[bug] liveOpenapiRouter: Microsoft Graph mail slice fails discovery with RangeError: Invalid string length

[DomiR]

Executor version

2.0.0-beta.7 (image ghcr.io/usefulsoftwareco/executor-selfhost:2.0.0-beta.7), app framework apps@0.0.1-beta.14

How do you run Executor?

Self-host (Docker)

Operating system

Linux

Integration involved

OpenAPI spec via liveOpenapiRouter (Microsoft Graph slices from integrations.sh)

What happened

An app that mounts the Microsoft Graph mail slice with liveOpenapiRouter cannot list its tools. Discovery fails with AppEvaluationFailed (502), after first timing out (AppDiscoveryTimedOut / ToolListingTimedOut) on the cold cache. The server logs:

RangeError: Invalid string length
    at node_modules/apps/chunk-IDQI5BMJ.js:1:62696
    at next (<anonymous>)
    at app.dispatch (node_modules/apps/chunk-IDQI5BMJ.js:1:2553)

Bisecting the same app:

Slices mounted	Result
profile only (8 operations)	Tools list, calls work
profile + mail (about 290 operations)	AppEvaluationFailed, RangeError above
All 10 slices (profile, mail, calendar, tasks, files, excel, sites, onenote, teams-chat, meetings-calls)	Same

Passing ctx.cache instead of ctx.cache.forAccount(account) makes no difference. The OpenAPI source API in apps@0.0.1-beta.18 looks unchanged, so I don't expect a version bump to help.

The dashboard's catalog entry "Outlook Mail" points agents at this same document (https://integrations.sh/specs/microsoft-graph/mail.json), so the suggested setup path likely hits this too.

My guess: the Graph component schemas are large and heavily cross-referenced, so serializing a compiled revision (or per-operation schema dependencies) for the mail slice exceeds V8's maximum string length.

What you expected

The mail slice compiles and its tools list, as the profile slice does.

Steps to reproduce

1. Deploy this app (single-tenant Entra app; replace <tenant-id>):

import { defineApp, defineProvider, oauth2, router } from "apps";
import { liveOpenapiRouter } from "apps/openapi";

const TENANT = "<tenant-id>";

const microsoft = defineProvider({
  name: "Microsoft Graph",
  auth: {
    microsoftOAuth2: oauth2({
      discover: `https://login.microsoftonline.com/${TENANT}/v2.0`,
      scopes: ["openid", "offline_access", "User.Read", "Mail.ReadWrite"],
    }),
  },
});

const SLICES = { profile: "profile", mail: "mail" } as const;

export default defineApp({ accounts: { microsoft } }, async ({ accounts, cache, fetch, signal }) => ({
  tools: router(
    Object.fromEntries(
      Object.entries(SLICES).map(([key, slice]) => [
        key,
        liveOpenapiRouter({
          cache,
          fetch,
          signal,
          source: { url: `https://integrations.sh/specs/microsoft-graph/${slice}.json` },
          allowedOrigin: "https://graph.microsoft.com",
          securitySchemes: {
            microsoftOAuth2: {
              type: "oauth2",
              flows: {
                authorizationCode: {
                  authorizationUrl: `https://login.microsoftonline.com/${TENANT}/oauth2/v2.0/authorize`,
                  tokenUrl: `https://login.microsoftonline.com/${TENANT}/oauth2/v2.0/token`,
                  scopes: {},
                },
              },
            },
          },
          methods: {},
          oauth: ["microsoftOAuth2"],
          account: accounts.microsoft,
        }),
      ]),
    ),
  ),
}));

2. Create a profile and connect a Microsoft account (accounts.connect); it completes and the profile becomes ready.
3. In MCP execute, run await tools.search({ query: "list my mail messages" }). The app is reported in unavailableApps with AppEvaluationFailed, and the server logs the RangeError above.
4. Remove mail from SLICES, redeploy, and search again: the profile tools list, and profile.meUser.meUserGetUser({}) returns the signed-in user.

Diagnostics / logs

The RangeError stack above is the only error the server logs for the failed discovery. Apart from that there is only Executor request failed: POST EOF.

Before you submit

• I searched the open issues for a duplicate.
• I removed all keys, tokens, and credentials from this report.