@stage-labs/metro 0.1.0-beta.178 → 0.1.0-beta.179

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -21,7 +21,7 @@ import {
 } from '../routes/http.js';
 import { agentsDir, fileSource } from '../agents/files.js';
 import { syncPluginServers } from '../connectors/plugin-sync.js';
-import { readLocalConnectors } from '../connectors/store.js';
+import { loadConnectorPolicies, readLocalConnectors } from '../connectors/store.js';
 import { ensureMetroPlugin } from '../claude/plugin-install.js';
 import { unwatchSession, watchSession } from '../claude/session.js';
 import { tryClaudeSetup } from '../claude/setup.js';
@@ -33,7 +33,10 @@ import { ensureStationDeps } from '../stations/runtime-deps.js';
 import { localSessionApis } from '../routes/local-mode.js';
 import type { SessionApis } from '../routes/session-apis.js';
 import { createMetroMcp } from '../mcp/index.js';
+import { startPromptExpiry } from '../approvals/pending.js';
+import { watchPolicySnapshot } from '../mcp/policy-snapshot.js';
 import { gatherAccountsForAgents } from '../mcp/accounts.js';
+import { stationToolGroups } from '../mcp/tool-catalog.js';
 import {
   accountStationCapabilities,
   forgetOrphans,
@@ -107,6 +110,7 @@ function sessionApis(): SessionApis {
       },
       gatherAccounts: gatherAccountsForAgents,
       capabilities: accountStationCapabilities,
+      toolGroups: stationToolGroups,
       prepareAccount,
     });
 }
@@ -116,6 +120,10 @@ async function main(): Promise<void> {
   applyLocalOwner();
 installBearerSessions(agentsDir(), localOwner);
   migrateAgentLayout();
+  watchPolicySnapshot();
+  loadConnectorPolicies().catch((err: unknown) => {
+    log.warn({ err: errMsg(err) }, 'connector policy: loading the policies failed');
+  });
   log.info({ agent: await ensureLocalAgent() }, 'local daemon: agent');
   await materializeFrom(fileSource);
   forgetOrphans(knownAccounts());
@@ -128,6 +136,7 @@ installBearerSessions(agentsDir(), localOwner);
     true,
   );
   metroMcp.startInbound();
+  startPromptExpiry();
   syncPluginServers(readLocalConnectors());
   startUploadReaper();
   startAttachReaper();

package/runtime/node_modules/@metro-labs/daemon/src/channels/inbound.ts

@@ -1,6 +1,7 @@
 import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { str } from '@metro-labs/core/str';
 import { dedupeKey } from './dedupe.js';
+import { PERMISSION_REPLY_RE } from './reply-id.js';
 import {
   buildMediaFailureNote,
   buildMediaNote,
@@ -8,6 +9,7 @@ import {
   type SavedMedia,
 } from './media-note.js';
 import { buildWebhookNote } from './webhook-note.js';
+import { reactContent, reactionEmoji } from './react-note.js';
 import { replyMeta } from './addressed.js';
 import {
   capSet,
@@ -26,26 +28,20 @@ interface InboundDeps {
   getStations: () => Set<string>;
   senderAllowed: (from: string, line: string, verified?: boolean) => boolean;
   approves?: (station: string) => boolean;
+  answerPermission?: (requestId: string, behavior: 'allow' | 'deny', line: string) => Promise<boolean>;
 }
 
 const ATTACH_TIMEOUT_MS = 15_000;
 const DEDUPE_TTL_MS = 30_000;
 const DEDUPE_MAX = 2_000;
 const ALLOWED_LINES_MAX = 2_000;
-const PENDING_PERMISSIONS_MAX = 500;
 const SENT_IDS_MAX = 2_000;
 
-const PERMISSION_REPLY_RE = /^\s*(y|yes|n|no)\s+([a-km-z]{5})\s*$/i;
-
-const shortId = (id: string): string =>
-  id.length > 10 ? `${id.slice(0, 6)}…` : id;
-
 export class InboundRelay {
   private readonly deps: InboundDeps;
   private readonly pendingAttachments = new Map<string, PendingMsg>();
   private readonly seenEvents = new Map<string, number>();
   private readonly allowedLines = new Set<string>();
-  private readonly pendingPermissions = new Map<string, string>();
   private readonly sentIds = new Set<string>();
   private lastLine: string | undefined;
 
@@ -57,15 +53,6 @@ export class InboundRelay {
     return this.lastLine;
   }
 
-  registerPermission(requestId: string, line: string): void {
-    this.pendingPermissions.set(requestId, line);
-    while (this.pendingPermissions.size > PENDING_PERMISSIONS_MAX) {
-      const oldest = this.pendingPermissions.keys().next();
-      if (oldest.done) break;
-      this.pendingPermissions.delete(oldest.value);
-    }
-  }
-
   noteSent(messageId: string): void {
     if (!messageId) return;
     this.sentIds.add(messageId);
@@ -241,9 +228,7 @@ export class InboundRelay {
     const removed =
       (ev.payload as { removed?: boolean } | undefined)?.removed === true ||
       / \(removed\)\]?$/.test(base.text);
-    const verb = removed ? 'removed from' : 'reacted to';
-    const label = removed ? emoji || 'reaction' : emoji || 'reacted';
-    const content = `${label} ${verb} message ${shortId(target)}`.trim();
+    const content = reactContent(emoji, target, removed);
     await this.notify('notifications/claude/channel', {
       content,
       meta: {
@@ -261,18 +246,12 @@ export class InboundRelay {
     });
   }
 
-  private async handlePermissionReply(text: string, line: string): Promise<boolean> {
-    const m = PERMISSION_REPLY_RE.exec(text);
-    if (m?.[1] === undefined || m[2] === undefined || !this.pendingPermissions.size)
-      return false;
-    const id = m[2].toLowerCase();
-    if (this.pendingPermissions.get(id) !== line) return false;
-    this.pendingPermissions.delete(id);
-    await this.notify('notifications/claude/channel/permission', {
-      request_id: id,
-      behavior: m[1].toLowerCase().startsWith('y') ? 'allow' : 'deny',
-    });
-    return true;
+  private async handlePermissionReply(ev: Record<string, unknown>, base: EventBase): Promise<boolean> {
+    const answer = this.deps.answerPermission;
+    if (answer === undefined || base.evType !== 'msg' || !this.approves(base.station) || ev.senderVerified === false) return false;
+    const m = PERMISSION_REPLY_RE.exec(base.text);
+    if (m?.[1] === undefined || m[2] === undefined) return false;
+    return answer(m[2].toLowerCase(), m[1].toLowerCase().startsWith('y') ? 'allow' : 'deny', base.line);
   }
 
   private approves(station: string): boolean {
@@ -334,8 +313,7 @@ export class InboundRelay {
       this.deps.log('drop: empty message', base.station, base.line, str(ev.messageId));
       return;
     }
-    if (base.evType === 'msg' && this.approves(base.station) && (await this.handlePermissionReply(base.text, base.line)))
-      return;
+    if (await this.handlePermissionReply(ev, base)) return;
     await this.notify('notifications/claude/channel', {
       content:
         base.evType === 'system'
@@ -388,8 +366,3 @@ interface EventBase {
   text: string;
 }
 
-function reactionEmoji(raw: unknown): string {
-  if (typeof raw === 'string') return raw;
-  const obj = raw as { name?: string; reaction?: string } | undefined;
-  return obj?.name ?? obj?.reaction ?? '';
-}

package/runtime/node_modules/@metro-labs/daemon/src/channels/react-note.ts

@@ -0,0 +1,13 @@
+const shortId = (id: string): string => (id.length > 10 ? `${id.slice(0, 6)}…` : id);
+
+export function reactionEmoji(raw: unknown): string {
+  if (typeof raw === 'string') return raw;
+  const obj = raw as { name?: string; reaction?: string } | undefined;
+  return obj?.name ?? obj?.reaction ?? '';
+}
+
+export function reactContent(emoji: string, target: string, removed: boolean): string {
+  const verb = removed ? 'removed from' : 'reacted to';
+  const label = removed ? emoji || 'reaction' : emoji || 'reacted';
+  return `${label} ${verb} message ${shortId(target)}`.trim();
+}

package/runtime/node_modules/@metro-labs/daemon/src/channels/reply-id.ts

@@ -0,0 +1 @@
+export const PERMISSION_REPLY_RE = /^\s*(y|yes|n|no)\s+([a-km-z]{5})\s*$/i;

package/runtime/node_modules/@metro-labs/daemon/src/claude/setup.ts

@@ -128,7 +128,10 @@ export function guidancePath(env: NodeJS.ProcessEnv = process.env): string {
 }
 
 const PRIOR_WORKER: ReadonlySet<string> = new Set(['08a0cd8710df285d6512245246bb8b658b7cfc7f3e89490514ee5376779eb2ef']);
-const PRIOR_SKILL: ReadonlySet<string> = new Set(['0b3d122ed95beff09d579cf912cd4238e1db524c41fce4b314de57d6ff5908ad']);
+const PRIOR_SKILL: ReadonlySet<string> = new Set([
+  '0b3d122ed95beff09d579cf912cd4238e1db524c41fce4b314de57d6ff5908ad',
+  '36f4fb57f231a119d717b5e3d6ccb654f94960fcca708683f376679aead8df25',
+]);
 
 const digest = (text: string): string => createHash('sha256').update(text).digest('hex');
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/api.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import { log } from '@metro-labs/core/log';
 import { healthOf } from './health.js';
 import type { RemoteTool } from './tools.js';
+import { normalizePolicy, type ToolPolicy } from '../policy/policy.js';
 import {
   apiFailure,
   apiSession,
@@ -39,6 +40,7 @@ export interface ConnectorApiDeps extends OAuthRouteDeps {
   disconnectConnector: (id: string) => Promise<Connector>;
   renameConnector: (id: string, name: string) => Promise<Connector>;
   deleteConnector: (id: string) => Promise<DeletedConnector>;
+  setConnectorPolicy: (id: string, policy: ToolPolicy) => Promise<Connector>;
 }
 
 type Routable =
@@ -49,7 +51,8 @@ type Routable =
   | { kind: 'tools'; id: string }
   | { kind: 'connect'; id: string }
   | { kind: 'disconnect'; id: string }
-  | { kind: 'rename'; id: string };
+  | { kind: 'rename'; id: string }
+  | { kind: 'policy'; id: string };
 
 type Target = Routable | { kind: 'unknown' } | null;
 
@@ -62,6 +65,7 @@ function subTarget(id: string, rest: string[]): Target {
   if (head === 'connect') return { kind: 'connect', id };
   if (head === 'disconnect') return { kind: 'disconnect', id };
   if (head === 'rename') return { kind: 'rename', id };
+  if (head === 'policy') return { kind: 'policy', id };
   return { kind: 'unknown' };
 }
 
@@ -86,6 +90,7 @@ function connectorPayload(row: Connector): Record<string, unknown> {
     clientId: row.client?.clientId ?? null,
     signIn: row.signIn,
     verified: row.verified,
+    policy: row.policy,
     health: healthOf(row.id),
   };
 }
@@ -202,6 +207,32 @@ async function handleRename(
   sendJson(req, res, 200, connectorPayload(row));
 }
 
+async function handlePolicy(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ConnectorApiDeps,
+  id: string,
+): Promise<void> {
+  const policy = normalizePolicy(bodyField(await readJsonBody(req), 'policy'));
+  const row = await deps.setConnectorPolicy(id, policy);
+  log.info({ id: row.id, name: row.name, policy: row.policy }, 'connector-api: tool policy set');
+  sendJson(req, res, 200, connectorPayload(row));
+}
+
+type ById = Exclude<Routable['kind'], 'collection' | 'callback'>;
+
+const BY_ID: Record<ById, (req: IncomingMessage, res: ServerResponse, deps: ConnectorApiDeps, id: string) => Promise<void>> = {
+  verify: handleVerify,
+  tools: async (req, res, deps, id) => {
+    sendJson(req, res, 200, { tools: await deps.connectorTools(id) });
+  },
+  connect: handleConnect,
+  disconnect: handleDisconnect,
+  rename: handleRename,
+  policy: handlePolicy,
+  connector: handleConnector,
+};
+
 async function route(
   req: IncomingMessage,
   res: ServerResponse,
@@ -210,17 +241,7 @@ async function route(
 ): Promise<void> {
   try {
     if (tgt.kind === 'callback') return;
-    if (tgt.kind === 'verify')
-      await handleVerify(req, res, deps, tgt.id);
-    else if (tgt.kind === 'tools') sendJson(req, res, 200, { tools: await deps.connectorTools(tgt.id) });
-    else if (tgt.kind === 'connect')
-      await handleConnect(req, res, deps, tgt.id);
-    else if (tgt.kind === 'disconnect')
-      await handleDisconnect(req, res, deps, tgt.id);
-    else if (tgt.kind === 'rename')
-      await handleRename(req, res, deps, tgt.id);
-    else if (tgt.kind === 'connector')
-      await handleConnector(req, res, deps, tgt.id);
+    if (tgt.kind !== 'collection') await BY_ID[tgt.kind](req, res, deps, tgt.id);
     else if (req.method === 'GET') await handleList(req, res, deps);
     else await handleCreate(req, res, deps);
   } catch (err) {
@@ -237,6 +258,7 @@ const ALLOWED: Record<Routable['kind'], string[]> = {
   connect: ['POST'],
   disconnect: ['POST'],
   rename: ['POST'],
+  policy: ['PUT'],
 };
 
 async function dispatch(

package/runtime/node_modules/@metro-labs/daemon/src/connectors/config.ts

@@ -6,6 +6,8 @@ import type {
 } from './verify.js';
 import type { OAuthClient } from './oauth-client.js';
 import { isRecord } from '@metro-labs/core/is-record';
+import type { ToolGroup } from '@metro-labs/core/stations/types';
+import { parsePolicy, type ToolPolicy } from '../policy/policy.js';
 
 const CONNECTOR_NAME_MAX = 64;
 const HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;
@@ -24,6 +26,8 @@ export interface ConnectorConfig {
   verified: VerifiedRecord;
   oauth: boolean;
   client: OAuthClient | null;
+  policy?: ToolPolicy;
+  toolGroups?: Record<string, ToolGroup>;
 }
 
 function text(value: unknown): string {
@@ -135,15 +139,30 @@ function readVerified(raw: unknown): VerifiedRecord {
   return { at: text(record.at), server: text(record.server) };
 }
 
+const TOOL_NAME_MAX = 128;
+const TOOL_GROUPS_MAX = 1000;
+
+export function readToolGroups(raw: unknown): Record<string, ToolGroup> | undefined {
+  if (!isRecord(raw)) return undefined;
+  const kept = Object.entries(raw)
+    .filter((entry): entry is [string, ToolGroup] => entry[0].length <= TOOL_NAME_MAX && (entry[1] === 'read' || entry[1] === 'write'))
+    .slice(0, TOOL_GROUPS_MAX);
+  return kept.length > 0 ? Object.fromEntries(kept) : undefined;
+}
+
 export function readConfig(raw: unknown): ConnectorConfig {
   const record = isRecord(raw) ? raw : {};
   const auth = readAuth(record.auth);
+  const policy = parsePolicy(record.policy, 'connectors.json');
+  const toolGroups = readToolGroups(record.toolGroups);
   return {
     auth,
     createdAt: text(record.createdAt),
     verified: readVerified(record.verified),
     oauth: record.oauth === true || auth.kind === 'oauth',
     client: readClient(record.client),
+    ...(policy === undefined || Object.keys(policy).length === 0 ? {} : { policy }),
+    ...(toolGroups === undefined ? {} : { toolGroups }),
   };
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/gates.ts

@@ -0,0 +1,63 @@
+import type { ToolGroup } from '@metro-labs/core/stations/types';
+import { policyFor, setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
+import { serverKeysOf } from './plugin-sync.js';
+
+interface GateRow {
+  id: string;
+  name: string;
+  config: { policy?: ToolPolicy; toolGroups?: Record<string, ToolGroup> };
+}
+
+export interface ConnectorGate {
+  id: string;
+  name: string;
+  server: string;
+  policy: ToolPolicy;
+  tools: Record<string, ToolGroup>;
+}
+
+let gates: ConnectorGate[] = [];
+
+const normalized = (name: string): string => name.replace(/[^a-zA-Z0-9_-]/g, '_');
+
+export function registerConnectors(rows: readonly GateRow[]): void {
+  const keys = serverKeysOf([...rows]);
+  gates = rows.map((row) => ({
+    id: row.id,
+    name: row.name,
+    server: keys.get(row.id) ?? '',
+    policy: row.config.policy ?? {},
+    tools: row.config.toolGroups ?? {},
+  }));
+  const entries = rows.flatMap((row): [PolicyTarget, ToolPolicy][] =>
+    row.config.policy === undefined ? [] : [[{ kind: 'connector', id: row.id }, row.config.policy]],
+  );
+  setPolicies('connector', entries);
+}
+
+export const connectorGates = (): readonly ConnectorGate[] => gates;
+
+export const toolGroupOf = (gate: ConnectorGate, tool: string): ToolGroup => (gate.tools[tool] === 'read' ? 'read' : 'write');
+
+export function blockedReason(connectorId: string, tool: string): string | null {
+  const gate = gates.find((g) => g.id === connectorId);
+  if (gate === undefined) return null;
+  const access = policyFor({ kind: 'connector', id: connectorId }, { name: tool, group: toolGroupOf(gate, tool) });
+  return access === 'deny' ? `Blocked by the owner's policy for ${gate.name} (${tool}).` : null;
+}
+
+function prefixesOf(gate: ConnectorGate): string[] {
+  return [`mcp__plugin_metro_${gate.server}__`, `mcp__${gate.server}__`, `mcp__${normalized(`metro.box ${gate.name}`)}__`];
+}
+
+export function connectorToolOf(toolName: string): { gate: ConnectorGate; tool: string } | undefined {
+  if (toolName.startsWith('mcp__metro__')) return undefined;
+  for (const gate of gates)
+    for (const prefix of prefixesOf(gate))
+      if (toolName.startsWith(prefix) && toolName.length > prefix.length) {
+        const called = toolName.slice(prefix.length);
+        const known = [...Object.keys(gate.tools), ...Object.keys(gate.policy.tools ?? {})];
+        return { gate, tool: known.find((name) => name === called) ?? known.find((name) => normalized(name) === called) ?? called };
+      }
+  return undefined;
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/plugin-sync.ts

@@ -30,16 +30,21 @@ export function serverKey(name: string): string {
   return slug === '' ? 'connector' : slug;
 }
 
-export function pluginServers(rows: PluginRow[], base: string): Record<string, PluginServer> {
+export function serverKeysOf(rows: PluginRow[]): Map<string, string> {
   const taken = new Map<string, number>();
-  const out: Record<string, PluginServer> = {};
+  const keys = new Map<string, string>();
   for (const row of rows) {
     const wanted = serverKey(row.name);
     const seen = taken.get(wanted) ?? 0;
     taken.set(wanted, seen + 1);
-    const key = seen === 0 ? wanted : `${wanted}-${row.id.toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 4)}`;
-    out[key] = { type: 'http', url: `${base}/relay/${row.id}`, headersHelper: HELPER };
+    keys.set(row.id, seen === 0 ? wanted : `${wanted}-${row.id.toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 4)}`);
   }
+  return keys;
+}
+
+export function pluginServers(rows: PluginRow[], base: string): Record<string, PluginServer> {
+  const out: Record<string, PluginServer> = {};
+  for (const [id, key] of serverKeysOf(rows)) out[key] = { type: 'http', url: `${base}/relay/${id}`, headersHelper: HELPER };
   return out;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay-policy.ts

@@ -0,0 +1,85 @@
+import type { ServerResponse } from 'node:http';
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+
+export type BlockedReason = (connectorId: string, tool: string) => string | null;
+
+export interface Screened {
+  forward: Uint8Array<ArrayBuffer> | null;
+  answers: Record<string, unknown>[];
+  batch: boolean;
+}
+
+const encoder = new TextEncoder();
+
+function parsed(body: Uint8Array): unknown {
+  try {
+    return JSON.parse(new TextDecoder().decode(body));
+  } catch {
+    return undefined;
+  }
+}
+
+function toolOf(message: unknown): string | null {
+  if (!isRecord(message) || message.method !== 'tools/call' || !isRecord(message.params)) return null;
+  const name = message.params.name;
+  return typeof name === 'string' ? name : null;
+}
+
+function blockedAnswer(message: Record<string, unknown>, reason: string): Record<string, unknown> | null {
+  if (!('id' in message)) return null;
+  return { jsonrpc: '2.0', id: message.id, result: { isError: true, content: [{ type: 'text', text: reason }] } };
+}
+
+function reasonFor(message: unknown, connectorId: string, blocked: BlockedReason): string | null {
+  const tool = toolOf(message);
+  return tool === null ? null : blocked(connectorId, tool);
+}
+
+export function screenCalls(body: Uint8Array<ArrayBuffer>, connectorId: string, blocked: BlockedReason): Screened | null {
+  const message = parsed(body);
+  const batch = Array.isArray(message);
+  const list: unknown[] = batch ? message : [message];
+  const answers: Record<string, unknown>[] = [];
+  const kept: unknown[] = [];
+  for (const item of list) {
+    const reason = reasonFor(item, connectorId, blocked);
+    if (reason === null || !isRecord(item)) {
+      kept.push(item);
+      continue;
+    }
+    log.info({ connector: connectorId, tool: toolOf(item) }, 'relay: a call the owner blocked was answered without the connector');
+    const answer = blockedAnswer(item, reason);
+    if (answer !== null) answers.push(answer);
+  }
+  if (kept.length === list.length) return null;
+  const forward = kept.length === 0 ? null : new Uint8Array(encoder.encode(JSON.stringify(kept)));
+  return { forward, answers, batch };
+}
+
+export function answerBlocked(res: ServerResponse, screened: Screened): void {
+  if (res.headersSent) return;
+  if (screened.answers.length === 0) {
+    res.writeHead(202).end();
+    return;
+  }
+  const body = screened.batch ? screened.answers : screened.answers[0];
+  res.writeHead(200, { 'content-type': 'application/json' });
+  res.end(JSON.stringify(body));
+}
+
+const sseFrames = (answers: Record<string, unknown>[]): string =>
+  answers.map((answer) => `event: message\ndata: ${JSON.stringify(answer)}\n\n`).join('');
+
+export async function mergeBlocked(res: ServerResponse, upstream: Response, headers: Record<string, string>, answers: Record<string, unknown>[]): Promise<void> {
+  const text = await upstream.text();
+  if ((headers['content-type'] ?? '').includes('text/event-stream')) {
+    res.writeHead(upstream.status, headers);
+    res.end(`${text}${sseFrames(answers)}`);
+    return;
+  }
+  const theirs = text.trim() === '' ? [] : parsed(encoder.encode(text));
+  const list: unknown[] = Array.isArray(theirs) ? theirs : theirs === undefined || theirs === null ? [] : [theirs];
+  res.writeHead(200, { ...headers, 'content-type': 'application/json' });
+  res.end(JSON.stringify([...list, ...answers]));
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay.ts

@@ -5,11 +5,13 @@ import type { RelayTarget } from './relay-target.js';
 import type { AgentIdentity } from '@metro-labs/http/api-http';
 import { ApiError } from '@metro-labs/http/api-error';
 import { errMsg, log } from '@metro-labs/core/log';
+import { answerBlocked, mergeBlocked, screenCalls, type BlockedReason } from './relay-policy.js';
 
 export interface RelayApiDeps {
   target: (connectorId: string, force: boolean) => Promise<RelayTarget>;
   identify: (req: IncomingMessage) => AgentIdentity | null;
   signedOut: (connectorId: string) => void;
+  blocked?: BlockedReason;
 }
 
 const ID_PATH_RE = /^\/relay\/([A-Za-z0-9][A-Za-z0-9_-]{10})$/;
@@ -172,12 +174,21 @@ async function pumpBody(
   }
 }
 
-async function pipe(res: ServerResponse, upstream: Response): Promise<void> {
+function passedHeaders(upstream: Response): Record<string, string> {
   const headers: Record<string, string> = {};
   for (const name of PASS_RES) {
     const value = upstream.headers.get(name);
     if (value !== null) headers[name] = value;
   }
+  return headers;
+}
+
+async function pipe(res: ServerResponse, upstream: Response, answers: Record<string, unknown>[]): Promise<void> {
+  const headers = passedHeaders(upstream);
+  if (answers.length > 0 && (upstream.status === 200 || upstream.status === 202)) {
+    await mergeBlocked(res, upstream, headers, answers);
+    return;
+  }
   const sse = (headers['content-type'] ?? '').includes('text/event-stream');
   if (sse) headers['x-accel-buffering'] = 'no';
   res.writeHead(upstream.status, headers);
@@ -246,21 +257,13 @@ async function relayExchange(
   }
 }
 
-async function relayOnce(
-  req: IncomingMessage,
+async function deliver(
   res: ServerResponse,
   connectorId: string,
   deps: RelayApiDeps,
-  signal: AbortSignal,
+  out: Exchanged,
+  answers: Record<string, unknown>[],
 ): Promise<void> {
-  const body = req.method === 'POST' ? await readCapped(req) : null;
-  const out = await exchange(
-    req,
-    connectorId,
-    deps,
-    body,
-    signal,
-  );
   if (out.kind === 'missing') {
     answer(res, 404, { error: 'no such connector' });
     return;
@@ -279,7 +282,24 @@ async function relayOnce(
   }
   const { status } = out.upstream;
   noteHealth(connectorId, status < 400, status < 400 ? null : `the connector answered ${String(status)}`);
-  await pipe(res, out.upstream);
+  await pipe(res, out.upstream, answers);
+}
+
+async function relayOnce(
+  req: IncomingMessage,
+  res: ServerResponse,
+  connectorId: string,
+  deps: RelayApiDeps,
+  signal: AbortSignal,
+): Promise<void> {
+  const read = req.method === 'POST' ? await readCapped(req) : null;
+  const screened = read === null || deps.blocked === undefined ? null : screenCalls(read, connectorId, deps.blocked);
+  if (screened?.forward === null) {
+    answerBlocked(res, screened);
+    return;
+  }
+  const out = await exchange(req, connectorId, deps, screened === null ? read : screened.forward, signal);
+  await deliver(res, connectorId, deps, out, screened?.answers ?? []);
 }
 
 function dispatch(