Retry connected app tools without creating duplicate effects
Retain operation identity, concrete arguments and provider evidence across timeouts and durable recovery.
Understand pending capacity reservations, creation usage and unbounded tool effects before planning integration costs.
Creating a hosted connection and executing an app tool are different metered effects. The connection creation journal settles usage after independently verifying provider ownership of the created account. A pending or later revoked account can still have incurred creation usage. Tool execution has its own operation and usage reservation. Do not promise that abandoning the browser flow erases every cost, or that a previously connected account makes all later tools free. Consult the workspace’s current plan and provider arrangement rather than publishing a fixed price inferred from a different product or historical marketing page.
Lupin treats connected tool execution as an unbounded paid effect and blocks it when a matching spending limit is active. A model cannot override that guard by calling the operation a read or estimating that it will probably be cheap. An uncertain provider timeout also retains its usage reservation until reconciliation because the effect may already have happened. Keep budget readiness distinct from OAuth readiness: an active account can be correctly authorized while a particular execution remains blocked by the workspace’s spending policy. Report the specific condition so the owner can make the appropriate decision.
Review stale pending setups and accounts whose purpose has ended, then disconnect through the supported provider revocation and deletion path. If revocation fails, Lupin preserves the record for reconciliation rather than pretending that hiding it releases external access. A busy lifecycle lock or uncertain creation needs operator attention before cleanup. Avoid deleting durable records directly to manufacture capacity. The safe objective is an accurate provider and local inventory, after which the applicable slot and usage state can be reconciled under the product’s actual accounting rules.
Before creating a connection, identify the account owner, workflow purpose, expected frequency and whether the provider or Lupin usage needs funding. Before tool execution, show the exact operation and any known cost boundary alongside approval. A bootstrap key does not grant paid resource creation or external app writes, even if a free workspace has nominal capacity. A useful local test sends concurrent creation attempts at the limit and asserts one consistent reservation outcome. Another should leave a timeout uncertain and ensure that retries neither free its reservation prematurely nor duplicate the provider effect.
If two owners started authorization and only one completed it, count both attempts when investigating a slot limit. Identify the unfinished flow and reconcile or clean it up through the supported lifecycle. Do not remove a durable row solely because the browser was closed; a provider-side account or reserved attempt may still exist.
Reviewed against current checked-in Lupin routes, shared contracts and official provider references. No live calls, OAuth authorizations, app actions or purchases were performed.
Prepared with AI assistance by Lupin editorial. How we research and maintain these guides.