| β¦ | β¦ | @@ -145,7 +145,7 @@ const ListScheduledTasksTool = Tool.make("list_scheduled_tasks", { | |
| 146 | 146 | const UpdateScheduledTaskTool = Tool.make("update_scheduled_task", { | |
| 147 | 147 | description: | |
| 148 | - | "Update an existing scheduled task by scheduledTaskId (from list_scheduled_tasks). Webhook schedule dedupe accepts replayKey, coalesceKey, and coalesceWindowSeconds (10β3600, default 120) to suppress replays for 7 days and retain the latest payload in each fixed window. Only the provided fields change; omit a field to leave it as-is. Use enabled=false to pause a task without deleting it. Set bindToCurrentThread to move the task between posting into this thread and launching a fresh thread per run. A webhook schedule without filters keeps the stored filters; pass filters to replace them, or filters:[] to clear them.", | |
| 148 | + | "Update an existing scheduled task by scheduledTaskId (from list_scheduled_tasks). Webhook schedule dedupe accepts replayKey, coalesceKey, and coalesceWindowSeconds (10β3600, default 120) to suppress replays for 7 days and retain the latest payload in each fixed window. Only the provided fields change; omit a field to leave it as-is. The same holds inside schedule: an optional field such as timeZone that you leave out keeps its stored value, and null removes it. Use enabled=false to pause a task without deleting it. Set bindToCurrentThread to move the task between posting into this thread and launching a fresh thread per run. A webhook schedule without filters keeps the stored filters; pass filters to replace them, or filters:[] to clear them.", | |
π΄ Critical orchestrator/tools.ts:148
Omitting signature from schedule when updating a signed webhook clears its secret and disables signature verification, despite this description promising omitted schedule fields retain their stored values. updateScheduledTask forwards the schedule without merging, and ScheduledTaskService.upsert treats the omitted signature as null; narrow the preservation guidance to supported fields and tell callers to include the existing signature when editing a signed webhook.
π€ Copy this AI Prompt to have your agent fix this:
| 1 | In file @apps/server/src/mcp/toolkits/orchestrator/tools.ts around line 148: |
| 2 | |
| 3 | Omitting `signature` from `schedule` when updating a signed webhook clears its secret and disables signature verification, despite this description promising omitted schedule fields retain their stored values. `updateScheduledTask` forwards the schedule without merging, and `ScheduledTaskService.upsert` treats the omitted signature as `null`; narrow the preservation guidance to supported fields and tell callers to include the existing signature when editing a signed webhook. |