feat: allow deleting models, mcp, skills from settings

[innoavator]

Summary

Fixes #301
Fixes #494
Fixes #498

Co-authors to be added from other PRs:
@kristopolous - #495, #499, #501, #502
@azaanaliraza - #369
@Gadgitmatic - #880

---

Settings entries (model providers, MCP servers, and skills) can now be deleted, but only when no configured agent still references them. If an agent still uses the entry, the API returns 409 naming those agents so the user can delete the agent first.

This also closes the hole where updating a model provider could drop a model an agent still pointed at, and adds a confirmation dialog (plus Connect on unauthenticated OAuth connectors in the list).

Changes

• Add DELETE for /api/v1/settings/model-providers/{name}, /mcp-servers/{name}, and /skills/{name}
• Block delete (and model-provider PUT that drops a model) with 409 when listAgentCatalogUsage finds a referencing agent
• Clear stored OAuth tokens and pending authorizations when deleting an MCP server
• Settings UI: shared confirm-delete dialog; unused deletes ask for confirmation, in-use 409s become an error dialog with Close only (no Remove retry)
• Removing a provider's last model deletes the provider (a provider must declare at least one model)
• Connector list: Connect on added-but-unauthenticated OAuth servers; Remove on configured connectors
• Wire deleteModelProvider / deleteSkill / deleteConnector through the TrueForge catalog adapters
• Regenerate OpenAPI and TS/Python SDKs via the official generate scripts

Screenshots

Configured connectors with Connect / Remove on the list:

Confirm before removing an unused connector:

Removing a provider's last model deletes the whole provider:

In-use catalog entries cannot be removed — Close only, no retry:

How was this tested?

• Store contract tests for listAgentCatalogUsage and catalog delete* (SQLite)
• Unit tests for settings DELETE and in-use 409s (skills, MCP servers, model providers), including the model-provider PUT guard
• UI tests for confirm/cancel, 409 shown as an error dialog with Close only, last-model-removes-provider, and connector remove
• pnpm --filter @truefoundry/trueforge typecheck and pnpm --filter @truefoundry/trueforge-ui typecheck
• pnpm lint:ci and pnpm format:check

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, python/trueforge_sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed

---

Note

Medium Risk
Changes settings admin APIs and deletes catalog data (including MCP OAuth grants), with referential checks but real impact on agent runtime configuration if misused.

Overview
Adds DELETE for settings model providers, MCP servers, and skills, plus SDK/OpenAPI support. Deletes (and model-provider updates that remove models) run findCatalogUsageConflict via new listAgentCatalogUsage on the agent store; in-use entries return 409 with agent names. Deleting an MCP server also clears stored OAuth tokens and pending authorizations.

The settings UI uses a shared ConfirmDeleteDialog: confirm before remove, show API refusal in-dialog ("Can't remove …" + Close only). Model settings treat removing a provider's last model as deleting the whole provider. Connectors gain list-level Connect for unauthenticated OAuth servers and Remove wired through catalog deleteConnector / deleteModelProvider / deleteSkill adapters.

^{Reviewed by Cursor Bugbot for commit 8ec02fd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 8ec02fd

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@truefoundry/trueforge-ui	Patch
@truefoundry/trueforge	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit c13f694. Configure here.}

[Gadgitmatic]

Thanks for the umbrella PR — this covers the three long-open issues (#301, #494, #498) and the confirm dialog is a better shape than what I built.

I'm the @Gadgitmatic on #880, which you already credit. #880 is the same model-provider delete, so it should probably close as a duplicate of this PR.

Since the branch is 24 behind main I did a trial merge. 14 files conflict, but 7 are generated SDK/OpenAPI output. Of the 7 real ones, 6 are additive — your deleteServer / deleteProvider land next to main's resolveInvokeHeaders and resolve by keeping both sides. Only agentStore.ts (and the agent-store impls) is a genuine two-way: listAgentCatalogUsage vs the pagination in #863.

Two notes in case they help:

1. In McpServerWithAuthStore.ts the hunk is easy to resolve wrong. Main's resolveInvokeHeaders takes turnMetadata?: TurnMetadata; your branch predates it. sessionResources.ts:135 passes it via a spread, so taking "ours" there won't fail the type check — it just stops being forwarded. No behaviour change today since the body ignores it, but the signature would silently diverge from main.
2. Your delete* returning boolean is better than the void in feat(models): allow deleting configured model providers #880 — that's what lets the route tell "gone" from "never existed" and pick between confirm and 409. I'd keep yours.

Happy to resolve the 6 additive conflicts and the agentStore.ts one if that'd help — say the word and I'll push to the branch, or open a separate PR against main that you can merge in.