@exposify/express 0.3.15 → 0.3.16

package/README.md

@@ -192,6 +192,18 @@ decide what they can do. The startup log says which it is
 agents sign in" page. Adding a sign-in method there takes effect within a
 minute.
 
+### The `<ConnectAgents />` component
+
+With the hosted broker on, `/mcp` also answers [`@exposify/react`](https://www.npmjs.com/package/@exposify/react)'s
+`<ConnectAgents />` component — a "Connect your AI assistant" UI you can drop
+into your own app. The component `fetch`es your `/mcp` with a custom `Accept`
+header and gets back JSON (your app name, look, and ready-to-render install
+clients). `aiReady()` serves it automatically, **before the auth gate**, so
+the component works signed out, and with permissive CORS so it can live on a
+different origin than your API. There's nothing to add — it's on whenever the
+hosted broker is. Turn the component off from the dashboard switch (it then
+renders nothing).
+
 ## "Click Connect and log in" (OAuth)
 
 By default the MCP client has to be handed a token by hand. If your app's

package/dist/index.cjs

@@ -574,12 +574,13 @@ function aiReady(options = {}) {
   const gate = cfg.oauth ? (0, import_core6.createOAuthGate)(cfg.oauth) : null;
   const metadataPaths = cfg.oauth ? prmPaths(cfg.oauth.resource) : /* @__PURE__ */ new Set();
   const brokerGate = !gate && cfg.docsAuth === "required" ? (0, import_core6.createBrokerGate)(cfg.auth) : null;
-  const resourceOf = (req, path, mcpPath) => {
+  const publicMcpUrl = (req, path, mcpPath) => {
     const original = String(req.originalUrl ?? req.url).split("?")[0];
     const prefix = original.endsWith(path) ? original.slice(0, original.length - path.length) : "";
     const local = `${req.protocol ?? "http"}://${req.headers.host ?? "localhost"}${prefix}${mcpPath}`;
-    return brokerGate.resourceFor((0, import_core6.publicRequestUrl)(local, headersOf(req), { trustForwardedHost: trustsProxy(req) }));
+    return (0, import_core6.publicRequestUrl)(local, headersOf(req), { trustForwardedHost: trustsProxy(req) });
   };
+  const resourceOf = (req, path, mcpPath) => brokerGate.resourceFor(publicMcpUrl(req, path, mcpPath));
   const cwd = options.cwd ?? process.cwd();
   const mounts = options.mounts;
   const brokerInfo = (0, import_core6.hostedResolverInfo)(cfg.auth);
@@ -698,62 +699,73 @@ function aiReady(options = {}) {
       return;
     }
     if (path !== MCP_PATH && !path.startsWith(`${MCP_PATH}/`)) return next();
-    if (disabled) {
-      res.writeHead(503).end("agemno is disabled due to an internal error");
+    const handleMcp = () => {
+      if (disabled) {
+        res.writeHead(503).end("agemno is disabled due to an internal error");
+        return;
+      }
+      const authorized = gate ? gate.check(headersOf(req)).then(async (result) => {
+        if (result.ok) return { claims: result.claims };
+        await sendWebResponse(res, result.response);
+        return null;
+      }, (err) => {
+        console.warn("[agemno] oauth gate failed:", err);
+        if (!res.headersSent) res.writeHead(503).end("authorization check failed");
+        return null;
+      }) : brokerGate ? report(req, resourceOf(req, path, MCP_PATH)).then(async (verdict) => {
+        if (verdict === "open") return {};
+        const result = await brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH));
+        if (result.ok) return {};
+        await sendWebResponse(res, result.response);
+        return null;
+      }).catch((err) => {
+        console.warn("[agemno] broker check failed:", err);
+        if (!res.headersSent) res.writeHead(503).end("authorization check failed");
+        return null;
+      }) : Promise.resolve({});
+      authorized.then((authContext) => {
+        if (!authContext) return;
+        handlerPromise ??= initialize(
+          req.app,
+          cfg,
+          cwd,
+          mounts,
+          { descriptions, openapi },
+          (surface) => logSurface(surface.routes, surface.docs.length, "updated: routes registered after startup")
+        );
+        return handlerPromise.then(
+          (handler) => (
+            // Tool calls made while handling this request reach the app with
+            // this caller's address and forwarding headers (see surface.ts).
+            runAsCaller(callerOf(req), () => handler(req, res, authContext))
+          )
+        );
+      }).catch((err) => {
+        disabled = true;
+        handlerPromise = null;
+        if (!warned) {
+          warned = true;
+          console.error(
+            (0, import_core6.formatFailed)(
+              LOG_PREFIX,
+              errorMessage(err),
+              `${MCP_PATH} now answers 503 until the process restarts (your own routes are unaffected); full error below`
+            ),
+            err
+          );
+        }
+        if (!res.headersSent) res.writeHead(503).end("agemno failed to initialize");
+      });
+    };
+    if (brokerInfo) {
+      const mcpUrl = brokerInfo.resource ?? (brokerGate ? resourceOf(req, path, MCP_PATH) : publicMcpUrl(req, path, MCP_PATH));
+      void (0, import_core6.serveConnectInfo)(new Request(mcpUrl, { method: req.method, headers: headersOf(req) }), brokerInfo, mcpUrl).then((info) => info ? sendWebResponse(res, info) : handleMcp()).catch((err) => {
+        console.warn("[agemno] connect-info failed:", err);
+        handleMcp();
+      });
       return;
     }
-    const authorized = gate ? gate.check(headersOf(req)).then(async (result) => {
-      if (result.ok) return { claims: result.claims };
-      await sendWebResponse(res, result.response);
-      return null;
-    }, (err) => {
-      console.warn("[agemno] oauth gate failed:", err);
-      if (!res.headersSent) res.writeHead(503).end("authorization check failed");
-      return null;
-    }) : brokerGate ? report(req, resourceOf(req, path, MCP_PATH)).then(async (verdict) => {
-      if (verdict === "open") return {};
-      const result = await brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH));
-      if (result.ok) return {};
-      await sendWebResponse(res, result.response);
-      return null;
-    }).catch((err) => {
-      console.warn("[agemno] broker check failed:", err);
-      if (!res.headersSent) res.writeHead(503).end("authorization check failed");
-      return null;
-    }) : Promise.resolve({});
-    authorized.then((authContext) => {
-      if (!authContext) return;
-      handlerPromise ??= initialize(
-        req.app,
-        cfg,
-        cwd,
-        mounts,
-        { descriptions, openapi },
-        (surface) => logSurface(surface.routes, surface.docs.length, "updated: routes registered after startup")
-      );
-      return handlerPromise.then(
-        (handler) => (
-          // Tool calls made while handling this request reach the app with
-          // this caller's address and forwarding headers (see surface.ts).
-          runAsCaller(callerOf(req), () => handler(req, res, authContext))
-        )
-      );
-    }).catch((err) => {
-      disabled = true;
-      handlerPromise = null;
-      if (!warned) {
-        warned = true;
-        console.error(
-          (0, import_core6.formatFailed)(
-            LOG_PREFIX,
-            errorMessage(err),
-            `${MCP_PATH} now answers 503 until the process restarts (your own routes are unaffected); full error below`
-          ),
-          err
-        );
-      }
-      if (!res.headersSent) res.writeHead(503).end("agemno failed to initialize");
-    });
+    handleMcp();
   };
   async function serveLoginPage(req, res, login) {
     const original = String(req.originalUrl ?? req.url);

package/dist/index.js

@@ -24,6 +24,7 @@ import {
   loginResultFromResponse,
   publicRequestUrl,
   reportAppLogin,
+  serveConnectInfo,
   verifyFields as verifyFields2,
   resolveOptions,
   routeToolsPhrase,
@@ -582,12 +583,13 @@ function aiReady(options = {}) {
   const gate = cfg.oauth ? createOAuthGate(cfg.oauth) : null;
   const metadataPaths = cfg.oauth ? prmPaths(cfg.oauth.resource) : /* @__PURE__ */ new Set();
   const brokerGate = !gate && cfg.docsAuth === "required" ? createBrokerGate(cfg.auth) : null;
-  const resourceOf = (req, path, mcpPath) => {
+  const publicMcpUrl = (req, path, mcpPath) => {
     const original = String(req.originalUrl ?? req.url).split("?")[0];
     const prefix = original.endsWith(path) ? original.slice(0, original.length - path.length) : "";
     const local = `${req.protocol ?? "http"}://${req.headers.host ?? "localhost"}${prefix}${mcpPath}`;
-    return brokerGate.resourceFor(publicRequestUrl(local, headersOf(req), { trustForwardedHost: trustsProxy(req) }));
+    return publicRequestUrl(local, headersOf(req), { trustForwardedHost: trustsProxy(req) });
   };
+  const resourceOf = (req, path, mcpPath) => brokerGate.resourceFor(publicMcpUrl(req, path, mcpPath));
   const cwd = options.cwd ?? process.cwd();
   const mounts = options.mounts;
   const brokerInfo = hostedResolverInfo(cfg.auth);
@@ -706,62 +708,73 @@ function aiReady(options = {}) {
       return;
     }
     if (path !== MCP_PATH && !path.startsWith(`${MCP_PATH}/`)) return next();
-    if (disabled) {
-      res.writeHead(503).end("agemno is disabled due to an internal error");
+    const handleMcp = () => {
+      if (disabled) {
+        res.writeHead(503).end("agemno is disabled due to an internal error");
+        return;
+      }
+      const authorized = gate ? gate.check(headersOf(req)).then(async (result) => {
+        if (result.ok) return { claims: result.claims };
+        await sendWebResponse(res, result.response);
+        return null;
+      }, (err) => {
+        console.warn("[agemno] oauth gate failed:", err);
+        if (!res.headersSent) res.writeHead(503).end("authorization check failed");
+        return null;
+      }) : brokerGate ? report(req, resourceOf(req, path, MCP_PATH)).then(async (verdict) => {
+        if (verdict === "open") return {};
+        const result = await brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH));
+        if (result.ok) return {};
+        await sendWebResponse(res, result.response);
+        return null;
+      }).catch((err) => {
+        console.warn("[agemno] broker check failed:", err);
+        if (!res.headersSent) res.writeHead(503).end("authorization check failed");
+        return null;
+      }) : Promise.resolve({});
+      authorized.then((authContext) => {
+        if (!authContext) return;
+        handlerPromise ??= initialize(
+          req.app,
+          cfg,
+          cwd,
+          mounts,
+          { descriptions, openapi },
+          (surface) => logSurface(surface.routes, surface.docs.length, "updated: routes registered after startup")
+        );
+        return handlerPromise.then(
+          (handler) => (
+            // Tool calls made while handling this request reach the app with
+            // this caller's address and forwarding headers (see surface.ts).
+            runAsCaller(callerOf(req), () => handler(req, res, authContext))
+          )
+        );
+      }).catch((err) => {
+        disabled = true;
+        handlerPromise = null;
+        if (!warned) {
+          warned = true;
+          console.error(
+            formatFailed(
+              LOG_PREFIX,
+              errorMessage(err),
+              `${MCP_PATH} now answers 503 until the process restarts (your own routes are unaffected); full error below`
+            ),
+            err
+          );
+        }
+        if (!res.headersSent) res.writeHead(503).end("agemno failed to initialize");
+      });
+    };
+    if (brokerInfo) {
+      const mcpUrl = brokerInfo.resource ?? (brokerGate ? resourceOf(req, path, MCP_PATH) : publicMcpUrl(req, path, MCP_PATH));
+      void serveConnectInfo(new Request(mcpUrl, { method: req.method, headers: headersOf(req) }), brokerInfo, mcpUrl).then((info) => info ? sendWebResponse(res, info) : handleMcp()).catch((err) => {
+        console.warn("[agemno] connect-info failed:", err);
+        handleMcp();
+      });
       return;
     }
-    const authorized = gate ? gate.check(headersOf(req)).then(async (result) => {
-      if (result.ok) return { claims: result.claims };
-      await sendWebResponse(res, result.response);
-      return null;
-    }, (err) => {
-      console.warn("[agemno] oauth gate failed:", err);
-      if (!res.headersSent) res.writeHead(503).end("authorization check failed");
-      return null;
-    }) : brokerGate ? report(req, resourceOf(req, path, MCP_PATH)).then(async (verdict) => {
-      if (verdict === "open") return {};
-      const result = await brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH));
-      if (result.ok) return {};
-      await sendWebResponse(res, result.response);
-      return null;
-    }).catch((err) => {
-      console.warn("[agemno] broker check failed:", err);
-      if (!res.headersSent) res.writeHead(503).end("authorization check failed");
-      return null;
-    }) : Promise.resolve({});
-    authorized.then((authContext) => {
-      if (!authContext) return;
-      handlerPromise ??= initialize(
-        req.app,
-        cfg,
-        cwd,
-        mounts,
-        { descriptions, openapi },
-        (surface) => logSurface(surface.routes, surface.docs.length, "updated: routes registered after startup")
-      );
-      return handlerPromise.then(
-        (handler) => (
-          // Tool calls made while handling this request reach the app with
-          // this caller's address and forwarding headers (see surface.ts).
-          runAsCaller(callerOf(req), () => handler(req, res, authContext))
-        )
-      );
-    }).catch((err) => {
-      disabled = true;
-      handlerPromise = null;
-      if (!warned) {
-        warned = true;
-        console.error(
-          formatFailed(
-            LOG_PREFIX,
-            errorMessage(err),
-            `${MCP_PATH} now answers 503 until the process restarts (your own routes are unaffected); full error below`
-          ),
-          err
-        );
-      }
-      if (!res.headersSent) res.writeHead(503).end("agemno failed to initialize");
-    });
+    handleMcp();
   };
   async function serveLoginPage(req, res, login) {
     const original = String(req.originalUrl ?? req.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/express",
-  "version": "0.3.15",
+  "version": "0.3.16",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",