their scores, and workflow step scorers in experiments now save their step scores. (#30145)

• The execute_command tool description now tells agents that timeout stops a background command after that many seconds, so they leave it out for dev servers and other commands that should keep running. (#29000)

• Export AgentStreamBus, createRunAbortController, and the RunAbortController type from @mastra/core/agent/durable for shared stream-bus and caller-cancellation setup. (#29635)

• Fixed observers of a plain Agent run (agent.observe(), reconnecting clients) receiving sub-agent progress chunks and the run's error chunks timed by when they were published instead of when they were produced, which could make thread history show an already stored part again. (#29997)

• Mastra.shutdown() now hands back the agent thread runs this instance still holds, instead of leaving their thread leases behind. (#29794)

  Also in: @mastra/deployer@1.83.0

• Fixed durable agents replacing completed background task results with running placeholders when another tool finishes later. (#29307)

• Fixed Azure OpenAI requests failing with Invalid schema for function when strict mode is on. (#29953)

• Fixed the replay cache of DurableAgent and EventedAgent runs storing a sub-agent's full prompt, message history and steps on every chunk it forwards during delegation. (#29151)

• Fixed replies to stored tool questions after a server restart. (#30132)

  Also in: @mastra/server@1.83.0

• Reduced memory use and garbage-collection pauses for thread subscribers on storage adapters that can read a run's status on its own, such as Postgres. (#30175)

• Workflow runs with the experimental storageVersion option now keep the version they were stored with: resuming a run after changing the option continues it in that version instead of throwing. (#28708)

• Fixed agent.stream() skipping onFinish when an output processor blocks the stream with a tripwire. (#29470)

• Fixed durable, evented, and Inngest agents rejecting strict-mode (OpenAI / Azure OpenAI) structured output when the model answers optional fields with null. (#30136)

• A durable sub-agent's run-log index is not copied onto the parent agent's stream, where it would read as a position in the parent's run. (#29520)

• Fixed client tool results being saved as a second copy of the tool call. (#29440)

• Fixed structured output on Claude models before 4.6, such as claude-sonnet-4-5 and claude-haiku-4-5, failing when the conversation ends on an assistant message. (#29414)

• Fixed the execute_command truncation notice so it says which lines were dropped. (#29413)

• Fixed agent sessions never emitting message_end for the assistant message when a turn ends in a tool suspension, for example ask_user. (#29463)

• Durable and evented agents now save the turn when a total timeout (modelSettings.timeout.totalMs) ends the run. (#29036)

• Fixed channel tool approvals being ignored after AgentChannels is rebuilt or the bot restarts. (#29618)

• Fixed a failed workspace filesystem resolver call being cached for the rest of the request. (#29480)

• Improved how a plain Agent stores its run stream. (#29971)

• Durable agent runs that finish on another worker now record their real span outcome (success, limit/max_steps, guardrail with its processor id, delegation failure) instead of unknown. (#29261)

@mastra/ai-sdk@1.12.0

Patch Changes

• Preserve optional tool titles in AI SDK v6 and v7 tool-input stream events so clients can display human-readable tool names. (#30125)

@mastra/auth@1.2.0

Minor Changes

• Added jwksUri and issuer options to MastraJwtAuth, so it can verify tokens signed by an identity provider instead of only tokens signed with a shared secret. The issuer is advertised to MCP clients by the built-in MCP server, and tokens are checked against server.mcp.oauth.resource when it is set. (#29930)

Patch Changes

• The authenticated user now has id set to the token's sub claim when the token has no id claim. (#29930)

  Also in: @mastra/auth-auth0@1.3.0, @mastra/auth-clerk@1.4.0

• Added toMastraUser() support: the JWT auth provider normalizes the token payload through its mapUser option (or the default mapping), so dynamic agent configuration callbacks receive the mapped user as the user argument. (#28612)

@mastra/auth-auth0@1.3.0

Minor Changes

• The built-in MCP server now advertises your Auth0 tenant to MCP clients for sign-in, and rejects tokens whose audience does not include server.mcp.oauth.resource when it is set. (#29930)

@mastra/auth-better-auth@1.1.11

Patch Changes

• Updated better-auth to ^1.7.15. (#29052)

• Added user support for dynamic agent configuration callbacks: the provider now implements toMastraUser() so callbacks receive a correctly mapped user argument (id, name, email, avatar, and role where available). (#28612)

  Also in: @mastra/auth-cloud@1.2.9, @mastra/auth-supabase@1.2.0

@mastra/auth-clerk@1.4.0

Minor Changes

• The built-in MCP server now advertises your identity provider as the authorization server to MCP clients, so they can discover where to sign in. (#29930)

  Also in: @mastra/auth-okta@0.3.0, @mastra/auth-supabase@1.2.0

@mastra/auth-neon@0.3.6

Patch Changes

• Added user support for dynamic agent configuration callbacks: the provider now implements toMastraUser() so callbacks receive a correctly mapped user argument (id, name, email and avatar). (#28612)

• Fixed @mastra/auth-neon so it works with hosted Neon Auth projects. (#29633)

@mastra/auth-studio@1.4.0

Minor Changes

• Added fetchAsRequestUser(request, path, init) to MastraAuthStudio. It calls the Mastra platform API as the signed-in user of an incoming request, so your server can act on the organization that user's session is on without its own platform token. It resolves to null when the request has no Mastra session, and gives up after 15 seconds unless you pass your own signal. (#29183)

Patch Changes

• Fixed sign-outs and extra platform calls when a page sends several requests at once. (#29434)

@mastra/clickhouse@1.30.0

Minor Changes

• Sort span queries by model or provider in ascending or descending order. (#30096)

  Also in: @mastra/duckdb@1.19.0, @mastra/pg@1.36.0

• Fixed anonymous feedback appearing to come from the trace user when its author is explicitly null. (#29289)

• Support full feedback replacement and protected creates: (#30059)

  Also in: @mastra/duckdb@1.19.0, @mastra/pg@1.36.0

@mastra/client-js@1.60.0

Minor Changes

• Keep generated feedback/score IDs and timestamps stable across retries, expose optional response identity data, and preserve the caller's context mode selection or omission. Add bounded, cancellable retries for recognized missing-anchor responses and a full-replacement Platform feedback method. (#29289)

• Added getBuiltinMcpServer() to read how the built-in MCP server is set up. (#29932)

• Added typed single-record reads: (#29529)

• Added text-search request types and capability flags for Platform integration. (#29897)

• Allow querySpans() to sort by model or provider. (#30096)

• Required traceId in the request types for createFeedback() and createScore(). Callers that previously omitted the trace ID must now supply it. spanId remains optional, and response types are unchanged. (#29287)

• Added a review status filter to the experiment results list. Pass status to get only the results with that review status. (#29291)

  Also in: @mastra/server@1.83.0

• Support OSS feedback replacement requests and the feedbackReplacement capability. (#30059)

Patch Changes

• Added the route type for the built-in MCP server endpoint (ALL /mcp) to the generated route types. (#29929)

• Fixed agent.generate() and agent.stream() in the client SDK rejecting a plain-object requestContext at the type level. (#29577)

• Fixed agent.generate() and agent.generateLegacy() running only the first client tool when the model called several in one step. (#29407)

• The generated route types for scores now include the SCORER and PROCESSOR entity types, matching the entity types experiments can emit. (#30145)

• Fixed the types of agent.generateLegacy() results. (#29605)

• Fixed streamed client tool continuations to use the current tool result format. (#29384)

• Fixed deleteTraces, deleteScores, and deleteFeedback return types to include { accepted: true } from supporting Platform backends. (#30051)

• Align stored-agent durable configuration with resumable streams: accept a boolean or { cleanupTimeoutMs } and reject checkpoint execution options such as maxSteps with guidance to use createDurableAgent. (#29503)

  Also in: @mastra/editor@0.17.1, @mastra/server@1.83.0

@mastra/code-sdk@1.19.0

Minor Changes

• Added @mastra/code-sdk/voice/transcribe, which transcribes audio with any model in the speech-to-text registry, including Mistral Voxtral (voxtral-mini-latest), and gives up after one minute if the provider doesn't answer. OPENAI_ORG_ID and OPENAI_PROJECT_ID apply only when the key is the OPENAI_API_KEY env key. (#29363)

• Added a textExtensions option to SandboxFilesystem, so agents working in a remote sandbox can make grep search file types it skips by default. It works like the LocalFilesystem option: values extend the built-in set and are normalized, so 'sas', '.sas' and '.SAS' are equivalent. Fixes #28365. (#29417)

• Added a plansDir option to createMastraCode and prepareAgentControllerMount that sets where agents write plan files. When set, the prompts, the plan-mode write guard, and build-mode submit_plan guidance all use it instead of the per-session default. (#29132)

  Also in: @mastra/factory@0.28.0

• Added MASTRACODE_AGENT_STREAMS=off to run the code agent without publishing its runs on a resumable stream. Set it to compare a Factory deployment with agent streams on and off without a code change. Any value other than on, off, or unset fails at startup. (#30020)

• Added mouseDialogs and mouseInput preferences to global settings (GlobalSettings.preferences). Both default to false and control whether the Mastra Code TUI uses the mouse in dialogs and slash suggestions, and in the input box while you type. (#29701)

• Speech-to-text registry entries can now name a realtimeModel for live transcription. Mistral Voxtral sets it; other providers leave it undefined and stay on recorded clips. (#29573)

Patch Changes

• Improved the errors agent_signal_send and agent_connect return for a peer id that no saved peer has. (#29840)

• Improved responsiveness of sessions that load instruction files from a base branch, as on an untrusted pull request checkout. (#29551)

• Faster Factory project listing in the TUI. (#29322)

• Added the planApprovalStartsGoal option to createMastraCode(). (#28037)

• Build and plan modes now default to openai/gpt-5.6-sol instead of openai/gpt-5.5. (#29940)

• Fixed web search and web extract results that could contain a broken character after being shortened. (#29473)

• mastra/... models now run on the Mastra Gateway key stored with a Factory tenant's model credentials, and fall back to the server-wide MASTRA_GATEWAY_API_KEY only when the tenant has none, so an organization with its own key pays from its own Mastra account. (#29183)

• Reduced Mastra Code memory use when observational memory is on. (#29464)

• Mastra Code now runs on AI SDK v7. (#28738)

• Expand ~ in browser profile, executable, and storage-state paths using the operating system home directory, including paths already saved in settings, so these paths also work on Windows. (#30125)

• Fixed the plan-mode write guard so it actually runs. (#29132)

• Added AuthStorage.removeStoredApiKey(provider), the counterpart of setStoredApiKey(). (#29432)

• Sandbox file tools now explain why a read fails when the agent passes an absolute path outside the workspace, such as /tmp/x/file.ts. (#29821)

• Raised the @mastra/core peer dependency floor to 1.83.0 to match the @mastra/pg and @mastra/libsql versions it depends on. (#28299)

• Fire the SessionStart hook again when a session binds a different thread, with source: 'thread_change' (the boot event now carries source: 'startup'). (#30223)

• Fixed long requests ending the run as a "persistent outage" when the provider cut the response stream after accepting the request. (#29462)

• Fixed schedule summaries breaking across lines when a schedule's prompt or extra prompt contains line breaks. (#30108)

• Now requires @mastra/core 1.82.0 or later, matching the minimum required by @mastra/mcp. (#29331)

  Also in: @mastra/connect@1.4.0

@mastra/connect@1.4.0

Minor Changes

• Added codeMode() to the tools() resolver so agents can use connected tools through Code Mode. The agent writes one TypeScript program that calls the connected tools as functions, instead of calling each tool in its own step. This helps with tasks that fan out across many calls or providers. (#29583)

Patch Changes

• Fixed the Excel delete workbook tool failing with a "resource locked" error after the agent edited the workbook. (#30065)

• Fixed fireflies_get_transcript failing with a validation error on most real Fireflies transcripts. (#29538)

• Require @mastra/core >=1.83.0-0 <2.0.0-0 when installing MCP or Connect to avoid imports missing from core 1.82. (#30125)

  Also in: @mastra/mcp@2.9.0

@mastra/convex@1.9.0

Patch Changes

• Fixed resumed streams skipping events when using ConvexServerCache. (#29784)

• Fixed ConvexServerCache.get() returning null for counter keys. (#29847)

@mastra/deployer@1.83.0

Patch Changes

• Fixed mastra dev and mastra build failing under a loader such as tsx (for example NODE_OPTIONS="--import tsx" mastra dev) in projects whose package.json has no "type": "module". (#29329)

• Fixed mastra build installing optional peer dependencies that your project does not use. (#29929)

• Fixed mastra build and mastra dev on Windows writing deep imports such as lodash/fp/get with backslashes, which made the server fail at startup with ERR_INVALID_MODULE_SPECIFIER. (#29578)

• Fixed mastra build on Windows failing with We couldn't load "pnpapi" when the project sets a deployer such as CloudflareDeployer. (#29578)

  Also in: @mastra/deployer-cloudflare@1.2.42

• Raised the @mastra/core peer dependency floor to 1.83.0. (#28612)

  Also in: @mastra/deployer-cloud@1.83.0, @mastra/deployer-cloudflare@1.2.42, @mastra/deployer-netlify@1.2.42, @mastra/deployer-sandbox@0.3.27, @mastra/deployer-vercel@1.2.42, @mastra/temporal@0.6.0

• Fixed mastra build for projects with file-based agents. (#30003)

• Improved mastra build speed. (#29454)

• Fixed mastra build needing registry credentials to install the build output in pnpm monorepos where the Mastra app is not at the workspace root. (#29330)

• Fixed mastra build installing the wrong version of a package when a pnpm override is scoped to your Mastra app, such as '@my/app>@mastra/core': 1.82.0 next to a repo-wide '@mastra/core': 1.67.0. (#29350)

• Reduced the memory mastra build and mastra dev use to read the deployer, bundler and server options from the Mastra config. (#29558)

@mastra/deployer-cloud@1.83.0

Patch Changes

• The generated cloud auth entrypoint now reads PLAYGROUND_JWT_TOKEN and BUSINESS_JWT_TOKEN when the server starts instead of copying their values into the build output. (#29405)

@mastra/deployer-cloudflare@1.2.42

Patch Changes

• Fixed Cloudflare Workers builds for projects with file-based agents. (#30003)

@mastra/discord@1.3.4

Patch Changes

• Security (#30205)

@mastra/docker@0.14.0

Minor Changes

• Add Docker Cloud Sandboxes microVM support through DockerSandboxesSandbox, alongside the existing container-based DockerSandbox. Supports reconnection, streamed commands, cancellation, timeouts, and file operations. (#29356)

• DockerFactorySandbox keeps a Factory's Build environment variables out of the image and its template identity. Docker template builds don't receive them yet; they reach setup commands only when Factory runs setup itself. (#29923)

@mastra/dsql@1.5.7

Patch Changes

• Discard PostgreSQL pool connections when starting or rolling back a transaction fails, preventing an unknown transaction state from leaking into the next checkout. (#30144)

  Also in: @mastra/pg@1.36.0

• Await asynchronous rollback diagnostics so reporter failures cannot escape transaction cleanup or mask the original transaction error. (#30157)

  Also in: @mastra/pg@1.36.0

@mastra/duckdb@1.19.0

Minor Changes

• Preserve an explicit null feedback author in single and batch writes without substituting the span user. (#29289)

• Added persistenceLocation: 'local' to DuckDB observability storage, including its lazy facade and direct implementation. (#29737)

Patch Changes

• Improved list speed on large DuckDB databases. (#29523)

• Improved span and thread list speed on large DuckDB databases. (#29548)

@mastra/dynamodb@1.5.1

Patch Changes

• Mark thread listing as in-memory paginated so limited controller queries read and sort the resource once instead of repeating full reads. (#30090)

@mastra/e2b@0.17.0

Minor Changes

• Added a buildEnvRevision option to createRepoTemplate(). When it's set, the template name uses the revision instead of a hash of the buildEnv values, so secrets stay out of a name anyone listing templates can see. Change the revision whenever the values change to build a new template. Without a revision, buildEnv works as before. E2BFactorySandbox passes buildEnv and buildEnvRevision from the sandbox context through to it. (#29923)

@mastra/editor@0.17.1

Patch Changes

• Preserve the existing stored-agent registration when hydrating a different draft, status, or version of an agent. (#29966)

• Fixed stored agents loaded by several requests at the same time sometimes being treated as code-defined agents. (#29927)

  Also in: @mastra/hono@1.7.25, @mastra/server@1.83.0

@mastra/elysia@0.1.23

Patch Changes

• Fixed the route abort signal never firing when the client disconnected while earlier middleware or hooks (such as async auth) were still running. (#29669)

  Also in: @mastra/express@1.5.27, @mastra/fastify@1.5.27, @mastra/koa@1.7.27, @mastra/nestjs@0.3.0

• Fixed streaming routes that kept reading the response stream after the client disconnected. (#29669)

  Also in: @mastra/fastify@1.5.27, @mastra/koa@1.7.27, @mastra/nestjs@0.3.0

• Fixed server.mcpOptions from your Mastra config being ignored when you don't pass mcpOptions to the adapter (or to MastraModule.register in NestJS). (#29928)

  Also in: @mastra/express@1.5.27, @mastra/fastify@1.5.27, @mastra/koa@1.7.27, @mastra/nestjs@0.3.0

• Fixed auth checks for custom API routes so they always follow the route that actually handles the request. (#29325)

  Also in: @mastra/express@1.5.27, @mastra/fastify@1.5.27, @mastra/hono@1.7.25, @mastra/koa@1.7.27, @mastra/server@1.83.0

• MCP servers mounted on Express, Fastify, Koa, Elysia and NestJS now pass the authenticated caller to MCP tools, like Hono already did. (#29321)

  Also in: @mastra/express@1.5.27, @mastra/fastify@1.5.27, @mastra/koa@1.7.27, @mastra/nestjs@0.3.0

• Fixed two Elysia server problems on Node (@elysiajs/node) (#29667): (#29944)

• Raised the @mastra/core peer dependency floor to 1.83.0 to match @mastra/server, which now requires @mastra/core 1.83.0 or later. (#28612)

  Also in: @mastra/express@1.5.27, @mastra/fastify@1.5.27, @mastra/hono@1.7.25, @mastra/koa@1.7.27, @mastra/nestjs@0.3.0, @mastra/next@0.2.41, @mastra/tanstack-start@0.2.41

@mastra/express@1.5.27

Patch Changes

• Streaming routes now stop reading the response stream when the client disconnects, matching the Hono and Fastify adapters. (#29636)

• Streaming routes now wait for a slow client to catch up instead of buffering the whole stream in memory. (#29669)

@mastra/factory@0.28.0

Minor Changes

• The board now decides what Factory does on its own. The project-wide Auto-start runs and Self-review before pull requests switches are gone: a phase starts its runs without approval when it has autoStart (optionally autoStartWhen), and a card is self-reviewed when its board has a self-review phase. (#29756)

• A board phase now does exactly what its stored fields say, so an admin who edits a phase changes what actually runs. Entering a working phase starts its runner.skill in the runner.context session, with its instructions, for every card source. Code handlers no longer start work in the background. (#29707)

• Added filters to the work-item list route for finding cards without listing the whole board. (#30081)

• Intake routes can now move existing cards on pull request events. A route's on list accepts pull_request.opened, pull_request.synchronized (a push), pull_request.review_requested, pull_request.merged and pull_request.closed, so a board decides where a card goes when its pull request is pushed, merged or closed. (#29711)

• Each project's boards now live in its database, and admins can edit them. Factory stores the built-in Work board and every board passed to MastraFactory({ boards }) in a project once: when the project is created, and in existing projects the first time Factory loads them (including at startup). Factory then serves the stored board, so what you see in the database is the board that runs. Work and app boards keep their code behaviour, so edits can't break the work their code runs. (#29317)

• Added voice input to the Factory composer. Click the mic to dictate: the clip is transcribed server-side and the text is appended to your draft. Until a speech-to-text key is set up, the mic opens the voice input settings instead of recording. (#29366)

• Added creating, editing and deleting boards in the Factory UI. Organization admins get New board in the sidebar's Boards section and in Settings → Boards (formerly "Work board"), and Edit board on every board. (#29895)

• Factory sessions can now use your Mastra Connect tools. With Platform credentials and MASTRA_PROJECT_ID, which Platform deploys already have, sessions in web chat, Slack and on work items get the tools of every connection attached to your Platform project. Attach Linear on the project's Connect page in Mastra Platform, and a Slack thread can ask about its issues. Settings → Tools shows which connections sessions get. (#28756)

• Added board events to intake routes. You can now decide what happens to an existing card when its issue closes or reopens, and the session working a card now hears about new comments and edits. (#29353)

• Factory pages load faster. The project list now returns each project's linked repositories, so the web UI makes one request before it renders instead of one more per project, and the repositories are read in a fixed handful of database queries however many projects there are. (#29322)

• Removed comments from Factory work items. Cards no longer have a comment feed, mentions, or comment counts, and the mention and activity items are gone from the attention inbox. Slack aside messages are still ignored by the agent but are no longer copied onto the card, and Factory no longer mirrors card comments to Slack. (#29062)

  Also in: @mastra/playground-ui@69.0.0

• Intake routes now decide where every new card lands. Label routes and a source binding's board are gone, and Work stays the default board through an editable route instead of a hardcoded fallback. (#29754)

• Added Slack tools for Factory sessions started from Slack. A session can read channels and threads, post messages, search recent messages, and find channels and people by name. The tools act as the Slack app, and posting needs no approval, so they also work on runs nobody is watching. (#29293)

• Slack voice clips now reach the agent as text. When someone records a voice clip in Slack and sends it to a Factory session (tagging the bot, in a DM, or in a thread the bot is already in), Factory transcribes it and the transcript becomes the message, so the agent answers it like a typed message. Uploaded audio files stay attachments, as before. The thread's Factory decides whose model and key apply: a Factory with the factory model scope uses its own voice model from Settings → Models → Voice input and the organization's key; any other scope, or a thread with no Factory session, uses the sender's own voice model and personal key, never the organization's. If the clip can't be transcribed (no key, too long, can't be downloaded, timed out, provider error), the clip is dropped from the message and the sender gets a card only they can see, with the reason and, for a missing, rejected or out-of-credit key, an Open voice settings button. A message left with nothing but mentions doesn't start a run. (#29372)

• Added one-click Mastra Gateway setup to Factory. When Factory signs users in with their Mastra account, onboarding, factory creation, and Settings > Models offer Mastra Gateway first. One click creates a gateway key on the user's Mastra organization and stores it with their model credentials, so Mastra Gateway models run on the organization's Mastra credits without provider keys. (#29183)

• The board catalog now lists, per board, the phase that plays each part of the pull request loop under flow (triage, build, selfReview, pullRequestReview, completed, canceled). The Factory board reads these, so a custom board with a pull request loop offers the same Investigate, Plan, Build and Review moves and triage decisions as Work, under its own phase names. A board that doesn't build no longer treats its first working phase as triage. (#29712)

• Added a sessionId filter to the work-item list route. GET /web/factory/projects/:id/work-items?sessionId=<id> returns only the cards holding that session and the cards related to them (a card's parent and children, and a pull request with the card whose session branch it was pushed from). The response has the same shape as the full list. Repeat sessionId to list several sessions' cards in one request. (#30080)

• Factory agents can now browse Linear. linear_list_projects lists the connected workspace's projects and teams (optionally filtered by name), and linear_list_issues lists the open issues in one of them, with label filtering and pagination. Agents can now read the tickets in a project from its name or URL instead of needing each issue identifier. (#29435)

• Added a workItemId filter to the work-item list route for reading cards by id without listing the whole board. (#30154)

• A pull request or merge request for an issue that is already on the Work board now joins that issue's card instead of opening a second card. New projects no longer get the built-in Review board; Work's PR review phase does its job. (#29346)

• Added a scope=sessions filter to the work-item list route. GET /web/factory/projects/:id/work-items?scope=sessions returns only the cards holding a session and the cards related to them (a card's parent and children, and a pull request with the card whose session branch it was pushed from). The response has the same shape as the full list. scope cannot be combined with sessionId. (#30087)

• Factory now keeps one status comment on a GitHub pull request while it reviews it, the way review bots do. The comment says the review is queued, switches to an animated "Reviewing…" display (an ASCII factory puffing smoke, in light and dark variants that follow the reader's GitHub theme) once the run has really started, and is edited in place when the run ends. The final version shows the result: approved, changes requested, failed or cancelled. A small footer links the commit and says how long the run took. The commit is called reviewed only when the run recorded a verdict for it; otherwise the footer names the head the run started on. Anything Factory did not measure is left out. Formal reviews and inline comments are not affected. (#29597)

• Any board can now run the pull request loop. Factory finds each part of the loop from what a board's phases declare instead of from Work's phase names: the review phase that grants factory_review_source reviews pull requests, a review phase that only grants factory_record_review_verdict self-reviews the builder's branch, and the working phase that moves into it builds. Pull requests attach to cards on any such board, verdicts record there, and the Factory skills read the phase names from the card's own board. (#29710)

• The default Work board no longer has a self-review phase. New projects get Intake, Triage, Planning, Building, Review and Done (plus Canceled): Building opens the change request itself and moves the card to Review, where the pull request is reviewed. Review keeps the key pr-review. (#29724)

• Intake routes can move cards into any phase. A route that handles a status event (a close, a reopen, a pull request push or review request) now moves the card to its target phase even when that phase is a working phase such as Triage. One limit stays: on a board with a pull request loop, a pull request card enters only the review phase among working phases. (#29884)

• Composer dictation with Mistral streams: words appear in the draft while you speak. Other speech-to-text providers, and a working Mistral key that can't start a live session, record a clip and transcribe it when you stop; a rejected or out-of-credit Mistral key fails before the microphone opens. Send waits until dictation finishes, so a message never goes out half-transcribed. (#29573)

• A card's sandbox now stops as soon as the card is done with that context, instead of idling until the provider times it out. (#29981)

• Removed the source_control_publish_test_check session tool and the per-project reviewTestChecksEnabled setting that gated it. Factory's review skills now report test results only in their ## Factory test report comment. An app that wants a commit check passes its own tool through tools and builds it on the new factory.reviewedChangeRequest(requestContext). That returns the change request a Review run reviews (provider, repository, number, current head and branch), or undefined outside a Review run. Its publishCommitCheck() refuses a head that moved, a closed change request, and a provider that cannot publish commit checks. (#29888)

• Added two read routes that answer what the new session page shows without sending a project's cards. (#30097)

• Added Factory-wide sandbox environment variables. Open Settings › Manage Factory › Environment variables to add a variable and choose where it applies: (#29923)

• New projects' Work board has no Triage phase: a project created now gets Intake → Planning → Building → Review → Done/Canceled. Existing projects keep the Work board they stored, Triage included, and a project created on an older release that stores its boards only now gets Work with Triage too. No migration adds or removes Triage. Add Triage in Settings › Work board if you want it; resetting Factory's Work restores Factory's built-in Work, with Triage if Factory first stored the project's Work with it (an app's Work resets to the app's, see below). (#29901)

Patch Changes

• Blocked notices for a session parked on submit_plan now include its toolCallId, and factory_answer_approval can approve or decline that plan, so a follower no longer has to move the card by hand. (#29869)

• Fixed two board automation gaps. (#29317)

• The board listing no longer re-sends every card on each refresh. (#30014)

• Improved how an open Factory board stays up to date. (#30099)

• Stop GitHub, GitLab, Linear, Jira and incident.io events from freezing the Factory server on large boards. (#29991)

• Fixed environment templates that could stop rebuilding for good. (#30148)

• Provider connections now live where they are used, so connecting no longer sends you to another page. (#29632)

• Added annotations to Studio and Factory chat, so you can point the agent at parts of a reply and comment on them. (#29310)

• Factory review, re-review, test report, triage, and self-review comments are now shorter and lead with what matters. (#29880)

• Factory no longer waits for done and canceled cards to be copied to the new card tables before it starts serving. (#29494)

• Factory now switches a bound session onto its card's thread as the session owner. (#30179)

• Fixed the work item audit trail for custom-board phases. (#29481)

• Factory sessions and MCP clients can now read the Factory's audit trail with factory_list_audit_events: who did what to which work item, run, branch or setting, and when. (#30165)

• Fixed board cards showing old labels, state or titles for up to a minute after an issue or pull request changed without its card moving. (#30042)

• Open boards stay fast on large projects. (#30041)

• Factory servers no longer wait for a pass over every active run binding before they finish booting. (#30025)

• Fixed a type error in the environment build schedule view after schedules gained one-off runs without a cron expression. (#30098)

• The encryption key banner now reads as the config fix it is: "Factory needs its encryption key. (#29828)

• Factory starts serving sooner on projects with many open decisions. (#29450)

• Factory now explains why integrations and provider credentials are unavailable when its stored secrets can't be decrypted. (#29644)

• Improved Factory response times: (#29519)

• Documented how to run focused tests for @mastra/factory in the package README. (#29866)

• GitHub status (/web/github/status) now returns reason: 'personal_install_hidden' when Mastra Platform withholds a GitHub App installed on a personal account from an organization with more than one member, instead of not_connected. (#30173)

• Fixed a GitLab merge request reviewer being refused when it published test checks: the reviewer is now bound to the merge request's number instead of digits read from its encoded id. (#29346)

• Record a retryable run_incomplete failure when a Factory working-phase runner ends cleanly before the card progresses. (#30101)

• Fixed Factory pages slowing down while several boards show a repository's open GitHub issues, as Work Intake and triage do. (#29421)

• Fixed Factory rule notifications waking an idle work-item session with no signed-in user. (#29872)

• Fixed 403 errors in the file and changes panels when an org member opens a session someone else shared with the org. (#29793)

• Sessions in environments with several repositories now sync the other repositories side by side instead of one after another, so a session starts in roughly the time of its slowest repository rather than the sum of all of them. (#30029)

• A Factory run parked on a tool prompt (a plan to review, a question to answer) now reads as waiting instead of running: session state reports it as parked, the board card shows it as waiting, and factory_list_attention lists it under waiting right away instead of it only surfacing when the run is flagged overdue hours later. (#29873)

• Factory agents are no longer told that approving a plan starts a goal. (#28037)

• Factory now links a pull request to the Work card it came from by the card's own branch name, even when no session on the card checked that branch out. (#29865)

• Fixed gh and git push failing with 401 errors partway through long Factory sessions. (#29824)

• Fixed boards under the key review being refused. (#29903)

• Factory PR reviews no longer request changes because of CI status alone. (#29933)

• Documented the exact value source.repository takes for each provider: owner/repo on GitHub (mastra-ai/mastra, not mastra), the full project path on GitLab, the team key on Linear and the project key on Jira, compared case-insensitively. incident.io items have none (test source.provider equals incidentio), and manual cards have no source.* facts (test source.kind not_exists). (#29982)

• Factory can now report the Mastra package versions it was built with. (#29647)

• Factory opens faster. (#29434)

• Thread pages load faster: they no longer download the code editor bundle up front. (#29554)

• Sessions that start at the same time now share one GitHub token mint per repository instead of each minting their own, so busy projects stop hitting the Platform's per-installation mint rate limit and skipping repository syncs. (#30032)

• Factory sessions can now read CI results on GitHub. (#29338)

• Honor explicit board-defined Planning routes for triaged items regardless of author trust, and return approval-labeled cards left in Triage to Intake without removing their approval label. (#30100)

• Factory triage comments on Linear issues now render correctly. (#29941)

• Added a "Join the issue's card instead" switch to intake routes in the Factory UI. (#30197)

• factory_update_work_item no longer claims it can pre-approve a card's plans. (#29857)

• Fixed the Factory board briefly failing with "Board item … has no work item …" when someone deleted a card while the board was refreshing. (#29565)

• Fixed build-on-push for Factories connected to GitHub through Mastra Platform. (#30135)

• Reduced database reads on every agent step for work sessions started from the board. (#29992)

• Improved run lookup speed for sessions without a factory project ID. (#29594)

• Fixed GitHub repository access after the GitHub App was reinstalled more than once. (#29472)

• Factories with more than ten repositories no longer hit GitHub's token rate limit when sessions start or environments build. (#30093)

• Stop an idle Factory from querying its database every second. (#29228)

• Fixed a Factory session staying marked as running on other people's boards after it switched to another thread, started a new one or deleted its thread in the middle of a run. (#30077)

• Fixed the Jira issue detail endpoint so it only returns issues from the project named in the issue reference. (#29326)

• Factory now tells open boards when something changes, so they no longer have to poll for it. (#29777)

• Fixed the platform Linear connection check reading the workspace list twice. (#29874)

• Fixed the Linear issue tool telling agents that every issue links under one workspace when an org connects several Linear workspaces. (#29863)

• Factory chat no longer re-renders on every status update that changes nothing. (#29596)

• Fixed removing a saved API key in local mode. (#29432)

• Factory chats now show how a tool call failed and what it reported: (#29314)

• Cards filed by hand now get a #number, so agents and the board can refer to them like issue cards. (#29871)

• Merged pull request announcements in chat threads now use a randomly chosen celebratory message (for example "🎉 Merged! is officially in.") instead of the plain "Pull request merged: ". (#29340)

• Work Intake settings now respond at once. (#29630)

• Factory build and self-review runs now link Linear source issues in the change request with one Fixes <ID> line per issue, such as Fixes ENG-123, so the GitHub and Linear sync closes them on merge. (#30112)

• Factory board cards, search results, pickers, and chat details show metadata as separate fields instead of joining them with · or — separators. (#29312)

• When someone without a connected account mentions the Factory agent in a Slack channel, the agent now replies in the thread, mentions them, and links to account setup. (#29623)

• Acknowledge running-session model switches immediately and apply the new default in the background without letting slow or failed session gateways block other sessions or newer defaults. (#29979)

• Fixed cards stuck in Self-review after the pull request opened. (#29763)

• Factory now wakes the builder when its own reviewer asks for changes in a COMMENTED review. (#29765)

• Fixed three problems found running a stored board without approval gates: (#29744)

• Checking whether a project still uses its retired Review board now reads Review cards a page at a time and stops at the first open one, instead of loading every Review row on each card read or write. (#30037)

• Updated Factory's browser tab icon and session status icons to a rounded tile, matching the rounded corners used across the rest of the UI. (#30040)

• Factory self-review now checks the branch against the work item's stated problem. (#29859)

• Fixed the active-runs list failing with invalid input syntax for type uuid whenever a teammate's private session had a run in progress. (#30010)

• Fixed Slack progress statuses that Slack rejected for being too long. (#30082)

• Factory sessions bound to a card no longer read every card on the board on each model step to find the card's parent and children. (#30034)

• Fixed slow GitHub board loads in Factory. (#29995)

• Fixed Linear workspace recovery in Factory. (#29399)

• Documented that the built-in Work and Review boards no longer declare a transition policy. (#29860)

@mastra/fastembed@1.3.7

Patch Changes

• FastEmbed models now declare their 512-token input window, so semantic recall splits long messages into chunks that fit it instead of embedding only the first 512 tokens. (#29826)

@mastra/hono@1.7.25

Patch Changes

• Fixed streaming routes that kept the response stream open when the client disconnected before the route handler returned. (#29669)

• Fixed server.mcpOptions from your Mastra config being ignored when you create the Hono adapter yourself (new MastraServer({ app, mastra })) without passing mcpOptions. (#29928)

• Fixed MCP requests to a Hono server occasionally failing with 400 Parse error: Invalid JSON on Node.js 22, most often on the first request after the server starts. (#29929)

@mastra/inngest@1.11.2

Patch Changes

• Fixed scores from createInngestAgent agents so they show on the agent run in a trace. (#30016)

• Fixed Inngest durable agents returning the original model text after an output processor rewrote or emptied the final reply. (#29849)

• Fixed custom stopWhen conditions on Inngest agents receiving tool results in Mastra's internal shape. (#29426)

• Inngest agent runs that finish on another connect worker now record their real span outcome (success, limit/max_steps, guardrail details) instead of unknown. (#29261)

• Fixed sub-agents that stopped streaming after an Inngest durable agent run was resumed with a requestContext and closeOnSuspend. (#29616)

• The Inngest durable agent's run stream events now send only the response messages that changed since the previous step, instead of the whole list on every step, so long runs keep their stream logs small. (#29976)

• Fixed observe(runId).fullStream on agents created with createInngestAgent. (#29917)

• Fixed resumed Inngest workflows and durable agents keeping the user who started the run. (#28612)

• Support span-local error counts in Inngest workflows. (#30088)

• Inngest durable agents now stop steps running on other workers when modelSettings.timeout.totalMs expires. (#29002)

• Fixed tool approvals on Inngest agents running a tool more than once, or running a tool nobody approved. (#29451)

• Fixed Inngest durable agents dropping chunks that output processors write with writer.custom() in processOutputResult. (#29286)

• Preserve existing stream replay and cancellation behavior for Inngest agents, including agents configured with a custom replay cache. (#29635)

@mastra/lance@1.6.1

Patch Changes

• Fixed SQL injection in LanceStorage key lookups. (#29404)

@mastra/libsql@1.30.0

Minor Changes

• Added support for the experimental workflow storageVersion: 2 option. Runs of workflows that set it are stored as a run header plus one row per step, and each write saves only what changed instead of rewriting the whole run: the steps that changed, the progress of a running foreach, and the changes to the workflow state. A nested workflow run stores its state as changes to the version of its parent's state it started from, and keeps that state when the parent run is deleted or pruned. This keeps writes small for long-running workflows and loops. Canceling a run from another process sharing the same database stops it before its next step. (#28299)

• Added persistenceLocation to libSQL observability storage. Files, in-memory databases, and embedded replicas report 'local'; HTTP and WebSocket clients report 'remote'. (#29737)

Patch Changes

• Fixed the Studio Traces page failing with stored.trim is not a function on LibSQL storage. (#29357)

• Fixed truncateIndex on LibSQL vector stores leaving the vector index broken, so later inserts failed with "failed to insert shadow row". (#26802)

@mastra/mcp@2.9.0

Minor Changes

• MCP tools now receive the caller that Mastra server auth resolved (user, permissions, roles, resource and organization) in requestContext when the server is mounted on a Mastra server adapter. These values come only from the server, never from the token or headers the client sends. (#29321)

• MCPClient.listTools(), listToolsets() and listToolDefinitions() no longer hand agents the tools an MCP App server marks as app-only (_meta.ui.visibility: ['app']). Those tools are meant to be called by the server's app UI, not by the model, so agents no longer see helpers such as data relays in their tool list, including agents rebuilt with toolsFromDefinitions() from a catalog cached before this change. onServerSettled callbacks receive the same filtered tools. (#29321)

Patch Changes

• Fixed MCP tool calls running twice on the server after a dropped connection (#28415). (#29492)

• Fixed MCPServer rejecting resources/read for URIs built from an advertised resource template. (#29493)

• Fixed MCP clients on 2025 protocol versions, such as the MCP Inspector, failing with "Method not found" against HTTP MCP servers. (#29929)

• Fixed MCPClient.authenticate() hanging after a successful browser sign-in. (#29560)

• listTools() now logs a warning when two server and tool pairs produce the same serverName_toolName key, such as server local with tool x_status and server local_x with tool status. (#29415)

• Fixed tools rebuilt with toolsFromDefinitions() or toolFromDefinition() connecting without the call's requestContext. (#29539)

@mastra/mcp-apps-components@0.1.0

Minor Changes

• The observability app now draws a whole dashboard instead of a single widget, with rows of KPIs, time series, tables and scores. The app applies the dashboard's default date range and filters. (#29645)

• Added an optional onConfigure callback to observabilityWidgetHost. When a host passes it, each widget in the observability widget app shows a settings button. Clicking it hands the host the widget along with the date preset, custom range and filters it is drawn with, so the host can open its own settings dialog for that widget. (#30043)

• Added widget pinning to the dashboard MCP App. Hosts that set mastra.ai/dashboard-pinned-widgets in their host context to the ids of their pinned widgets get a pin button on each widget. Clicking it sends a mastra.ai/dashboard-widget-pin notification with the widget, the dashboard's scope, the date range and filters the user had on (as dashboard defaults), and isPinned, so the host can render the widget on its own as the user saw it. Each button follows the ids the host sends back, so the host and the app stay in sync. (#29443)

• Added createObservabilityDraftSchemas, so tools that save dashboards can build the widget and dashboard schemas from one catalog, and offer a model only the choices they accept. (#29832)

• Added createObservabilityWidgetInputSchema, observabilityWidgetInputSchema and toObservabilityWidget, so a tool that adds one widget to a saved dashboard accepts the same widget a model writes for showObservabilityDashboard, checked and converted the same way. (#29913)

• Dashboards authored in chat now accept the same widgets as the dashboard editor: KPIs that combine values (ratio, difference, max, fallback), read trace, span or score aggregates (for example p95 span duration) and use duration, percent or score formats; line charts of scores; six more chart colors (blue, orange, pink, yellow, red, purple); and optional KPI icon and detail, series color and table empty message. (#30192)

• Added pinning to observabilityWidgetApp. When the chat host supports it, the widget shows a pin button, and the host decides what stays pinned. Hosts built on @mastra/playground-ui can use observabilityWidgetPins from the new @mastra/mcp-apps-components/host entry: (#29557)

• @mastra/mcp-apps-components now ships MCP Apps that use only messages from the MCP Apps spec. The first one is greetingApp, exported from the package root. To use it, register it as an app resource on an MCPServer and write its two tools as regular Mastra tools. The model calls one tool to open the app. The app calls the other, an app-only tool (visibility: ['app']), to get its data. (#29510)

• Added observabilityWidgetApp, an MCP App that draws one observability dashboard widget (KPIs, time series, table or scores) with the same components as Studio. The model opens it with a tool whose result is { widget, datePreset }. The app then reads its data through an app-only queryObservability tool (QUERY_OBSERVABILITY_TOOL) that you write, so you choose which Mastra server it reads from and how it authenticates. (#29557)

• Added @mastra/mcp-apps-components/dashboards, a strict schema for storing dashboard definitions. Unlike core's dashboardDefinitionSchema, it only accepts definitions the dashboard renderer can draw: built-in widget kinds only, each view's options checked against its kind, columns only on table views, and each kind's own checks run at both org and project scope. Every problem is a zod issue with a path. Problems in a view's options point into them, such as rows.0.widgets.1.views.0.options.series.0.value. Problems a kind finds, such as a KPI reading a query its view doesn't have, point at the view, such as rows.0.widgets.1.views.0, and their message says what's wrong. (#29802)

• Added observabilityWidgetHost to @mastra/mcp-apps-components/host, so a host page such as Studio's Metrics page can pass its project, date range and filters down to observability widgets. The widgets read over the host's selection instead of the dashboard's defaults, read again when it changes, and send projectId with every queryObservability call so your server can scope reads to that project. With a projectId, the widgets show at project scope; without one, at org scope. A custom range reads over the same window as the Metrics page, and a pinned widget keeps it. Pinning is optional. (#29736)

Patch Changes

• StatelessWidget now passes the widget definition to pin.onPin, the same way DashboardRenderer does, so a host can save which chart or widget was pinned or unpinned. (#29587)

  Also in: @mastra/playground-ui@69.0.0

• Fixed menus in observability widgets showing with a transparent background. (#29906)

• Replaced the onPin and isPinned props on DashboardRenderer, and the pin prop on StatelessWidget, with a host actions slot. (#30043)

  Also in: @mastra/playground-ui@69.0.0

• Fixed missing TypeScript types for @mastra/mcp-apps-components/host. (#29742)

• Added @mastra/mcp-apps-components, prebuilt MCP Apps that render Mastra UI inside any MCP App host such as Mastra Studio. (#29321)

@mastra/mcp-docs-server@1.3.13

Patch Changes

• Fixed export lookups for installed Mastra packages. (#29328)

@mastra/memory@1.41.1

Patch Changes

• Observational memory now includes the abort's reason when a run is stopped during observation, e.g. (#29723)

• Fixed durable and evented agents writing two or three semantic recall vector rows for every message. (#29826)

• Fixed buffered reflection splitting an observation group when retrieval is on. (#29412)

• Fixed Markdown working memory going stale when observational memory manages it. (#26203)

• Fixed concurrent vNext working memory updates (__experimental_updateWorkingMemoryVNext) from different threads overwriting each other when working memory uses the default resource scope. (#29477)

@mastra/mongodb@1.27.0

Patch Changes

• Break ties in thread-list timestamp ordering by thread ID, and extend the resource-scoped timestamp indexes to support the stable sort. (#30090)

@mastra/nestjs@0.3.0

Minor Changes

• Expose request context to authorization callbacks so applications can establish trusted tenant scope for observability writes and other routes. (#29289)

Patch Changes

• The built-in MCP endpoint now supports OAuth discovery, like the other server adapters. (#29930)

• Added support for the built-in MCP server at /api/mcp in NestJS apps. (#29929)

• Routes run in-process with dispatchRoute now apply your server.auth rules to the paths the NestJS module really serves, including a custom prefix passed to MastraModule.register. (#29928)

• Fixed built-in Mastra routes being reachable without authentication when their path matched server.auth.public. (#29928)

• Fixed the NestJS adapter ignoring per-route body size limits on JSON requests. (#29476)

@mastra/observability@1.24.0

Minor Changes

• Add feedback review-status delivery to storage and Platform exporters. Each supporting destination handles its own update, without depending on local storage. Flush and shutdown wait for pending updates. (#30075)

• Added opt-in byte-based flush thresholds to MastraPlatformExporter and MastraStorageExporter, with configurable export concurrency: (#29621)

• Add feedback replacement delivery through supporting exporters. MastraPlatformExporter sends PUT requests, while storage exporters persist their copies independently. Flush and shutdown drain pending replacements. (#30059)

• Added support for exporting feedback and scores that need trace details from Platform. The exporter retries while waiting for a trace to arrive, and flush() and shutdown() wait for pending deliveries to finish. (#30048)

• Added an explicit opt-in to persist observability data to your own storage alongside Mastra Platform. Built-in storage exporters remain disabled on Platform by default. Local observability domains remain disabled with an initialization warning, even with the opt-in. Set retainStorageExporterOnPlatform: true on an observability config to retain MastraStorageExporter, including exporters registered later. Deprecated DefaultExporter remains disabled on Platform. (#29737)

Patch Changes

• Update bundled model pricing with the latest prices from models.dev (1a078af)

• Fixed span errors exposing data on traces that use tracingOptions.hideInput or tracingOptions.hideOutput. (#29716)

• Fix feedback and score delivery so each exporter handles its own destination. (#30052)

• Fixed model call spans exported with no response. (#29896)

• Fixed MODEL_INFERENCE spans losing responseModel when the model call is recorded from the raw provider stream. (#30007)

• SensitiveDataFilter now redacts the whole value under a sensitive key, including objects and arrays. (#29403)

@mastra/pg@1.36.0

Minor Changes

• Added support for the experimental workflow storageVersion: 2 option. Runs of workflows that set it are stored as a run header plus one row per step, and each write saves only what changed instead of rewriting the whole run: the steps that changed, the progress of a running foreach, and the changes to the workflow state. A nested workflow run stores its state as changes to the version of its parent's state it started from, and keeps that state when the parent run is deleted or pruned. This keeps writes small for long-running workflows and loops. Canceling a run from another process sharing the same database stops it before its next step. (#28299)

Patch Changes

• Fixed index creation for descending columns that use an operator class. (#29594)

• Fixed slow startup when several processes initialize the same Postgres schema for the first time. (#29092)

• Fix scalar element comparisons, nested negation, wildcard escaping, and recursive value bindings in PostgreSQL vector $elemMatch filters. (#30095)

• Apply every nested $elemMatch operator when filtering PostgreSQL vectors, so searches and deletions honor all bounds on the same array element. (#30091)

• listWorkflowRuns no longer runs a separate count query when a page comes back with fewer runs than requested, so a paginated read such as listing an agent's suspended runs takes one query instead of two. (#29553)

• Fixed saveThread so that saving an existing thread id no longer moves the thread to another resource or overwrites its creation date. (#29149)

• Fixed thread metadata updates being lost when several processes share one Postgres database. (#29150)

• Listing and counting threads filtered by metadata is now much faster on large thread tables, because mastra_threads.metadata gets an index by default. (#30086)

@mastra/platform-workspace@1.13.0

Minor Changes

• Added publicPorts to PlatformSandbox. Sandbox ports are private by default and open through a signed-in preview link. Set publicPorts: true to let anyone with a port's URL reach it, for example a webhook receiver: (#28909)

• Added a buildEnvRevision option to createRepoTemplate(). buildEnv values stay out of the template, so changing them alone never rebuilt it. The revision adds a step ahead of the clone and setup steps, so changing it rebuilds them with the new values. PlatformFactorySandbox passes buildEnv and buildEnvRevision from the sandbox context through to it, merging buildEnv over the host's template.buildEnv. (#29923)

@mastra/playground-ui@69.0.0

Minor Changes

• Added closeOnEscape to Sidebar.NavStack.View so a sidebar view that accompanies a full page can stay open when Escape is pressed. The sidebar now also follows a minWidth that changes at runtime: it widens to the new minimum and returns to the user's saved width when the minimum drops, without overwriting that saved width, including when the page first loads with the raised minimum. (#29881)

• Added Metadata and Metadata.Item for compact UI fields. Fields wrap as space narrows; pass singleLine to keep them on one line with truncation in cards, menu options, and titles. Replaced decorative copy separators with structured fields and natural sentences. Added copy lint rules for separators and layout whitespace. (#29312)

• Improved MCP Apps support in Studio: (#29321)

• Replaced ThinkingLevelBars with ThinkingLevelIcon, a single brain filled to the picked level that matches the brains in ThinkingLevelRamp. It turns amber for costly levels, stays empty while no level is set, and pulses with loading. ThinkingLevelPicker and ThinkingLevelUnavailable now show it on their button. (#29853)

• Studio now shows how a sandbox command ended. Before, chat messages never handed a command's streamed output, exit code or workspace link to its tool call, so a command that failed after printing something looked like a success. Now a non-zero exit marks the call failed, on its own row and in its tool group's failure count, next to a chip saying how it ended: exit N, killed, timed out, or error when the sandbox could not run it. Opening it shows what the command printed, followed by its exit code and the full error, even one that spans several paragraphs. While it runs, you can scroll up through its output without it jumping back to the latest line on every update. (#29314)

• Added a series palette for charts that break down by model, provider or key: eleven --chart-series-* hues at one lightness and chroma per theme, plus --chart-series-neutral. seriesColors(items) colors a page's series from it: each lab reserves one hue (Anthropic orange, OpenAI green, Google indigo, Jev pink, DeepSeek blue, xAI neutral, and others), its next two models take shifted shades of that hue (a lab's other models, or every model when the page shows one lab, take hues of their own), and series with no lab take the hues left over. Call it once per page so a model keeps its color on every chart. (#29212)

• Added shared composer pieces: a combined provider and model picker, an attach menu, a status row and grouped action slots. (#29845)

• Dashboard cards can now offer a Create alert button. Pass the new optional alert prop to DashboardRenderer to turn it on. (#29533)

• Improved the Knowledge explorer. The graph now fills the explorer, with the page tree and the selected page's details in panels that slide in over its edges instead of squeezing it. Graph and Page switch with tabs, the graph's controls use the shared button group, and fits, the legend and the zoom controls stay clear of both panels. Narrow screens keep the stacked layout. (#29495)

• Added optional onPin and isPinned props to DashboardRenderer for pinning single widgets. Pass both together: each widget card then shows a pin button named after the widget, such as "Pin Agent runs". isPinned tells the renderer which widgets are pinned, by id, and onPin is called with the widget and the state the user asked for, so your app keeps the pinned widgets. A pinned widget keeps its unpin button in view; an unpinned one shows its pin button on hover. (#29443)

• Added RuleCard and RuleLines, composable parts for rules that read as sentences (Where … and … → Move to …). (#29978)

• Widened what dashboard widgets can show: (#30192)

• Removed callPose from @mastra/playground-ui/domains/chat/activity. Use presentTool(toolName, args).pose so the icon reflects the call's operation, including Knowledge moves, merges and deletions. (#29309)

• Added host feedback options to trace, span, and thread composers so integrations can select context and hide unsupported delete or review actions. (#29528)

• MessageTimestamp now says how long ago a message was sent ("just now", "7 minutes ago", "yesterday") and keeps that label current. Hovering or focusing it shows the full date and time, such as "Nov 3, 2026, 10:24 PM". (#29373)

• Added distinct chat icons for Knowledge, files, terminal, browser, delegation, workflows, schedules, notifications, source control and skills. Running calls animate to show their action. Icons are clearer at small sizes. (#29309)

• Redesigned ThinkingLevelRamp and made the thinking level controls keep their size while the level loads or can't be picked, so a model picker that holds them no longer jumps. (#29845)

• One settings layout for Studio, Factory and Platform, from @mastra/playground-ui/new/settings: (#29400)

• Added @mastra/playground-ui/fonts.css, which loads Mastra's product fonts, Mona Sans for text and Commit Mono for code, and points the font tokens at them. Import it next to the package's other stylesheets instead of bundling font files in each app: (#29915)

• Added two-line sidebar rows and a Sidebar.NavAction button for row actions. (#29937)

• Added StatelessWidget and planWidget so a dashboard widget can be rendered by a host that does its own fetching, such as an MCP App. (#29545)

• Redesigned the calendar and the custom date range picker. Picking a custom range now takes one two-month calendar: click the start day, then the end day, and set each end's time underneath. DateTimePicker uses the same time field instead of hour, minute and AM/PM dropdowns. Selected days are round, and the days in between read as one continuous band. (#29195)

• Added Steps, a numbered vertical rail for setup guides, like the steps in docs. Each Steps.Step takes a title, an optional description and action, and a done flag that swaps its number for a check. Steps number themselves in render order, so they can be rendered conditionally or composed from several components. (#29272)

• Added an inline variant to CodeEditor for editing prose in place: no border, background or gutter, and text lines up with the label above it. (#29978)

• Added in-place renaming for dashboard widget titles. Pass onTitleChange to StatelessWidget (or ChartCard) and plain titles become editable: hover or focus shows a dashed outline, Enter or clicking away saves the trimmed title, and Escape cancels. Titles with a view menu stay read-only; titles of cards that expand stay editable, with the expand link moved to the card's actions. Saving the new title is up to you. (#29751)

• Added chat annotations, so a person can point the agent at parts of the transcript and comment on them. (#29310)

• Added a host-controlled root source option to the trace explorer. (#30060)

• Improved text readability with heavier weights. Body copy, table cells and captions now render at weight 465 instead of 400, which read thin on dark surfaces, and menus move from 450 to 465. Labels and headings move from 500 to 515 so they keep standing out, and bold text in markdown from 500 to 550. (#29743)

• Changed empty charts to look the same everywhere: the chart keeps its dates but drops its lines and y-axis, under dashed rulers and "No data in this range". Legends stay hidden while a chart loads or has nothing to show, and totals show 0 instead of "—" when the range is empty. (#29740)

• Added McpAppHostProvider to @mastra/playground-ui/domains/mcps, so a chat can extend the MCP Apps shown in its tool cards. Its value can send extra host context to each app and receive every ui/update-model-context the app sends. McpAppViewer also accepts the matching hostContext and onModelContext props directly. (#29557)

Patch Changes

• Improved how DataList looks while scrolling: (#30055)

• Dashboard cards that expand now open their fuller view from an expand button in the card's actions, instead of turning the title into a link. (#30064)

• Fixed MCP apps in chat, such as the observability dashboard widget, showing as an opaque box pressed against the surrounding messages. (#29887)

• Removed the tool-call style for the retired Factory source_control_publish_test_check tool. (#29888)

• Fixed button labels wrapping onto a second line inside their pill when space is tight. (#29444)

• Dashboard widgets now keep their saved widths on any screen wide enough for the 12-column grid, so a row of three or four cards no longer wraps onto a second line below 1280px. (#29337)

• Improved markdown chat tables in Factory and Studio with highlighted headers, softly faded row dividers, and rounded hover backgrounds. (#29300)

• Polished the Knowledge explorer. (#29505)

• Fixed the panelRef type on CollapsiblePanel: it now requires an object ref (for example from useRef or usePanelRef), since the panel reads .current to collapse and expand. (#29341)

• Thinned the Metrics, Traces, Logs, Tools, Prompts, Experiments, Datasets, Scorers, Workspaces, Settings and Processor icons to the same line weight as every other icon, so they no longer look heavier than the icons beside them. (#28868)

• Fixed chat messages showing raw MCP App context. (#29500)

• The Knowledge explorer now names Notion, Confluence, Zendesk and Fireflies imported scopes by their source, with an icon for each source that has one, instead of showing the raw scope address. (#29556)

• Improved Knowledge explorer notes. (#29580)

• The toggle on pinned Knowledge listings in Studio chat now says how many pages the listing covers: "Show N pages ▾" when collapsed ("Show N+ pages ▾" when the total is unknown), "Hide pages ▴" when open. (#29987)

• Fixed the KPI row on dashboards being narrower than the cards around it when it can be moved, pinned, or turned into an alert. (#29753)

• Fixed MessageScroller losing the end of the thread when its last row is hidden: "jump to latest" now appears when you scroll up and brings you back to the last visible message. (#29241)

• Improved scrolling performance of MessageScroller and ThreadRail on long threads with thousands of messages. (#28713)

• Sidebar items now highlight the same area on hover and when selected, and no longer flash a darker pressed state when clicked. (#29919)

• ProviderLogo now shows a real brand mark or a neutral monogram for every vendor in the Gateway model catalog. (#29448)

• Fixed filter rows on narrow screens. (#29786)

• MCP Apps in Studio now get a JSON-RPC invalid-params error (-32602) when they call a tool the app's MCP server doesn't have or keeps for the model. (#29491)

• Fixed chart cards with a view picker blocking their own actions while the picker was open. (#29906)

• Improved read-only skill forms: SkillSimpleForm shows a locked name (nameReadOnly), and the name and description in readOnly mode, as plain text under their labels instead of disabled inputs, so a value that can't change no longer looks like a field you can fill in. (#29881)

• Fixed the KPI group on dashboards showing its drag handle and unpin button over the cards' top border at all times. (#29887)

• Long Markdown lists now stay fast while a reply streams. (#29596)

• Fixed phones zooming the page when you tap a text field. (#29662)

• Fixed hover highlights on cards and other surfaces stopping short of the edge. (#30047)

• Fixed task list scroll fades so they start at the card edge. (#29315)

• Fixed long option labels being cut off in Combobox. (#28851)

• Metrics card groups of three or more now use three columns from 48rem wide instead of staying on two until 56rem, so three KPIs sit on one row on medium-width dashboards instead of wrapping 2 + 1. (#29887)

• The tripwire notice now shows its metadata with the read-only code view instead of the code editor. (#29554)

• Improved resize performance on pages with many metrics charts. (#29726)

• DatePicker now fills the width of its container. (#29769)

• Fixed KPI and metrics card groups staying on two columns on wide dashboards in apps that load their own Tailwind CSS after this package's styles. (#29920)

@mastra/posthog@1.4.7

Patch Changes

• Keep feedback anonymous when its author is explicitly null instead of attributing it to a legacy user or metadata field. (#30052)

@mastra/rag@2.8.0

Minor Changes

• Added user to the vector store resolver context. Dynamic vectorStore resolvers on RAG tools now receive the authenticated end user (id, name?, email?, avatarUrl?, role?) alongside requestContext and mastra. (#28612)

Patch Changes

• GraphRAG.query() now rejects topK and randomWalkSteps values that are not positive integers, and restartProb values that are not finite numbers strictly between 0 and 1. (#29967)

• Fixed GraphRAG storing newly added self-links twice. (#29968)

• GraphRAG now rejects non-finite or sparse node and query embeddings instead of producing NaN similarity scores. (#29959)

• Rebuilding a GraphRAG instance with createGraph now replaces its previous nodes and edges instead of retaining stale graph content. (#29962)

• Build GraphRAG from each execution's retrieved documents so reused tools cannot return context from a previous request or tenant. (#30185)

• Reject JSON chunk sizes below 21 before they can stall chunking on long strings. (#30186)

• Reject duplicate node IDs when restoring a GraphRAG snapshot instead of silently replacing the first node. (#29958)

• GraphRAG now rejects nonfinite edge weights when adding an edge or restoring a serialized graph, including null produced when JSON serialization converts NaN. (#29956)

• rerank and rerankWithScorer now throw a clear error when topK is not a nonnegative integer (for example -1, 1.5, NaN, or Infinity), instead of silently returning a surprising number of results. (#29761)

• rerank and rerankWithScorer now reject component weights that are not finite numbers between 0 and 1, instead of silently inverting or amplifying rankings. (#29957)

• Fixed recursive chunking, and character chunking with an empty separator, cutting emoji and some rare characters in half. (#29410)

@mastra/react@1.15.0

Minor Changes

• Added an optional callback to start() in useSpeechRecognition that receives the transcript as it is recognized. (#29310)

• Fixed the Studio Review Queue showing only results flagged for review from the first 10 results of each experiment. The Review Queue and the Completed view now load every matching result of each experiment, page by page as you scroll. (#29291)

• Added explicit feedback author and context-mode options to useCreateFeedback. The hook returns the server response, including its identity and timestamp. (#29528)

Patch Changes

• useAuthCapabilities and usePermissionPatterns keep their last result while a new client loads. (#29400)

• Fixed recordMicrophoneToFile labelling every recording as WebM. (#29573)

• Fixed useChat so pressing Stop no longer makes sendMessage reject with an AbortError. (#29764)

• Fixed useSpeechRecognition dictating through the previous agent right after agentId changes. (#29310)

@mastra/redis@1.4.13

Patch Changes

• Avoid repeated full Redis thread scans during limited controller queries by reading and sorting the resource once before filtering locally. (#30090)

@mastra/redis-streams@0.8.1

Patch Changes

• Fixed lost events and stuck evented agent runs when Redis restarts and reloads its dataset. (#29430)

• Fixed publishes failing when the Redis connection dropped mid-write. (#29512)

@mastra/schema-compat@1.4.0

Minor Changes

• JSON Schema format keywords are now enforced when validating a plain JSON Schema (#30113)

Patch Changes

• Generate JSON Schema for OpenAPI request parameters and bodies from their accepted inputs, while keeping response schemas based on emitted outputs. (#30187)

  Also in: @mastra/server@1.83.0

• Fixed Gemini rejecting tools whose input schema has a numeric, boolean or empty-string literal, such as z.literal(1), z.literal(true) or z.union([z.string(), z.literal('')]). (#29416)

@mastra/server@1.83.0

Minor Changes

• Support model and provider sorting in span queries. (#30096)

• Added GET /api/mcp/builtin, which describes the built-in MCP server so Studio and other clients can show how to connect to it. It returns whether the server is enabled (and why not), its endpoint path, whether @mastra/mcp is installed, the toolsets it serves, read-only mode, and whether it's open or protected by server.auth (with the provider name). It needs the mcp:read permission and never returns agent, workflow, or tool ids or auth configuration. (#29932)

• Added OAuth discovery to the built-in MCP server. When server.auth is configured, MCP clients that get a 401 from /api/mcp now receive a WWW-Authenticate header pointing at protected-resource metadata served at /.well-known/oauth-protected-resource, so they can discover where to sign in. The challenge, the metadata routes, and the audience check below only apply to /api/mcp. (#29930)

• Added a built-in MCP server. MCP clients such as Claude Code, Cursor, and the MCP Inspector can now call your agents, workflows, and tools at /api/mcp without defining an MCPServer. Every call goes through the matching HTTP route, so validation, auth, RBAC, FGA, and thread or run ownership apply exactly as they do over the HTTP API. (#29929)

• Added memory, observability, and agent builder tools to the built-in MCP server at /api/mcp. MCP clients such as Claude Code can now read and manage threads and Observational Memory, query traces, logs, metrics, scores, and feedback, and create stored agents they can call right away with call_agent. (#29931)

• Added text-search capability reporting and request forwarding for Platform integration. (#29897)

• Added invokeRoute to @mastra/server/server-adapter. It runs a server route in-process as the calling user, with the same checks the HTTP route applies: server auth's authorize, authorizeUser and rules (matched against the route's HTTP path under apiPrefix), RBAC permission, fine-grained authorization and schema validation, and returns the route's status and body. Use it to expose a route through another channel, such as an MCP tool, without the two drifting apart. (#29321)

• Forward successful HTTP feedback review-status updates to supporting exporters while preserving the local response. Missing feedback or feedback outside the configured resource returns 404. (#30075)

• Add PUT /api/observability/feedback/:feedbackId for complete feedback replacement. Preserve the original ID, trace ID, and timestamp, and include every field to retain. Delayed POST retries keep existing feedback. Unsupported storage versions return 501. (#30059)

  Also in: @mastra/server-adapters-test-suite@0.3.0

• The auth middleware now stores the authenticated user on the request context, normalized to the MastraUser shape by the auth provider's toMastraUser(). When an RBAC provider is configured and the provider's user has no role, the primary RBAC role is used. (#28612)

• Added authorizeRoute, checkRouteRBAC and dispatchRoute to @mastra/server/server-adapter. Custom server adapters can now run the same RBAC and fine-grained authorization checks as the built-in adapters with one call, and server code can invoke a built-in route in-process with the same authorization, validation and error responses as an HTTP request to that route. (#29928)

• Added GET /observability/feedback/:feedbackId. The endpoint returns { feedback: record | null } and uses the existing observability authorization. Registered the route in the generated API CLI metadata. (#29529)

• Added cancelReaderOnResponseClose and writeWithBackpressure to @mastra/server/server-adapter for custom adapters that write streams to a Node.js response. They stop reading a route's stream when the client disconnects, including a client that leaves before the route handler returns, and wait for a slow client instead of buffering the whole stream. (#29669)

• Add explicit context modes to feedback and score POSTs. Omitted mode preserves OSS direct writes; resolve derives stored root/target context and reports structured missing-anchor errors. Accept supplied timestamps and return normalized identity data. (#29289)

• Required feedback.traceId and score.traceId on observability POST requests. Omitted, null, empty, or whitespace-only IDs now return 400 before storage is called, including span-only requests. This does not add a trace-existence lookup or change generated IDs, server timestamps, or success responses. (#29287)

Patch Changes

• Limit the agent-controller thread-list route without initializing a session, and normalize positive fractional limits to match array slicing. (#30090)

• Listing an agent controller session's threads with tags now filters by those tags in storage when every tag key is a valid metadata filter key, such as projectPath, instead of loading every thread of the resource and filtering them afterwards. (#29552)

• Fixed auth rules so the first rule that matches a request decides access. (#29324)

• Fixed PATCH /datasets/:datasetId/experiments/:experimentId/results/:resultId so it checks that the experiment belongs to the dataset in the path. (#29323)

• Fixed GET /api/tools dropping tools that FGA allows when a tool is registered under a key other than its id (for example tools: { deleteAccountTool } with id: 'delete-account'). (#29929)

• Forward HTTP-created feedback and scores to configured exporters after local persistence, preserving IDs, timestamps, authors and review status without writing the local record twice. (#30052)

• Fixed private stored agents being visible to and usable by other users outside /api/stored/agents. (#29927)

• Share the run-ownership authorization policy between observe and abort routes while preserving their separate read/write permissions, thread access checks, and existing responses. (#29600)

• Fixed observational memory routes for gateway agents so users can't read each other's observations. (#29926)

• Fixed PATCH with autoPublish: true on a stored agent updating the active version but leaving the agent's status as draft. (#29482)

• Fixed custom API routes such as chatRoute so a client disconnect stops the agent run and its model request. (#29617)

• Fixed Studio threads failing with Gateway API error 404 for agents using mastra/ models with an organization (v2) Gateway key. (#29369)

@mastra/server-adapters-test-suite@0.3.0

Minor Changes

• Added createBuiltinMCPOAuthTestSuite, which checks that a server adapter serves the built-in MCP server's OAuth metadata, sends the WWW-Authenticate challenge, and enforces the token audience. (#29930)

• Added a shared test suite that checks the built-in MCP server behaves the same as the HTTP API on each server adapter. (#29929)

• Added createBuiltinMCPToolsetsTestSuite, which checks that an adapter's built-in MCP memory and observability tools allow and deny the same calls as the HTTP routes. (#29931)

• Added createRouteDispatchParityTestSuite, which checks that a server adapter and dispatchRoute return the same allow/deny results for RBAC, fine-grained authorization and thread ownership on agent, workflow and tool routes. (#29928)

• Added createStreamDisconnectTestSuite, which checks over real HTTP that an adapter stops reading a route's stream when the client disconnects and pauses reading while the client is not reading. (#29669)

Patch Changes

• Added conformance tests for custom route auth: auth and FGA checks must follow the route that handles the request, including its path params, for overlapping routes, HEAD requests, letter case and percent-encoded paths. (#29325)

• Removed the skipUntilIdleDisconnectReplay option from the durable-disconnect suite. (#29636)

• Added shared HTTP conformance tests for single score and feedback reads, including missing records and denied access. (#29529)

• Added stream disconnect cases that check a stream failing partway still delivers what was sent before the failure and ends the response. (#29944)

• Cover feedback and score export delivery in the shared HTTP adapter tests. (#30052)

• Added shared tests for server adapters. (#29617)

@mastra/spanner@1.12.0

Patch Changes

• Updated @google-cloud/spanner to ^9.1.0. (#29052)

@mastra/teams@0.1.5

Patch Changes

• Fixed a stored bot credential that can no longer be decrypted (for example after the encryption key changed) crashing the runtime at boot and blocking disconnect. (#29534)

@mastra/temporal@0.6.0

Minor Changes

• Added Temporal-backed workflow suspend and resume support. run.start() and run.resume() now return Mastra-compatible suspended results while the Temporal workflow remains open waiting for a signal, and resumed step results include their suspend payload and resume data. Successful Temporal runs now return the workflow result directly in the standard Mastra result shape and expose normalized StepResult entries in steps. (#27020)

Patch Changes

• Fixed Temporal workflows honoring disabled input validation when started programmatically. (#29409)

• Fixed canceled Temporal workflows returning a failed result. (#29409)

• Fixed run.start() results for failed runs. (#29169)

• Fixed duplicate Temporal workflow starts incorrectly invoking terminal lifecycle hooks. (#29409)

• Fixed Temporal workflow results to include the workflow input under result.steps.input again, matching a local run. (#29506)

@mastra/turso@0.1.21

Patch Changes

• Raised the @mastra/core peer dependency floor to 1.83.0 to match the @mastra/libsql version it depends on. (#28299)

@mastra/upstash@1.6.1

Patch Changes

• Mark thread listing as in-memory paginated so limited controller queries scan and sort the resource once instead of repeating full reads. (#30090)

• Fixed Upstash vector filters with multi-key $not, $nor, and negated $and/$or conditions silently ignoring every key after the first. (#29760)

@mastra/valkey@0.2.9

Patch Changes

• Avoid repeated full Valkey thread scans during limited controller queries by reading and sorting the resource once before filtering locally. (#30090)

• Tag Mastra-created Valkey connections with a clientInfoTag of mastra, so the server reports them as GlideJS(mastra) instead of a generic GlideJS. (#30156)

  Also in: @mastra/valkey-streams@0.6.2

@mastra/vectorize@1.1.5

Patch Changes

• Fixed semantic recall filters on Cloudflare Vectorize. (#29418)

@mastra/voice-deepgram@0.13.4

Patch Changes

• Fixed listen sending unset options such as diarize=undefined to Deepgram, which made transcription requests fail. (#29573)

@mastra/voice-openai-realtime@0.14.9

Patch Changes

• Use gpt-realtime-2.1-mini by default for OpenAI Realtime voice connections instead of the retired gpt-4o-mini-realtime-preview-2024-12-17 model. (#30183)

Other updated packages

Dependency updates only: @mastra/agent-builder@1.2.1, @mastra/arize@1.3.30, @mastra/arthur@0.4.30, @mastra/auth-workos@1.6.9, @mastra/braintrust@1.3.27, @mastra/datadog@1.4.22, @mastra/deepeval@0.1.24, @mastra/e2b-desktop@0.1.13, @mastra/gcs@0.3.6, @mastra/laminar@1.3.32, @mastra/langfuse@1.6.6, @mastra/langsmith@1.4.3, @mastra/longmemeval@1.1.42, @mastra/opencode@0.1.42, @mastra/otel-bridge@1.5.22, @mastra/otel-exporter@1.5.2, @mastra/sentry@1.2.32, @mastra/voice-google-gemini-live@0.14.19, @mastra/voice-xai-realtime@0.2.18