fix(auth-okta): build correct endpoint URLs for Okta org authorization servers

.agents/skills/testing-core-processors/SKILL.md

@@ -0,0 +1,109 @@
+# Testing Core Error Processors
+
+How to write integration tests for error processors in `packages/core/src/processors/`.
+
+## Prerequisites
+
+- Build core before running tests: `pnpm build:core` (from repo root)
+- If focused vitest runs fail to resolve `@internal/test-utils/setup`, the build step was skipped
+
+## Mock Model Pattern
+
+Use `MockLanguageModelV2` from `@internal/ai-sdk-v5/test` to simulate API errors and verify retry behavior.
+
+```ts
+import { APICallError } from '@internal/ai-sdk-v5';
+import { convertArrayToReadableStream, MockLanguageModelV2 } from '@internal/ai-sdk-v5/test';
+
+// Track calls and captured prompts
+let callCount = 0;
+const receivedPrompts: any[] = [];
+
+const model = new MockLanguageModelV2({
+  doGenerate: async ({ prompt }) => {
+    callCount++;
+    receivedPrompts.push(JSON.parse(JSON.stringify(prompt)));
+    if (callCount === 1) {
+      throw new APICallError({
+        message: '...',
+        url: '...',
+        requestBodyValues: {},
+        statusCode: 400,
+        responseBody: '...',
+        isRetryable: false,
+      });
+    }
+    return {
+      rawCall: { rawPrompt: null, rawSettings: {} },
+      finishReason: 'stop',
+      usage: { inputTokens: 10, outputTokens: 20, totalTokens: 30 },
+      content: [{ type: 'text', text: 'response' }],
+      warnings: [],
+    };
+  },
+  doStream: async ({ prompt }) => {
+    // Same error logic as doGenerate
+    // IMPORTANT: Stream response must include all event types:
+    return {
+      rawCall: { rawPrompt: null, rawSettings: {} },
+      warnings: [],
+      stream: convertArrayToReadableStream([
+        { type: 'stream-start', warnings: [] },
+        { type: 'response-metadata', id: 'id-0', modelId: 'mock-model', timestamp: new Date(0) },
+        { type: 'text-start', id: 'text-1' },
+        { type: 'text-delta', id: 'text-1', delta: 'response text' },
+        { type: 'text-end', id: 'text-1' },
+        { type: 'finish', finishReason: 'stop', usage: { inputTokens: 10, outputTokens: 20, totalTokens: 30 } },
+      ]),
+    };
+  },
+});
+```
+
+### Stream Mock Gotcha
+
+The stream mock format requires `stream-start`, `response-metadata`, `text-start`, `text-delta`, `text-end`, and `finish` events. Using only `text-delta` + `finish` (the minimal format) will result in empty text output because the AI SDK expects the full event sequence. See `prefill-error-recovery.test.ts` for the reference pattern.
+
+## Test Structure
+
+For each error processor, write at minimum:
+
+1. **Happy path**: Processor catches the target error, modifies messages, retries successfully
+   - Assert: `agent.generate()` succeeds, mock called 2x, retry prompt has expected modifications
+2. **Control test**: Same scenario without the processor — error propagates
+   - Assert: `agent.generate()` throws the expected error
+3. **Selectivity test**: Processor ignores unrelated errors (e.g. rate limit 429)
+   - Assert: Error propagates, mock called only 1x
+
+## Passing Messages with Tool Calls
+
+When seeding conversation history for tool-related tests, pass messages as the second argument to `agent.generate()` or `agent.stream()` using the AI SDK message format:
+
+```ts
+const messages = [
+  { role: 'user', content: 'Do something' },
+  { role: 'assistant', content: [{ type: 'tool-call', toolCallId: 'some-id', toolName: 'myTool', args: {} }] },
+  { role: 'tool', content: [{ type: 'tool-result', toolCallId: 'some-id', toolName: 'myTool', result: 'done' }] },
+];
+await agent.generate(messages);
+```
+
+## Running Tests
+
+```bash
+# Run focused processor tests
+npx vitest run packages/core/src/processors/my-processor.test.ts
+
+# Run all processor tests
+npx vitest run packages/core/src/processors/
+
+# Full core test suite (slower)
+pnpm test:core
+```
+
+## Devin Secrets Needed
+
+None for mock-based integration tests. For live API tests:
+
+- `ANTHROPIC_API_KEY` — for testing against real Anthropic API
+- `OPENROUTER_API_KEY` — for testing provider switching scenarios

.changeset/afraid-monkeys-buy.md

@@ -0,0 +1,5 @@
+---
+'@mastra/voice-openai-realtime': patch
+---
+
+Fixed OpenAI Realtime voice output streaming for current audio event names.

.changeset/auth-okta-org-server-endpoints.md

@@ -0,0 +1,9 @@
+---
+'@mastra/auth-okta': patch
+---
+
+Fix endpoint URL construction for Okta org authorization servers.
+
+`MastraAuthOkta` concatenated `/v1/authorize` (and `/token`, `/keys`, `/logout`) directly onto `OKTA_ISSUER`. That yields the right endpoint for a custom authorization server (`https://{domain}/oauth2/default` → `.../oauth2/default/v1/authorize`), but 404s on an Okta org authorization server (`https://{domain}` → `.../v1/authorize`, whereas the real org endpoint is `.../oauth2/v1/authorize`).
+
+An internal `endpointBase` is now derived from the issuer — verbatim when it already contains `/oauth2/`, otherwise `${issuer}/oauth2` — and used for the authorize, token, keys, and logout URLs. JWT `iss`-claim validation still uses the raw issuer so token validation stays correct on both server types. Trailing slashes on the issuer are also normalized so `OKTA_ISSUER=https://{domain}/` no longer produces `.../oauth2//v1/...`.

.changeset/blue-singers-join.md

@@ -0,0 +1,9 @@
+---
+'@mastra/playground-ui': patch
+---
+
+Added a `destructive` variant on `DropdownMenu.Item` to highlight dangerous actions like delete.
+
+```tsx
+<DropdownMenu.Item variant="destructive">Delete project</DropdownMenu.Item>
+```

.changeset/brave-caches-observe.md

@@ -0,0 +1,20 @@
+---
+'@mastra/core': minor
+'@mastra/memory': minor
+---
+
+Added `activateAfterIdle: "auto"` for Observational Memory early activation.
+
+Mastra can now choose an idle activation timeout from the active model provider's prompt cache behavior. OpenAI also respects `providerOptions.openai.promptCacheRetention` when available.
+
+```ts
+const memory = new Memory({
+  options: {
+    observationalMemory: {
+      model: 'google/gemini-2.5-flash',
+      activateAfterIdle: 'auto',
+      activateOnProviderChange: true,
+    },
+  },
+})
+```

.changeset/brave-tigers-cheer.md

@@ -0,0 +1,17 @@
+---
+'@mastra/editor': minor
+---
+
+`EditorWorkspaceNamespace` can now snapshot a live `Workspace` for persistence — the reverse of `hydrateSnapshotToWorkspace()`:
+
+```ts
+const snapshot = await editor.workspace.snapshotFromWorkspace(runtimeWorkspace);
+await editor.workspace.create({ id: 'my-workspace', ...snapshot });
+```
+
+`snapshotFromWorkspace()` is `async` and awaits `sandbox.getInfo()` and `filesystem.getInfo()` so async providers like `CompositeFilesystem` keep their mount metadata in the stored config.
+
+Also includes two smaller behavioral fixes:
+
+- `EditorSkillNamespace.publishSkillFromSource()` stores the new `files` field on the published skill version and strips `undefined` keys before calling `update()` (libsql/pg adapters reject `undefined` bind arguments).
+- `CrudEditorNamespace.clearCache(id)` always calls `onCacheEvict(id)`, even when the entity wasn't cached, so subclasses can clean up runtime registries for version-specific lookups that bypass the editor cache.

.changeset/breezy-heads-cut.md

@@ -0,0 +1,5 @@
+---
+'mastracode': minor
+---
+
+Added automatic return to Plan mode when a goal started from an approved plan finishes.

.changeset/busy-plants-wonder.md

@@ -0,0 +1,29 @@
+---
+'@mastra/core': minor
+---
+
+Added support for permission arrays in FGA checks and route configuration. When an array is provided, the user needs **any one** of the listed permissions (logical OR).
+
+**Affected types**
+
+- `FGACheckParams.permission`
+- `FGARouteConfig.permission`
+- `FGARouteInfo.requiresPermission`
+- `FGADeniedError.permission`
+- `CheckFGAOptions.permission`
+
+Single-permission usage continues to work unchanged.
+
+```ts
+// Before — single permission only
+await fga.check({
+  resource: { type: 'agent', id: 'abc' },
+  permission: 'agents:read',
+});
+
+// After — single permission or array (ANY-of)
+await fga.check({
+  resource: { type: 'agent', id: 'abc' },
+  permission: ['agents:read', 'agents:execute'],
+});
+```

.changeset/calm-pandas-wave.md

@@ -0,0 +1,16 @@
+---
+'@mastra/client-js': minor
+---
+
+Added `agent.browserSession(threadId?)` and `agent.closeBrowser(threadId?)` to the `Agent` resource, plus a `GetAgentBrowserSessionResponse` type.
+
+`browserSession` probes the server's browser session state before opening a screencast WebSocket, so the connection is only made when the server has screencast support installed and an active session exists for the thread. `closeBrowser` ends the agent's browser session (or a single thread's session if `threadId` is passed). Both methods go through the configured client `baseUrl` and `apiPrefix`, so they work with servers mounted under a non-default API prefix.
+
+```ts
+const probe = await client.getAgent('my-agent').browserSession(threadId);
+if (probe.screencastAvailable && probe.hasSession) {
+  // safe to open the screencast WebSocket
+}
+
+await client.getAgent('my-agent').closeBrowser(threadId);
+```

.changeset/chubby-pugs-refuse.md

@@ -0,0 +1,53 @@
+---
+'@mastra/convex': minor
+---
+
+Added native Convex vector search support for production workloads. The new `ConvexNativeVector` adapter uses
+Convex schema-defined vector indexes and `ctx.vectorSearch` instead of loading vectors through `ConvexVector` and
+scoring them in JavaScript.
+
+Define a native vector table in `convex/schema.ts`:
+
+```ts
+import { defineSchema } from 'convex/server';
+import { defineMastraNativeVectorTable } from '@mastra/convex/schema';
+
+export default defineSchema({
+  docs_vectors: defineMastraNativeVectorTable({
+    dimensions: 1536,
+  }),
+});
+```
+
+Export the native vector handlers:
+
+```ts
+import {
+  mastraNativeVectorAction,
+  mastraNativeVectorMutation,
+  mastraNativeVectorQuery,
+} from '@mastra/convex/server';
+
+export const query = mastraNativeVectorAction;
+export const read = mastraNativeVectorQuery;
+export const write = mastraNativeVectorMutation;
+```
+
+Then configure `ConvexNativeVector` in your Mastra app:
+
+```ts
+import { ConvexNativeVector } from '@mastra/convex';
+
+const vectorStore = new ConvexNativeVector({
+  id: 'convex-native-vectors',
+  deploymentUrl: process.env.CONVEX_URL!,
+  adminAuthToken: process.env.CONVEX_ADMIN_KEY!,
+  indexes: {
+    docs: {
+      tableName: 'docs_vectors',
+      vectorIndexName: 'by_embedding',
+      dimension: 1536,
+    },
+  },
+});
+```

.changeset/chubby-wings-obey.md

@@ -0,0 +1,13 @@
+---
+'@mastra/playground-ui': patch
+---
+
+`PopoverContent` no longer forwards the underlying library's auto-focus event handlers (`onOpenAutoFocus`, `onCloseAutoFocus`). To control focus when the popover opens or closes, use `initialFocus` and `finalFocus`.
+
+```tsx
+// Before
+<PopoverContent onOpenAutoFocus={(e) => e.preventDefault()} />
+
+// After
+<PopoverContent initialFocus={false} />
+```

.changeset/clean-seals-press.md

@@ -0,0 +1,5 @@
+---
+'@mastra/server': patch
+---
+
+Fixed stored resource updates to preserve existing metadata keys.

.changeset/clear-eagles-throw.md

@@ -0,0 +1,17 @@
+---
+'@mastra/playground-ui': minor
+---
+
+Added `ContextMenu` for right-click interactions. Supports submenus, checkbox and radio items, keyboard shortcuts, and a `destructive` variant for dangerous actions like delete.
+
+```tsx
+import { ContextMenu } from '@mastra/playground-ui';
+
+<ContextMenu>
+  <ContextMenu.Trigger className="…">Right click here</ContextMenu.Trigger>
+  <ContextMenu.Content>
+    <ContextMenu.Item>Rename</ContextMenu.Item>
+    <ContextMenu.Item variant="destructive">Delete</ContextMenu.Item>
+  </ContextMenu.Content>
+</ContextMenu>;
+```