@0xmaxma/claude-gateway 1.8.7 → 1.8.9

package/dist/api/oauth-connectors-router.js

@@ -0,0 +1,384 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOauthConnectorsRouter = createOauthConnectorsRouter;
+exports.createOauthCallbackRouter = createOauthCallbackRouter;
+const express_1 = require("express");
+const auth_1 = require("./auth");
+const custom_1 = require("../connectors/custom");
+const token_env_1 = require("../connectors/token-env");
+const public_url_1 = require("../config/public-url");
+const mcp_oauth_1 = require("../connectors/mcp-oauth");
+const pending_oauth_store_1 = require("../connectors/pending-oauth-store");
+const oauth_refresh_sweep_1 = require("../connectors/oauth-refresh-sweep");
+// This route is PUBLIC (see module doc comment) and some of what lands in its
+// plain-HTML fallback pages is not ours to trust: `error` is a raw query
+// param off an unauthenticated request, and a token-exchange failure message
+// can embed a token endpoint's own raw JSON response body (see mcp-oauth.ts's
+// tokenRequest()) — reachable via an admin-added custom connector whose
+// token endpoint is attacker-controlled. Escape before ever interpolating
+// into an `<h1>`.
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * RFC 6749 §4.1.2.1 error codes are short ASCII tokens (`access_denied`,
+ * `invalid_scope`, …). `escapeHtml` covers this value on the way into our own
+ * fallback page, but `fail()` also forwards it OUT — as `connector_oauth_error` on
+ * the configured return URL — into a downstream app whose rendering is not ours to
+ * vouch for, and it arrives from the query string of an unauthenticated public
+ * route. URL-encoding makes it a well-formed parameter, not a safe one. Anything
+ * outside the token shape becomes a generic code before it leaves this process; the
+ * provider's own words still reach the operator, on the page and in the log.
+ */
+const OAUTH_ERROR_CODE_RE = /^[A-Za-z0-9_.:-]{1,64}$/;
+function safeErrorCode(raw) {
+    return OAUTH_ERROR_CODE_RE.test(raw) ? raw : 'provider_error';
+}
+/**
+ * Generic OAuth 2.1 + PKCE flow for connectors whose credential this gateway owns
+ * (`credentialOwner: 'gateway'` — see ConnectorCredentialOwner) — e.g. Firecrawl's
+ * `https://mcp.firecrawl.dev/v2/mcp-oauth`. This is the gateway-owned
+ * counterpart to an external control plane's own OAuth handlers (which produce
+ * 'external' entries via /oauth/receive): the whole dance (discovery, DCR,
+ * PKCE, token exchange, refresh) happens here, inside the user's own VM —
+ * no external service ever sees the resulting token.
+ *
+ * Two routers, deliberately NOT combined into one:
+ *   - createOauthConnectorsRouter(): admin-gated, mounted under /api like every
+ *     other connector-management route (`POST /v1/connectors/custom/:id/oauth/start`).
+ *   - createOauthCallbackRouter(): PUBLIC, no auth — this is the URL the OAuth
+ *     provider redirects the end user's own browser to
+ *     (`GET /oauth/mcp/callback`), which has no API key to present. Its
+ *     security rests on the single-use, TTL'd, unguessable `state` value
+ *     (see pending-oauth-store.ts), the same posture cliPairingStore already
+ *     uses for its own unauthenticated browser-facing routes — plus a re-read of
+ *     the connector before it commits anything, because `state` proves which
+ *     browser started the flow and nothing about what happened to the connector
+ *     while that browser sat on the provider's consent screen.
+ */
+function createOauthConnectorsRouter(apiKeys, gatewayConfig, store, pendingStore = pending_oauth_store_1.pendingOAuthStore) {
+    const router = (0, express_1.Router)();
+    if (apiKeys?.length)
+        router.use((0, auth_1.createApiAuthMiddleware)(apiKeys));
+    function requireAdmin(req, res) {
+        if (!apiKeys?.length)
+            return true;
+        if (!(0, auth_1.isAdmin)(req.apiKey)) {
+            res.status(403).json({ error: 'Connector management requires an admin API key' });
+            return false;
+        }
+        return true;
+    }
+    // Same shape check as connectors-router.ts's — see its `router.param('id')` comment.
+    // Here the id is also looked up in `store`, so this is defence in depth rather than
+    // the only guard, but it keeps the 400-vs-404 distinction honest.
+    router.param('id', (req, res, next, id) => {
+        if (!(0, custom_1.isValidConnectorId)(id)) {
+            res.status(400).json({ error: `Invalid connector id '${id}'` });
+            return;
+        }
+        next();
+    });
+    router.post('/v1/connectors/custom/:id/oauth/start', async (req, res) => {
+        if (!requireAdmin(req, res))
+            return;
+        const id = req.params.id;
+        // Read and validate inside a try, for the reason connectors-router.ts's
+        // /connect route states at length: `store.read()` does no runtime shape
+        // validation — `config` is required by the TypeScript type and by nothing
+        // else — so an entry hand-written into config.json without it turns
+        // `entry.config.url` into a TypeError, and on Express 4 a rejected async
+        // handler escapes to index.ts's `unhandledRejection` hook, which calls
+        // emergencyShutdown(). A malformed entry must cost this caller a 500, not
+        // every agent on the box. Kept separate from the try below, which reports
+        // 502: that one covers the third-party AS, and a broken local entry is not
+        // an upstream failure.
+        let mcpUrl;
+        try {
+            const entry = (await store.read())[id];
+            if (!entry) {
+                res.status(404).json({ error: `Unknown connector '${id}'` });
+                return;
+            }
+            if (entry.credentialOwner !== 'gateway') {
+                res.status(400).json({
+                    error: entry.credentialOwner === 'external'
+                        ? `Connector '${id}' has its credential owned externally — its token is pushed in via POST /v1/connectors/${id}/oauth/receive, not signed in for here`
+                        : `Connector '${id}' was not added with oauth: true`,
+                });
+                return;
+            }
+            const url = entry.config?.url;
+            if (typeof url !== 'string') {
+                res.status(400).json({ error: `Connector '${id}'.config.url is missing` });
+                return;
+            }
+            mcpUrl = url;
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+            return;
+        }
+        const publicUrl = (0, public_url_1.resolveGatewayPublicUrl)(gatewayConfig?.gateway?.publicUrl);
+        if (!publicUrl) {
+            res.status(500).json({
+                error: 'This gateway has no valid gateway.publicUrl configured — OAuth sign-in needs a reachable HTTPS callback URL.',
+            });
+            return;
+        }
+        const redirectUri = `${publicUrl}/oauth/mcp/callback`;
+        try {
+            const metadata = await (0, mcp_oauth_1.discoverOAuthMetadata)(mcpUrl);
+            // Reuse a client this connector already registered via DCR, rather
+            // than minting (and orphaning, at the provider) a brand-new one on
+            // every Connect click — including retries after an abandoned attempt.
+            // Only valid while the redirect_uri it was registered with still
+            // matches; a changed gateway.publicUrl invalidates the cache.
+            //
+            // Falls back to the live client_id so a connector that registered before
+            // the DCR cache had a key of its own keeps reusing it, instead of orphaning
+            // one more registration at the provider on the first Connect after upgrade.
+            // Both reads only — see dcrClientIdSecretKey for why start never WRITES the
+            // key the sweep refreshes with.
+            const cachedClientId = (0, token_env_1.getSecret)((0, oauth_refresh_sweep_1.dcrClientIdSecretKey)(id)) ?? (0, token_env_1.getSecret)((0, oauth_refresh_sweep_1.clientIdSecretKey)(id));
+            const cachedRedirectUri = (0, token_env_1.getSecret)((0, oauth_refresh_sweep_1.clientRedirectUriSecretKey)(id));
+            let clientId;
+            if (cachedClientId && cachedRedirectUri === redirectUri) {
+                clientId = cachedClientId;
+            }
+            else {
+                clientId = await (0, mcp_oauth_1.resolveClientId)(metadata, id, redirectUri);
+                (0, token_env_1.setSecret)((0, oauth_refresh_sweep_1.dcrClientIdSecretKey)(id), clientId);
+                (0, token_env_1.setSecret)((0, oauth_refresh_sweep_1.clientRedirectUriSecretKey)(id), redirectUri);
+            }
+            const { codeVerifier, codeChallenge } = (0, mcp_oauth_1.generatePkce)();
+            const state = pendingStore.create({ connectorId: id, metadata, clientId, redirectUri, codeVerifier });
+            const scope = (0, mcp_oauth_1.resolveScope)(metadata, id);
+            const authorizeUrl = (0, mcp_oauth_1.buildAuthorizeUrl)({
+                metadata,
+                clientId,
+                redirectUri,
+                scope,
+                codeChallenge,
+                state,
+            });
+            res.json({ authorizeUrl });
+        }
+        catch (err) {
+            res.status(502).json({ error: err.message });
+        }
+    });
+    return router;
+}
+/**
+ * Both paths, for the same reason share-router.ts registers
+ * `['/shared/:token', '/gateway/shared/:token']`.
+ *
+ * `resolveGatewayPublicUrl` REQUIRES the configured publicUrl to end in `/gateway`,
+ * so the redirect_uri handed to the provider is always
+ * `<origin>/gateway/oauth/mcp/callback`. Behind Traefik that prefix is stripped
+ * before the request reaches Express and the bare path matches. In the direct-path
+ * deployment the same function explicitly permits (`http://localhost` / `127.*` /
+ * `*.internal` / `*.local` + `/gateway`) nothing strips it — there is no prefix
+ * middleware anywhere in this app — so the provider redirected the user's own
+ * browser to a path with no route. The result was a bare 404 and a pending flow
+ * left to expire silently: the sign-in fails, and the one page the user sees says
+ * nothing about why.
+ */
+const CALLBACK_PATHS = ['/oauth/mcp/callback', '/gateway/oauth/mcp/callback'];
+/** See this file's module doc comment — mounted directly on the Express app,
+ *  NOT under any auth middleware, at `/oauth/mcp/callback`.
+ *
+ *  `agents` (all live AgentRunners) lets a completed sign-in restart the sessions
+ *  already using the connector, exactly as POST /v1/connectors/:id/oauth/receive
+ *  does for a pushed token. Without it the user finishes the OAuth dance, sees the
+ *  connector go green, and then finds the agent they are talking to still has no
+ *  such tool — its MCP subprocess was spawned with no token and cannot be
+ *  hot-patched (see session/process.ts's writeMcpConfig). */
+function createOauthCallbackRouter(store, pendingStore = pending_oauth_store_1.pendingOAuthStore, returnUrl, agents) {
+    const router = (0, express_1.Router)();
+    // This gateway is a generic, product-agnostic fork — it has no business
+    // hardcoding a downstream product's own domain (e.g. app.example.com).
+    // Whoever deploys it can opt into an auto-redirect by setting
+    // gateway.oauthReturnUrl in config.json; absent that, the plain "close this
+    // tab" message below is the safe default. Validated once, at router
+    // construction — a malformed value degrades to "not configured" rather
+    // than injecting a broken redirect into every future callback response.
+    let validReturnUrl;
+    if (returnUrl) {
+        try {
+            const parsed = new URL(returnUrl);
+            // Scheme-gated, not merely parseable. `new URL()` accepts every scheme
+            // there is — `javascript:`, `data:`, `file:`, `intent:` — and this value's
+            // whole purpose is to become the `Location` of a 302 sent to the end
+            // user's own browser, on a route that is PUBLIC and reachable by anyone
+            // who can hit the gateway. A `javascript:` return URL is a stored XSS
+            // primitive aimed at every user who ever finishes (or abandons) a sign-in,
+            // and `file:` points the browser at the operator's own disk. Nothing an
+            // OAuth flow needs to return to is anything but http(s), so requiring it
+            // costs no real deployment anything.
+            if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+                console.error(`oauth-connectors-router: gateway.oauthReturnUrl "${returnUrl}" is not an http(s) URL — ignoring it`);
+            }
+            else {
+                validReturnUrl = parsed.toString();
+            }
+        }
+        catch {
+            console.error(`oauth-connectors-router: gateway.oauthReturnUrl "${returnUrl}" is not a valid URL — ignoring it`);
+        }
+    }
+    // No interstitial "Connected!" page + timed meta-refresh here on purpose —
+    // that just makes the user wait and watch a flash of gateway-branded HTML
+    // before landing back in the app. A real HTTP redirect goes straight to
+    // validReturnUrl with nothing to look at in between — on EVERY terminal
+    // outcome, not just success (a denied/expired/failed sign-in used to leave
+    // the user stranded on a bare, unbranded gateway page with no way back).
+    // The plain HTML pages below are only for the unconfigured (self-hosted,
+    // no oauthReturnUrl) case, where there's nowhere else to send the browser.
+    const CLOSE_TAB_PAGE = '<h1>Connected — you can close this tab.</h1>';
+    /** Terminal-failure response: redirect back with the reason as a query
+     *  param when the app knows where "back" is, else render it in place. */
+    function fail(res, status, message, errorCode) {
+        if (validReturnUrl) {
+            const url = new URL(validReturnUrl);
+            url.searchParams.set('connector_oauth_error', errorCode);
+            res.redirect(302, url.toString());
+            return;
+        }
+        res.status(status).send(`<h1>${escapeHtml(message)}</h1>`);
+    }
+    /** Is this id still a connector whose credential THIS gateway owns? */
+    async function isGatewayOwned(connectorId) {
+        return (await store.read())[connectorId]?.credentialOwner === 'gateway';
+    }
+    /** Terminal response for a connector that went away (or changed owner) mid-flow. */
+    function failGone(res) {
+        fail(res, 409, 'This connector was removed or handed to another owner while you were signing in — nothing was stored. Add it again and reconnect.', 'connector_gone');
+    }
+    router.get(CALLBACK_PATHS, async (req, res) => {
+        const state = typeof req.query.state === 'string' ? req.query.state : '';
+        const code = typeof req.query.code === 'string' ? req.query.code : '';
+        const providerError = typeof req.query.error === 'string' ? req.query.error : '';
+        const flow = state ? pendingStore.consume(state) : null;
+        if (!flow) {
+            fail(res, 400, 'This sign-in link expired or was already used. Go back and click Connect again.', 'expired_link');
+            return;
+        }
+        if (providerError) {
+            // The message keeps the provider's own words (escaped on the way into our
+            // HTML) — on a self-hosted install that page is the only diagnostic the admin
+            // gets. Only the code, which leaves for someone else's app, is clamped.
+            fail(res, 400, `Sign-in failed: ${providerError}`, safeErrorCode(providerError));
+            return;
+        }
+        if (!code) {
+            fail(res, 400, 'Sign-in failed: no authorization code returned.', 'missing_code');
+            return;
+        }
+        try {
+            // The flow was authorised against the connector as it stood when
+            // /oauth/start ran, and `state` only proves this browser is the one that
+            // started it. It says nothing about the connector still existing, or the
+            // gateway still being the party that owns its credential — and the window
+            // is a full FLOW_TTL_MS (see pending-oauth-store.ts) of the user sitting
+            // on the provider's consent screen. Two things can land inside it:
+            //
+            //   - DELETE /v1/connectors/:id, which clears the credentials precisely so
+            //     a live refresh_token cannot resurrect a connector the admin just
+            //     disconnected. Writing this token set would do exactly that.
+            //   - POST /v1/connectors/:id/oauth/receive, which can hand the id over to
+            //     'external'. The sweep skips a non-'gateway' entry and DELETE only
+            //     clears internal keys for a 'gateway' one, so the CUSTOMINT__* keys
+            //     written here would be orphans nothing ever collects.
+            //
+            // Checked once here — before spending a code on a token nothing will
+            // keep — and again after the exchange, which is the check that actually
+            // closes the race. `store.read()` degrades to {} rather than throwing
+            // (see custom-connectors-store.ts), so an unreadable config fails closed.
+            if (!(await isGatewayOwned(flow.connectorId))) {
+                failGone(res);
+                return;
+            }
+            const token = await (0, mcp_oauth_1.exchangeCode)({
+                metadata: flow.metadata,
+                clientId: flow.clientId,
+                redirectUri: flow.redirectUri,
+                code,
+                codeVerifier: flow.codeVerifier,
+            });
+            // Authoritative re-check: either of the two actions above could have landed
+            // during the exchange round trip, which is the race the pre-check cannot
+            // see. Discarding the token here loses nothing the caller can miss — it was
+            // never stored, and reconnecting mints a fresh one.
+            if (!(await isGatewayOwned(flow.connectorId))) {
+                failGone(res);
+                return;
+            }
+            // One rewrite for the whole result — a crash between separate writes
+            // could leave an access_token filed with no expiry, which the refresh
+            // sweep then reads as "due now" on every tick.
+            (0, token_env_1.updateSecrets)({
+                [(0, custom_1.customSecretKey)(flow.connectorId, 'access_token')]: token.access_token,
+                [(0, oauth_refresh_sweep_1.clientIdSecretKey)(flow.connectorId)]: flow.clientId,
+                ...(token.refresh_token
+                    ? { [(0, oauth_refresh_sweep_1.refreshTokenSecretKey)(flow.connectorId)]: token.refresh_token }
+                    : {}),
+                [(0, oauth_refresh_sweep_1.expiresAtSecretKey)(flow.connectorId)]: String(Date.now() + (token.expires_in ?? 3600) * 1000),
+                // Bumped so the background refresh sweep (oauth-refresh-sweep.ts) can
+                // tell, after its own two-network-round-trip refresh, whether a fresher
+                // token landed here in the meantime — and if so, discard its own
+                // now-stale result instead of clobbering this one.
+                [(0, oauth_refresh_sweep_1.tokenGenerationSecretKey)(flow.connectorId)]: String(Date.now()),
+            }, 
+            // A completed sign-in is as much a fresh start as the sweep's own
+            // successful refresh, and has to clear the same bookkeeping. Leaving it
+            // behind meant a connector the user had just reconnected was still
+            // serving a backoff of up to six hours — so its brand-new one-hour token
+            // expired unrefreshed — while status reported the old failure streak
+            // against it. Worst of the three: a permanent count already sitting at 2
+            // turned the very next refusal into credential deletion, one tick after
+            // a successful sign-in.
+            [
+                (0, oauth_refresh_sweep_1.refreshFailCountSecretKey)(flow.connectorId),
+                (0, oauth_refresh_sweep_1.refreshTransientCountSecretKey)(flow.connectorId),
+                (0, oauth_refresh_sweep_1.refreshBackoffUntilSecretKey)(flow.connectorId),
+                // `client_id` above is written unconditionally; `refresh_token` only
+                // when this response carried one. An AS is entitled to omit it (RFC
+                // 6749 §6, and it happens routinely whenever the granted scopes don't
+                // include `offline_access`), and without this removal the old one
+                // survived — leaving refresh_token R1, issued to client C1, sitting
+                // beside the new client_id C2. The sweep then POSTs that mismatched
+                // pair, the AS answers `invalid_client`, which is classified permanent,
+                // and three ticks later it deletes the sign-in that just succeeded.
+                // The two values are one credential: they are replaced together or not
+                // at all.
+                ...(token.refresh_token ? [] : [(0, oauth_refresh_sweep_1.refreshTokenSecretKey)(flow.connectorId)]),
+            ]);
+            // The connector only just became resolvable; a session spawned before
+            // this holds an MCP config without it. Failure to restart must not turn a
+            // successful sign-in into an error page — the token IS stored — so this
+            // is logged, not surfaced.
+            if (agents) {
+                await Promise.all([...agents.values()].map((runner) => runner.restartSessionsUsingConnector(flow.connectorId).catch((e) => {
+                    console.error(`oauth-connectors-router: restart for connector=${flow.connectorId} failed: ${e.message}`);
+                })));
+            }
+            if (validReturnUrl) {
+                res.redirect(302, validReturnUrl);
+                return;
+            }
+            res.send(CLOSE_TAB_PAGE);
+        }
+        catch (err) {
+            fail(res, 502, `Sign-in failed: ${err.message}`, 'exchange_failed');
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=oauth-connectors-router.js.map

package/dist/api/oauth-connectors-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connectors-router.js","sourceRoot":"","sources":["../../src/api/oauth-connectors-router.ts"],"names":[],"mappings":";;AAqFA,kEAyHC;AA4BD,8DAsNC;AAhcD,qCAAkE;AAElE,iCAA0D;AAE1D,iDAA2E;AAC3E,uDAA8E;AAC9E,qDAA+D;AAC/D,uDAOiC;AACjC,2EAA8F;AAE9F,2EAU2C;AAI3C,8EAA8E;AAC9E,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,0EAA0E;AAC1E,kBAAkB;AAClB,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,2BAA2B,CACzC,OAA6B,EAC7B,aAAgE,EAChE,KAA4B,EAC5B,eAAkC,uCAAiB;IAEnD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,IAAI,OAAO,EAAE,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,IAAA,8BAAuB,EAAC,OAAO,CAAC,CAAC,CAAC;IAElE,SAAS,YAAY,CAAC,GAAY,EAAE,GAAa;QAC/C,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC,IAAA,cAAO,EAAE,GAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,oFAAoF;IACpF,kEAAkE;IAClE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAU,EAAE,EAAE;QACjF,IAAI,CAAC,IAAA,2BAAkB,EAAC,EAAE,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzF,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QACpC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAEzB,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,uBAAuB;QACvB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EACH,KAAK,CAAC,eAAe,KAAK,UAAU;wBAClC,CAAC,CAAC,cAAc,EAAE,0FAA0F,EAAE,wCAAwC;wBACtJ,CAAC,CAAC,cAAc,EAAE,kCAAkC;iBACzD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC;YAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBAC3E,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,oCAAuB,EAAC,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EACH,8GAA8G;aACjH,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,SAAS,qBAAqB,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAA,iCAAqB,EAAC,MAAM,CAAC,CAAC;YACrD,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,iEAAiE;YACjE,8DAA8D;YAC9D,EAAE;YACF,yEAAyE;YACzE,4EAA4E;YAC5E,4EAA4E;YAC5E,4EAA4E;YAC5E,gCAAgC;YAChC,MAAM,cAAc,GAAG,IAAA,qBAAS,EAAC,IAAA,0CAAoB,EAAC,EAAE,CAAC,CAAC,IAAI,IAAA,qBAAS,EAAC,IAAA,uCAAiB,EAAC,EAAE,CAAC,CAAC,CAAC;YAC/F,MAAM,iBAAiB,GAAG,IAAA,qBAAS,EAAC,IAAA,gDAA0B,EAAC,EAAE,CAAC,CAAC,CAAC;YACpE,IAAI,QAAgB,CAAC;YACrB,IAAI,cAAc,IAAI,iBAAiB,KAAK,WAAW,EAAE,CAAC;gBACxD,QAAQ,GAAG,cAAc,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,MAAM,IAAA,2BAAe,EAAC,QAAQ,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;gBAC5D,IAAA,qBAAS,EAAC,IAAA,0CAAoB,EAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC9C,IAAA,qBAAS,EAAC,IAAA,gDAA0B,EAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,IAAA,wBAAY,GAAE,CAAC;YACvD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YACtG,MAAM,KAAK,GAAG,IAAA,wBAAY,EAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACzC,MAAM,YAAY,GAAG,IAAA,6BAAiB,EAAC;gBACrC,QAAQ;gBACR,QAAQ;gBACR,WAAW;gBACX,KAAK;gBACL,aAAa;gBACb,KAAK;aACN,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,cAAc,GAAG,CAAC,qBAAqB,EAAE,6BAA6B,CAAC,CAAC;AAE9E;;;;;;;;6DAQ6D;AAC7D,SAAgB,yBAAyB,CACvC,KAA4B,EAC5B,eAAkC,uCAAiB,EACnD,SAAkB,EAClB,MAAiC;IAEjC,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,wEAAwE;IACxE,uEAAuE;IACvE,8DAA8D;IAC9D,4EAA4E;IAC5E,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,cAAkC,CAAC;IACvC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,uEAAuE;YACvE,2EAA2E;YAC3E,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,2EAA2E;YAC3E,wEAAwE;YACxE,yEAAyE;YACzE,qCAAqC;YACrC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAChE,OAAO,CAAC,KAAK,CACX,oDAAoD,SAAS,uCAAuC,CACrG,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,oDAAoD,SAAS,oCAAoC,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,cAAc,GAAG,8CAA8C,CAAC;IAEtE;6EACyE;IACzE,SAAS,IAAI,CAAC,GAAa,EAAE,MAAc,EAAE,OAAe,EAAE,SAAiB;QAC7E,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;YACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;YACzD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,uEAAuE;IACvE,KAAK,UAAU,cAAc,CAAC,WAAmB;QAC/C,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,eAAe,KAAK,SAAS,CAAC;IAC1E,CAAC;IAED,oFAAoF;IACpF,SAAS,QAAQ,CAAC,GAAa;QAC7B,IAAI,CACF,GAAG,EACH,GAAG,EACH,mIAAmI,EACnI,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/D,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,aAAa,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAEjF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CACF,GAAG,EACH,GAAG,EACH,iFAAiF,EACjF,cAAc,CACf,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,0EAA0E;YAC1E,8EAA8E;YAC9E,wEAAwE;YACxE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,aAAa,EAAE,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,iDAAiD,EAAE,cAAc,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,iEAAiE;YACjE,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,EAAE;YACF,2EAA2E;YAC3E,uEAAuE;YACvE,kEAAkE;YAClE,2EAA2E;YAC3E,wEAAwE;YACxE,yEAAyE;YACzE,2DAA2D;YAC3D,EAAE;YACF,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,0EAA0E;YAC1E,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBAC9C,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAY,EAAC;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC,CAAC,CAAC;YACH,4EAA4E;YAC5E,yEAAyE;YACzE,4EAA4E;YAC5E,oDAAoD;YACpD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBAC9C,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,sEAAsE;YACtE,+CAA+C;YAC/C,IAAA,yBAAa,EACX;gBACE,CAAC,IAAA,wBAAe,EAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY;gBACvE,CAAC,IAAA,uCAAiB,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ;gBACpD,GAAG,CAAC,KAAK,CAAC,aAAa;oBACrB,CAAC,CAAC,EAAE,CAAC,IAAA,2CAAqB,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,aAAa,EAAE;oBACpE,CAAC,CAAC,EAAE,CAAC;gBACP,CAAC,IAAA,wCAAkB,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAC5C,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAC/C;gBACD,sEAAsE;gBACtE,wEAAwE;gBACxE,iEAAiE;gBACjE,mDAAmD;gBACnD,CAAC,IAAA,8CAAwB,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;aACjE;YACD,kEAAkE;YAClE,wEAAwE;YACxE,mEAAmE;YACnE,yEAAyE;YACzE,qEAAqE;YACrE,yEAAyE;YACzE,wEAAwE;YACxE,wBAAwB;YACxB;gBACE,IAAA,+CAAyB,EAAC,IAAI,CAAC,WAAW,CAAC;gBAC3C,IAAA,oDAA8B,EAAC,IAAI,CAAC,WAAW,CAAC;gBAChD,IAAA,kDAA4B,EAAC,IAAI,CAAC,WAAW,CAAC;gBAC9C,qEAAqE;gBACrE,oEAAoE;gBACpE,sEAAsE;gBACtE,kEAAkE;gBAClE,oEAAoE;gBACpE,oEAAoE;gBACpE,wEAAwE;gBACxE,oEAAoE;gBACpE,uEAAuE;gBACvE,UAAU;gBACV,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,2CAAqB,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;aAC1E,CACF,CAAC;YAEF,sEAAsE;YACtE,0EAA0E;YAC1E,wEAAwE;YACxE,2BAA2B;YAC3B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClC,MAAM,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;oBACxE,OAAO,CAAC,KAAK,CACX,kDAAkD,IAAI,CAAC,WAAW,YAAY,CAAC,CAAC,OAAO,EAAE,CAC1F,CAAC;gBACJ,CAAC,CAAC,CACH,CACF,CAAC;YACJ,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAoB,GAAa,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/api/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/api/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM,SAAS,CAAC;AAOpD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAe,WAAW,EAAE,MAAM,UAAU,CAAC;AAiDzE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAExD;AAMD,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAEtD;AAuED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CA4CjD;AAoID,wBAAgB,eAAe,CAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EACtC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EACtC,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,EAAE,GACrB,MAAM,CAgpGR"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/api/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM,SAAS,CAAC;AAOpD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAe,WAAW,EAAE,MAAM,UAAU,CAAC;AAmDzE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAExD;AAMD,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAEtD;AAuED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CA4CjD;AAoID,wBAAgB,eAAe,CAC7B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EACtC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EACtC,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,EAAE,GACrB,MAAM,CAsuGR"}

package/dist/api/router.js

@@ -46,7 +46,9 @@ const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const runner_1 = require("../agent/runner");
 const turn_stream_1 = require("../agent/turn-stream");
+const custom_1 = require("../connectors/custom");
 const agent_env_1 = require("../config/agent-env");
+const config_write_lock_1 = require("../config/config-write-lock");
 const auth_1 = require("./auth");
 const media_store_1 = require("../history/media-store");
 const db_1 = require("../history/db");
@@ -373,8 +375,6 @@ function apiKeyId(key) {
 function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models) {
     const router = (0, express_1.Router)();
     const auth = (0, auth_1.createApiAuthMiddleware)(apiKeys);
-    // Closure-scoped lock: serialises concurrent writes to config.json within this router instance.
-    let configWriteLock = Promise.resolve();
     async function writeAgentsToConfigImpl(cfgPath, mutate, newId) {
         const raw = await fsp.readFile(cfgPath, 'utf-8');
         const config = JSON.parse(raw);
@@ -384,18 +384,14 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
                 throw Object.assign(new Error(`Agent '${newId}' already exists in config`), { code: 'DUPLICATE' });
         }
         mutate(config.agents);
-        const tmp = cfgPath + '.tmp.' + (0, crypto_1.randomUUID)();
-        // mode: 0o600 — config.json carries the admin API key and every agent's
-        // channel bot tokens; rename() onto cfgPath carries this file's mode
-        // with it, so an unmoded tmp file silently downgrades an existing 0600
-        // config to 0644 on its very first edit (issue #460).
-        await fsp.writeFile(tmp, JSON.stringify(config, null, 2), { encoding: 'utf-8', mode: 0o600 });
-        await fsp.rename(tmp, cfgPath);
+        await (0, config_write_lock_1.writeConfigAtomic)(cfgPath, config);
     }
+    // Process-wide, keyed by config path — NOT a lock private to this router. The
+    // connectors store and the app-agent manager rewrite the same file, and a lock
+    // scoped to this closure would serialise agent writes against each other while
+    // still letting one of those clobber them. See config/config-write-lock.ts.
     function writeAgentsToConfig(cfgPath, mutate, newId) {
-        const next = configWriteLock.catch(() => { }).then(() => writeAgentsToConfigImpl(cfgPath, mutate, newId));
-        configWriteLock = next.catch(() => { });
-        return next;
+        return (0, config_write_lock_1.withConfigWriteLock)(cfgPath, () => writeAgentsToConfigImpl(cfgPath, mutate, newId));
     }
     /**
      * GET /api/v1/commands
@@ -719,6 +715,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
             description: cfg.description,
             model: cfg.claude?.model ?? null,
             allow_tools: cfg.allow_tools ?? false,
+            connectors: cfg.connectors ?? {},
             avatarUrl: cfg.avatar ? `/api/v1/agents/${id}/avatar` : null,
             telegram_connected: !!cfg.telegram?.botToken,
             discord_connected: !!cfg.discord?.botToken,
@@ -1452,7 +1449,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
             return;
         }
         const body = req.body;
-        const { name, description, model, allow_tools, telegram_bot_token, discord_bot_token, line_channel_access_token, line_channel_secret, line_dm_policy, line_dm_allowlist, line_group_policy, line_group_allowlist, line_require_mention, line_pairing, slack_bot_token, slack_signing_secret, slack_dm_policy, slack_dm_allowlist, slack_group_policy, slack_group_allowlist, slack_require_mention, slack_pairing } = body;
+        const { name, description, model, allow_tools, telegram_bot_token, discord_bot_token, line_channel_access_token, line_channel_secret, line_dm_policy, line_dm_allowlist, line_group_policy, line_group_allowlist, line_require_mention, line_pairing, slack_bot_token, slack_signing_secret, slack_dm_policy, slack_dm_allowlist, slack_group_policy, slack_group_allowlist, slack_require_mention, slack_pairing, connectors } = body;
         if (name !== undefined && name !== null && typeof name !== 'string') {
             res.status(400).json({ error: 'name must be a string or null' });
             return;
@@ -1604,6 +1601,51 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
         const slackAccessTouched = slack_dm_policy !== undefined || slack_dm_allowlist !== undefined ||
             slack_group_policy !== undefined || slack_group_allowlist !== undefined || slack_require_mention !== undefined ||
             slack_pairing !== undefined;
+        // connectors: a partial map of { [connectorId]: { enabled: boolean } } to merge.
+        const connectorPatch = {};
+        if (connectors !== undefined) {
+            // Admin, unlike the rest of this route. Every connector route is admin-only
+            // (see connectors-router.ts's requireAdmin), and enabling one here reaches the
+            // same credential those routes guard: a connector's secret is resolved into
+            // the agent's mcp-config at spawn, so flipping this flag is what actually
+            // hands an agent the token an admin connected. Under the multi-owner posture
+            // README documents — `gateway.connectorsDefaultEnabled: false`, connectors off
+            // unless named — a `write` key scoped to nothing but its own agent could
+            // otherwise grant that agent any connector on the box. It would not even need
+            // to enumerate them first: ids are label slugs (`github`, `notion`) and the
+            // check below deliberately does not require the id to exist.
+            //
+            // Deliberately field-level rather than route-level: the rest of PATCH is a
+            // `write`-key operation on the caller's own agent (API.md's table) and must
+            // stay that way. Only the field that crosses into another owner's credential
+            // is raised.
+            if (!(0, auth_1.isAdmin)(req.apiKey)) {
+                res.status(403).json({ error: 'Admin permission required to change connectors' });
+                return;
+            }
+            if (typeof connectors !== 'object' || connectors === null || Array.isArray(connectors)) {
+                res.status(400).json({ error: 'connectors must be an object' });
+                return;
+            }
+            for (const [id, val] of Object.entries(connectors)) {
+                // Shape only, not existence: enablement is stored per agent and read back
+                // by id, so an id that can't be a connector id is an entry nothing will
+                // ever match — it just accumulates in config.json. Existence is
+                // deliberately NOT required; enablement defaults to opt-out, so
+                // pre-setting `{enabled: false}` for a connector nobody has added yet is a
+                // legitimate way to keep it off an agent from the moment it appears.
+                if (!(0, custom_1.isValidConnectorId)(id)) {
+                    res.status(400).json({ error: `Invalid connector id '${id}'` });
+                    return;
+                }
+                const enabled = val?.enabled;
+                if (typeof enabled !== 'boolean') {
+                    res.status(400).json({ error: `connectors.${id}.enabled must be a boolean` });
+                    return;
+                }
+                connectorPatch[id] = { enabled };
+            }
+        }
         try {
             await writeAgentsToConfig(configPath, (agents) => {
                 const agent = agents.find((a) => a.id === agentId);
@@ -1753,6 +1795,10 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
                         }
                     }
                 }
+                if (connectors !== undefined) {
+                    const existing = agent.connectors ?? {};
+                    agent.connectors = { ...existing, ...connectorPatch };
+                }
             });
         }
         catch (err) {
@@ -1945,6 +1991,47 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
                     (0, pending_senders_1.clearPendingSender)('slack', agentId, id);
             }
         }
+        if (connectors !== undefined) {
+            const before = cfg.connectors ?? {};
+            const merged = { ...before, ...connectorPatch };
+            // Only respawn when the merged map actually differs. An external panel
+            // that echoes the whole agent form back on every save sends `connectors`
+            // on edits that have nothing to do with connectors, and restarting every
+            // live session for a no-op patch is a visible interruption to whoever is
+            // talking to that agent. The entries are `{enabled: boolean}`, so
+            // comparing that one field per key is the whole comparison.
+            const ids = new Set([...Object.keys(before), ...Object.keys(merged)]);
+            const changed = [...ids].some((id) => before[id]?.enabled !== merged[id]?.enabled);
+            cfg.connectors = merged;
+            // Enablement is read at spawn — respawn live sessions so they pick it up.
+            // The runner's view of the map is updated either way; only the teardown is
+            // conditional, so a no-op patch costs nothing but still leaves the runner
+            // holding the same map that was just written to disk.
+            const runner = agentRunners.get(agentId);
+            if (runner) {
+                runner.updateAgentConfig(cfg);
+                // Same options as AgentRunner.restartSessionsUsingConnector — a connector
+                // enablement change is exactly the same kind of change, so it must not
+                // SIGKILL an idle channel session either. Bare restartOrDefer() defaults
+                // deferIdle to false, which stops idle sessions immediately.
+                //
+                // Caught, because this call sits AFTER the handler's try/catch closes and
+                // restartOrDefer awaits proc.stop() unguarded: on Express 4 a rejection
+                // here escapes the handler entirely and lands in index.ts's
+                // `unhandledRejection` hook, which calls emergencyShutdown() — every agent
+                // on the box killed because one PATCH toggled a connector. The config is
+                // already written and the runner's map already updated at this point, so a
+                // failed teardown costs the caller nothing but a session that respawns on
+                // its own next natural restart. Every sibling call site guards this the
+                // same way (oauth-refresh-sweep.ts's .catch, connectors-router.ts's
+                // restartSessionsUsing).
+                if (changed) {
+                    await runner.restartOrDefer({ skipBusy: false, deferIdle: true }).catch((err) => {
+                        console.error(`router: connector-enablement restart for agent=${agentId} failed: ${err.message}`);
+                    });
+                }
+            }
+        }
         res.json({
             agent: {
                 id: agentId,
@@ -1952,6 +2039,7 @@ function createApiRouter(agentRunners, agentConfigs, apiKeys, configPath, models
                 description: cfg.description,
                 model: cfg.claude?.model,
                 allow_tools: cfg.allow_tools ?? false,
+                connectors: cfg.connectors ?? {},
                 telegram_connected: !!cfg.telegram?.botToken,
                 discord_connected: !!cfg.discord?.botToken,
                 telegram_token_preview: cfg.telegram?.botToken ? maskToken(cfg.telegram.botToken) : null,