@meshagent/meshagent 0.44.12 → 0.45.0

package/dist/node/toolkit-config.js

@@ -180,30 +180,19 @@ class Connector {
         if (connector == null && this.oauth == null) {
             return true;
         }
-        const token = await room.secrets.getOfflineOAuthToken({
-            connector,
-            oauth: this.oauth,
-            delegatedTo: agentName,
-        });
-        return token != null;
+        void room;
+        void agentName;
+        throw new Error("OAuth MCP connections require proxy-backed user secrets");
     }
     async authenticate(client, agent, redirectUri) {
         const connector = this.buildConnectorRef();
         if (connector == null && this.oauth == null) {
             return null;
         }
-        const localParticipant = client.localParticipant;
-        if (localParticipant == null) {
-            throw new Error("Connector.authenticate requires a local participant");
-        }
-        const agentName = agent.getAttribute("name");
-        return await client.secrets.requestOAuthToken({
-            fromParticipantId: localParticipant.id,
-            connector,
-            oauth: this.oauth,
-            redirectUri,
-            delegateTo: agentName == null ? null : String(agentName),
-        });
+        void client;
+        void agent;
+        void redirectUri;
+        throw new Error("OAuth MCP connections require proxy-backed user secrets");
     }
 }
 exports.Connector = Connector;
@@ -259,7 +248,25 @@ function roomServiceMcpServerUrl({ service, port, endpoint, }) {
     const fragment = baseUrl.hash;
     return `${baseUrl.protocol}//${userInfo}${bracketIpv6Host(baseUrl.hostname)}:${portValue}${joinedPath}${query}${fragment}`;
 }
-function mcpConnectorsFromRoomServices({ services, agentName, }) {
+function proxyMcpServerUrl({ serverUrl, useProxySecret, proxyConfig, }) {
+    const secretId = useProxySecret?.trim();
+    if (serverUrl == null || secretId == null || secretId.length === 0 || proxyConfig == null) {
+        return serverUrl;
+    }
+    const apiUrl = proxyConfig.apiUrl.trim().replace(/\/+$/, "");
+    if (apiUrl.length === 0 || proxyConfig.apiKey.trim().length === 0) {
+        throw new Error("meshagent_proxy_config requires apiUrl and apiKey");
+    }
+    const url = new URL(`${apiUrl}/proxy-request`);
+    url.searchParams.set("url", serverUrl);
+    url.searchParams.set("secret-id", secretId);
+    const user = proxyConfig.user?.trim();
+    if (user != null && user.length > 0) {
+        url.searchParams.set("user", user);
+    }
+    return url.toString();
+}
+function mcpConnectorsFromRoomServices({ services, agentName, meshagentProxyConfig, }) {
     const connectors = [];
     for (const service of services) {
         const filter = service.metadata.annotations?.["meshagent.agent.filter"];
@@ -276,12 +283,24 @@ function mcpConnectorsFromRoomServices({ services, agentName, }) {
                     name: mcp.label,
                     server: new MCPServer({
                         serverLabel: mcp.label,
-                        serverUrl: roomServiceMcpServerUrl({ service, port, endpoint }),
-                        headers: headersFromEndpointSpec(mcp.headers),
+                        serverUrl: proxyMcpServerUrl({
+                            serverUrl: roomServiceMcpServerUrl({ service, port, endpoint }),
+                            useProxySecret: mcp.use_proxy_secret,
+                            proxyConfig: meshagentProxyConfig,
+                        }),
+                        headers: mcp.use_proxy_secret != null && meshagentProxyConfig != null
+                            ? [
+                                ...(headersFromEndpointSpec(mcp.headers) ?? []),
+                                new MCPHeader({
+                                    name: "Authorization",
+                                    value: `Bearer ${meshagentProxyConfig.apiKey}`,
+                                }),
+                            ]
+                            : headersFromEndpointSpec(mcp.headers),
                         requireApproval: mcp.require_approval,
                         openaiConnectorId: mcp.openai_connector_id,
                     }),
-                    oauth: mcp.oauth,
+                    oauth: mcp.use_proxy_secret != null ? undefined : mcp.oauth,
                 }));
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meshagent/meshagent",
-    "version": "0.44.12",
+    "version": "0.45.0",
     "description": "Meshagent Client",
     "homepage": "https://github.com/meshagent/meshagent-ts",
     "scripts": {

package/dist/browser/secrets-client.d.ts

@@ -1,112 +0,0 @@
-import type { ConnectorRef, OAuthClientConfig } from "./meshagent-client.js";
-import { FileContent } from "./response.js";
-import { RoomClient } from "./room-client.js";
-export interface SecretInfo {
-    id: string;
-    name: string;
-    type: string;
-    delegatedTo?: string | null;
-}
-export interface OAuthTokenRequest {
-    requestId: string;
-    authorizationEndpoint: string;
-    tokenEndpoint: string;
-    challenge?: string | null;
-    scopes?: string[] | null;
-    clientId?: string | null;
-}
-export type OAuthTokenRequestHandler = (request: OAuthTokenRequest) => Promise<void> | void;
-export interface SecretRequest {
-    requestId: string;
-    url: string;
-    type: string;
-    delegateTo?: string | null;
-}
-export type SecretRequestHandler = (request: SecretRequest) => Promise<void> | void;
-export declare class SecretsClient {
-    private readonly client;
-    private readonly oauthTokenRequestHandler?;
-    private readonly secretRequestHandler?;
-    private readonly _oauthRequestHandler;
-    private readonly _secretRequestHandler;
-    constructor({ room, oauthTokenRequestHandler, secretRequestHandler, }: {
-        room: RoomClient;
-        oauthTokenRequestHandler?: OAuthTokenRequestHandler;
-        secretRequestHandler?: SecretRequestHandler;
-    });
-    private unexpectedResponse;
-    private invoke;
-    private serializeConnectorRef;
-    private serializeOAuthConfig;
-    private parseAccessToken;
-    private parseSecretInfo;
-    private _handleClientOAuthTokenRequest;
-    private _handleClientSecretRequest;
-    provideOAuthAuthorization({ requestId, code, }: {
-        requestId: string;
-        code: string;
-    }): Promise<void>;
-    rejectOAuthAuthorization({ requestId, error, }: {
-        requestId: string;
-        error: string;
-    }): Promise<void>;
-    provideSecret({ requestId, data, }: {
-        requestId: string;
-        data: Uint8Array;
-    }): Promise<void>;
-    rejectSecret({ requestId, error, }: {
-        requestId: string;
-        error: string;
-    }): Promise<void>;
-    getOfflineOAuthToken({ connector, oauth, delegatedTo, delegatedBy, }: {
-        connector?: ConnectorRef | null;
-        oauth?: OAuthClientConfig | null;
-        delegatedTo?: string | null;
-        delegatedBy?: string | null;
-    }): Promise<string | null>;
-    requestOAuthToken({ connector, oauth, timeout, fromParticipantId, redirectUri, delegateTo, }: {
-        connector?: ConnectorRef | null;
-        oauth?: OAuthClientConfig | null;
-        timeout?: number;
-        fromParticipantId: string;
-        redirectUri: string | URL;
-        delegateTo?: string | null;
-    }): Promise<string | null>;
-    listSecrets(): Promise<SecretInfo[]>;
-    exists({ secretId, delegatedTo, forIdentity, }: {
-        secretId: string;
-        delegatedTo?: string | null;
-        forIdentity?: string | null;
-    }): Promise<boolean>;
-    deleteSecret({ secretId, delegatedTo, }: {
-        secretId: string;
-        delegatedTo?: string | null;
-    }): Promise<void>;
-    deleteRequestedSecret({ url, type, delegatedTo, }: {
-        url: string;
-        type: string;
-        delegatedTo?: string | null;
-    }): Promise<void>;
-    requestSecret({ fromParticipantId, url, type, timeout, delegateTo, }: {
-        fromParticipantId: string;
-        url: string;
-        type: string;
-        timeout?: number;
-        delegateTo?: string | null;
-    }): Promise<Uint8Array>;
-    setSecret({ secretId, type, mimeType, name, delegatedTo, forIdentity, data, }: {
-        secretId?: string | null;
-        type?: string | null;
-        mimeType?: string | null;
-        name?: string | null;
-        delegatedTo?: string | null;
-        forIdentity?: string | null;
-        data: Uint8Array;
-    }): Promise<void>;
-    getSecret({ secretId, type, name, delegatedTo, }: {
-        secretId?: string | null;
-        type?: string | null;
-        name?: string | null;
-        delegatedTo?: string | null;
-    }): Promise<FileContent | null>;
-}

package/dist/browser/secrets-client.js

@@ -1,300 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SecretsClient = void 0;
-const response_js_1 = require("./response.js");
-const room_server_client_js_1 = require("./room-server-client.js");
-const utils_js_1 = require("./utils.js");
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-class SecretsClient {
-    constructor({ room, oauthTokenRequestHandler, secretRequestHandler, }) {
-        this._oauthRequestHandler = this._handleClientOAuthTokenRequest.bind(this);
-        this._secretRequestHandler = this._handleClientSecretRequest.bind(this);
-        this.client = room;
-        this.oauthTokenRequestHandler = oauthTokenRequestHandler;
-        this.secretRequestHandler = secretRequestHandler;
-        this.client.protocol.addHandler("secrets.request_oauth_token", this._oauthRequestHandler);
-        this.client.protocol.addHandler("secrets.request_secret", this._secretRequestHandler);
-    }
-    unexpectedResponse(operation) {
-        return new room_server_client_js_1.RoomServerException(`unexpected return type from secrets.${operation}`);
-    }
-    async invoke(operation, input) {
-        return await this.client.invokeContent({
-            toolkit: "secrets",
-            tool: operation,
-            input,
-        });
-    }
-    serializeConnectorRef(connector) {
-        if (connector == null) {
-            return null;
-        }
-        return {
-            openai_connector_id: connector.openaiConnectorId ?? null,
-            server_url: connector.serverUrl ?? null,
-            client_secret_id: connector.clientSecretId ?? null,
-        };
-    }
-    serializeOAuthConfig(oauth) {
-        if (oauth == null) {
-            return null;
-        }
-        return {
-            client_id: oauth.client_id,
-            client_secret: oauth.client_secret ?? null,
-            authorization_endpoint: oauth.authorization_endpoint,
-            token_endpoint: oauth.token_endpoint,
-            no_pkce: oauth.no_pkce ?? null,
-            scopes: oauth.scopes ?? null,
-        };
-    }
-    parseAccessToken(operation, response) {
-        if (!(response instanceof response_js_1.JsonContent)) {
-            throw this.unexpectedResponse(operation);
-        }
-        const token = response.json["access_token"];
-        if (typeof token !== "string" || token.length === 0) {
-            return null;
-        }
-        return token;
-    }
-    parseSecretInfo(value) {
-        if (!isRecord(value) || typeof value["id"] !== "string" || typeof value["name"] !== "string" || typeof value["type"] !== "string") {
-            throw this.unexpectedResponse("list_secrets");
-        }
-        const delegatedTo = value["delegated_to"];
-        if (delegatedTo !== undefined && delegatedTo !== null && typeof delegatedTo !== "string") {
-            throw this.unexpectedResponse("list_secrets");
-        }
-        return {
-            id: value["id"],
-            name: value["name"],
-            type: value["type"],
-            delegatedTo: delegatedTo,
-        };
-    }
-    async _handleClientOAuthTokenRequest(protocol, messageId, type, bytes) {
-        if (!this.client.isActiveProtocol(protocol)) {
-            return;
-        }
-        void messageId;
-        void type;
-        if (bytes == null) {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_oauth_token payload");
-        }
-        if (this.oauthTokenRequestHandler == null) {
-            throw new room_server_client_js_1.RoomServerException("No oauth token handler registered");
-        }
-        const [request] = (0, utils_js_1.unpackMessage)(bytes);
-        const requestId = request["request_id"];
-        const challenge = request["challenge"];
-        const requestPayload = request["request"];
-        if (typeof requestId !== "string" || !isRecord(requestPayload)) {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_oauth_token payload");
-        }
-        const oauth = requestPayload["oauth"];
-        if (!isRecord(oauth) || typeof oauth["authorization_endpoint"] !== "string" || typeof oauth["token_endpoint"] !== "string") {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_oauth_token payload");
-        }
-        const scopes = oauth["scopes"];
-        if (scopes !== undefined && scopes !== null && (!Array.isArray(scopes) || scopes.some((scope) => typeof scope !== "string"))) {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_oauth_token payload");
-        }
-        Promise.resolve(this.oauthTokenRequestHandler({
-            requestId,
-            authorizationEndpoint: oauth["authorization_endpoint"],
-            tokenEndpoint: oauth["token_endpoint"],
-            challenge: typeof challenge === "string" ? challenge : null,
-            scopes: scopes ?? null,
-            clientId: typeof oauth["client_id"] === "string" ? oauth["client_id"] : null,
-        })).catch((error) => {
-            console.warn("OAuth token request handler threw", error);
-        });
-    }
-    async _handleClientSecretRequest(protocol, messageId, type, bytes) {
-        if (!this.client.isActiveProtocol(protocol)) {
-            return;
-        }
-        void messageId;
-        void type;
-        if (bytes == null) {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_secret payload");
-        }
-        if (this.secretRequestHandler == null) {
-            throw new room_server_client_js_1.RoomServerException("No secret handler registered");
-        }
-        const [request] = (0, utils_js_1.unpackMessage)(bytes);
-        const requestId = request["request_id"];
-        const requestPayload = request["request"];
-        if (typeof requestId !== "string" || !isRecord(requestPayload) || typeof requestPayload["url"] !== "string" || typeof requestPayload["type"] !== "string") {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_secret payload");
-        }
-        Promise.resolve(this.secretRequestHandler({
-            requestId,
-            url: requestPayload["url"],
-            type: requestPayload["type"],
-            delegateTo: typeof requestPayload["delegate_to"] === "string" ? requestPayload["delegate_to"] : null,
-        })).catch((error) => {
-            console.warn("Secret request handler threw", error);
-        });
-    }
-    async provideOAuthAuthorization({ requestId, code, }) {
-        const response = await this.invoke("provide_oauth_authorization", {
-            request_id: requestId,
-            code,
-            error: null,
-        });
-        if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
-        }
-        throw this.unexpectedResponse("provide_oauth_authorization");
-    }
-    async rejectOAuthAuthorization({ requestId, error, }) {
-        const response = await this.invoke("provide_oauth_authorization", {
-            request_id: requestId,
-            code: null,
-            error,
-        });
-        if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
-        }
-        throw this.unexpectedResponse("provide_oauth_authorization");
-    }
-    async provideSecret({ requestId, data, }) {
-        const response = await this.invoke("provide_secret", new response_js_1.BinaryContent({
-            data,
-            headers: {
-                request_id: requestId,
-                error: null,
-            },
-        }));
-        if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
-        }
-        throw this.unexpectedResponse("provide_secret");
-    }
-    async rejectSecret({ requestId, error, }) {
-        const response = await this.invoke("provide_secret", new response_js_1.BinaryContent({
-            data: new Uint8Array(0),
-            headers: {
-                request_id: requestId,
-                error,
-            },
-        }));
-        if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
-        }
-        throw this.unexpectedResponse("provide_secret");
-    }
-    async getOfflineOAuthToken({ connector, oauth, delegatedTo, delegatedBy, }) {
-        const response = await this.invoke("get_offline_oauth_token", {
-            connector: this.serializeConnectorRef(connector),
-            oauth: this.serializeOAuthConfig(oauth),
-            delegated_to: delegatedTo ?? null,
-            delegated_by: delegatedBy ?? null,
-        });
-        return this.parseAccessToken("get_offline_oauth_token", response);
-    }
-    async requestOAuthToken({ connector, oauth, timeout = 60 * 5, fromParticipantId, redirectUri, delegateTo, }) {
-        const response = await this.invoke("request_oauth_token", {
-            connector: this.serializeConnectorRef(connector),
-            oauth: this.serializeOAuthConfig(oauth),
-            redirect_uri: typeof redirectUri === "string" ? redirectUri : redirectUri.toString(),
-            timeout,
-            participant_id: fromParticipantId,
-            delegate_to: delegateTo ?? null,
-        });
-        return this.parseAccessToken("request_oauth_token", response);
-    }
-    async listSecrets() {
-        const response = await this.invoke("list_secrets", {});
-        if (!(response instanceof response_js_1.JsonContent)) {
-            throw this.unexpectedResponse("list_secrets");
-        }
-        const secrets = response.json["secrets"];
-        if (!Array.isArray(secrets)) {
-            throw this.unexpectedResponse("list_secrets");
-        }
-        return secrets.map((item) => this.parseSecretInfo(item));
-    }
-    async exists({ secretId, delegatedTo, forIdentity, }) {
-        const response = await this.invoke("exists", {
-            secret_id: secretId,
-            delegated_to: delegatedTo ?? null,
-            for_identity: forIdentity ?? null,
-        });
-        if (!(response instanceof response_js_1.JsonContent) || typeof response.json["exists"] !== "boolean") {
-            throw this.unexpectedResponse("exists");
-        }
-        return response.json["exists"];
-    }
-    async deleteSecret({ secretId, delegatedTo, }) {
-        const response = await this.invoke("delete_secret", {
-            id: secretId,
-            delegated_to: delegatedTo ?? null,
-        });
-        if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
-        }
-        throw this.unexpectedResponse("delete_secret");
-    }
-    async deleteRequestedSecret({ url, type, delegatedTo, }) {
-        const response = await this.invoke("delete_requested_secret", {
-            url,
-            type,
-            delegated_to: delegatedTo ?? null,
-        });
-        if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
-        }
-        throw this.unexpectedResponse("delete_requested_secret");
-    }
-    async requestSecret({ fromParticipantId, url, type, timeout = 60 * 5, delegateTo, }) {
-        const response = await this.invoke("request_secret", {
-            url,
-            type,
-            participant_id: fromParticipantId,
-            timeout,
-            delegate_to: delegateTo ?? null,
-        });
-        if (response instanceof response_js_1.FileContent) {
-            return response.data;
-        }
-        throw this.unexpectedResponse("request_secret");
-    }
-    async setSecret({ secretId, type, mimeType, name, delegatedTo, forIdentity, data, }) {
-        const response = await this.invoke("set_secret", new response_js_1.BinaryContent({
-            data,
-            headers: {
-                secret_id: secretId ?? null,
-                type: type ?? mimeType ?? null,
-                name: name ?? null,
-                delegated_to: delegatedTo ?? null,
-                for_identity: forIdentity ?? null,
-                has_data: true,
-            },
-        }));
-        if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
-        }
-        throw this.unexpectedResponse("set_secret");
-    }
-    async getSecret({ secretId, type, name, delegatedTo, }) {
-        const response = await this.invoke("get_secret", {
-            secret_id: secretId ?? null,
-            type: type ?? null,
-            name: name ?? null,
-            delegated_to: delegatedTo ?? null,
-        });
-        if (response instanceof response_js_1.EmptyContent) {
-            return null;
-        }
-        if (response instanceof response_js_1.FileContent) {
-            return response;
-        }
-        throw this.unexpectedResponse("get_secret");
-    }
-}
-exports.SecretsClient = SecretsClient;

package/dist/esm/secrets-client.d.ts

@@ -1,112 +0,0 @@
-import type { ConnectorRef, OAuthClientConfig } from "./meshagent-client.js";
-import { FileContent } from "./response.js";
-import { RoomClient } from "./room-client.js";
-export interface SecretInfo {
-    id: string;
-    name: string;
-    type: string;
-    delegatedTo?: string | null;
-}
-export interface OAuthTokenRequest {
-    requestId: string;
-    authorizationEndpoint: string;
-    tokenEndpoint: string;
-    challenge?: string | null;
-    scopes?: string[] | null;
-    clientId?: string | null;
-}
-export type OAuthTokenRequestHandler = (request: OAuthTokenRequest) => Promise<void> | void;
-export interface SecretRequest {
-    requestId: string;
-    url: string;
-    type: string;
-    delegateTo?: string | null;
-}
-export type SecretRequestHandler = (request: SecretRequest) => Promise<void> | void;
-export declare class SecretsClient {
-    private readonly client;
-    private readonly oauthTokenRequestHandler?;
-    private readonly secretRequestHandler?;
-    private readonly _oauthRequestHandler;
-    private readonly _secretRequestHandler;
-    constructor({ room, oauthTokenRequestHandler, secretRequestHandler, }: {
-        room: RoomClient;
-        oauthTokenRequestHandler?: OAuthTokenRequestHandler;
-        secretRequestHandler?: SecretRequestHandler;
-    });
-    private unexpectedResponse;
-    private invoke;
-    private serializeConnectorRef;
-    private serializeOAuthConfig;
-    private parseAccessToken;
-    private parseSecretInfo;
-    private _handleClientOAuthTokenRequest;
-    private _handleClientSecretRequest;
-    provideOAuthAuthorization({ requestId, code, }: {
-        requestId: string;
-        code: string;
-    }): Promise<void>;
-    rejectOAuthAuthorization({ requestId, error, }: {
-        requestId: string;
-        error: string;
-    }): Promise<void>;
-    provideSecret({ requestId, data, }: {
-        requestId: string;
-        data: Uint8Array;
-    }): Promise<void>;
-    rejectSecret({ requestId, error, }: {
-        requestId: string;
-        error: string;
-    }): Promise<void>;
-    getOfflineOAuthToken({ connector, oauth, delegatedTo, delegatedBy, }: {
-        connector?: ConnectorRef | null;
-        oauth?: OAuthClientConfig | null;
-        delegatedTo?: string | null;
-        delegatedBy?: string | null;
-    }): Promise<string | null>;
-    requestOAuthToken({ connector, oauth, timeout, fromParticipantId, redirectUri, delegateTo, }: {
-        connector?: ConnectorRef | null;
-        oauth?: OAuthClientConfig | null;
-        timeout?: number;
-        fromParticipantId: string;
-        redirectUri: string | URL;
-        delegateTo?: string | null;
-    }): Promise<string | null>;
-    listSecrets(): Promise<SecretInfo[]>;
-    exists({ secretId, delegatedTo, forIdentity, }: {
-        secretId: string;
-        delegatedTo?: string | null;
-        forIdentity?: string | null;
-    }): Promise<boolean>;
-    deleteSecret({ secretId, delegatedTo, }: {
-        secretId: string;
-        delegatedTo?: string | null;
-    }): Promise<void>;
-    deleteRequestedSecret({ url, type, delegatedTo, }: {
-        url: string;
-        type: string;
-        delegatedTo?: string | null;
-    }): Promise<void>;
-    requestSecret({ fromParticipantId, url, type, timeout, delegateTo, }: {
-        fromParticipantId: string;
-        url: string;
-        type: string;
-        timeout?: number;
-        delegateTo?: string | null;
-    }): Promise<Uint8Array>;
-    setSecret({ secretId, type, mimeType, name, delegatedTo, forIdentity, data, }: {
-        secretId?: string | null;
-        type?: string | null;
-        mimeType?: string | null;
-        name?: string | null;
-        delegatedTo?: string | null;
-        forIdentity?: string | null;
-        data: Uint8Array;
-    }): Promise<void>;
-    getSecret({ secretId, type, name, delegatedTo, }: {
-        secretId?: string | null;
-        type?: string | null;
-        name?: string | null;
-        delegatedTo?: string | null;
-    }): Promise<FileContent | null>;
-}