@stage-labs/metro 0.1.0-beta.26 → 0.1.0-beta.261

package/runtime/node_modules/@metro-labs/daemon/src/claude/version.ts

@@ -0,0 +1,113 @@
+import { spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ApiError } from '@metro-labs/http/api-error';
+import { errMsg, log } from '@metro-labs/core/log';
+import { isRecord } from '@metro-labs/core/is-record';
+import { sessionRunning, stopSession, type SessionDeps } from './session.js';
+import { agentUser, asAgent, claudeBin } from '../agent-user/user.js';
+
+const LATEST_URL = 'https://registry.npmjs.org/@anthropic-ai/claude-code/latest';
+const VERSION_RE = /(\d+)\.(\d+)\.(\d+)/;
+const CACHE_MS = 10 * 60_000;
+const INSTALL_TIMEOUT_MS = 5 * 60_000;
+const TAIL = 400;
+
+export interface VersionDeps {
+  claude?: string;
+  fetchImpl?: typeof fetch;
+  session?: SessionDeps;
+  now?: () => number;
+}
+
+export interface ClaudeVersion {
+  installed: string | null;
+  latest: string | null;
+  newer: boolean;
+}
+
+let cached: { latest: string | null; at: number } | null = null;
+
+function candidates(deps: VersionDeps): string[] {
+  if (deps.claude !== undefined) return [deps.claude];
+  return agentUser() === null ? ['claude', join(homedir(), '.local', 'bin', 'claude')] : [claudeBin()];
+}
+
+const parse = (text: string): string | null => {
+  const m = VERSION_RE.exec(text);
+  return m === null ? null : `${m[1] ?? ''}.${m[2] ?? ''}.${m[3] ?? ''}`;
+};
+
+function probe(bin: string): string | null {
+  const run = spawnSync(...asAgent(bin, ['--version']), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  return run.error === undefined && run.status === 0 && typeof run.stdout === 'string' ? parse(run.stdout) : null;
+}
+
+function located(deps: VersionDeps): { bin: string; installed: string } | null {
+  for (const bin of candidates(deps)) {
+    const installed = probe(bin);
+    if (installed !== null) return { bin, installed };
+  }
+  return null;
+}
+
+export function newerThan(a: string, b: string): boolean {
+  const left = a.split('.').map(Number);
+  const right = b.split('.').map(Number);
+  for (let i = 0; i < 3; i += 1) {
+    const d = (left[i] ?? 0) - (right[i] ?? 0);
+    if (d !== 0) return d > 0;
+  }
+  return false;
+}
+
+async function latestClaudeVersion(deps: VersionDeps = {}): Promise<string | null> {
+  const now = (deps.now ?? Date.now)();
+  if (cached !== null && now - cached.at < CACHE_MS) return cached.latest;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  let latest: string | null = null;
+  try {
+    const res = await fetchImpl(LATEST_URL, { headers: { accept: 'application/json' }, redirect: 'manual' });
+    const body: unknown = res.ok ? await res.json() : null;
+    latest = isRecord(body) && typeof body.version === 'string' ? parse(body.version) : null;
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'claude-version: could not read the latest version from npm');
+  }
+  cached = { latest, at: now };
+  return latest;
+}
+
+export function forgetClaudeVersion(): void {
+  cached = null;
+}
+
+export async function claudeVersion(deps: VersionDeps = {}): Promise<ClaudeVersion> {
+  const installed = located(deps)?.installed ?? null;
+  const latest = await latestClaudeVersion(deps);
+  return { installed, latest, newer: installed !== null && latest !== null && newerThan(latest, installed) };
+}
+
+function install(bin: string): void {
+  const run = spawnSync(...asAgent(bin, ['install', 'latest']), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: INSTALL_TIMEOUT_MS });
+  if (run.error !== undefined) throw new ApiError(`claude install latest failed: ${errMsg(run.error)}`, 502);
+  if (run.status === 0) return;
+  const said = `${run.stderr ?? ''}${run.stdout ?? ''}`.trim().slice(-TAIL);
+  throw new ApiError(`claude install latest failed: ${said}`, 502);
+}
+
+function restartIfChanged(changed: boolean, session: SessionDeps): boolean {
+  if (!changed || !sessionRunning(session.tmux ?? 'tmux')) return false;
+  stopSession(session);
+  return true;
+}
+
+export async function updateClaude(deps: VersionDeps = {}): Promise<ClaudeVersion & { restarted: boolean }> {
+  const found = located(deps);
+  if (found === null) throw new ApiError('Claude Code is not installed on this machine', 404);
+  install(found.bin);
+  forgetClaudeVersion();
+  const after = await claudeVersion(deps);
+  const restarted = restartIfChanged(after.installed !== null && after.installed !== found.installed, deps.session ?? {});
+  log.info({ from: found.installed, to: after.installed, restarted }, 'claude-version: Claude Code updated');
+  return { ...after, restarted };
+}

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/connector-api.ts → daemon/src/connectors/api.ts}

@@ -1,83 +1,44 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
+import { log } from '@metro-labs/core/log';
+import { healthOf } from './health.js';
+import type { RemoteTool } from './tools.js';
+import { normalizePolicy, type ToolPolicy } from '../policy/policy.js';
 import {
   apiFailure,
   apiSession,
-  projectParam,
   bodyField,
   cors,
   readJsonBody,
   sendJson,
-  type ApiSession,
-} from './api-http.js';
-import { parseId } from '../db/ids.js';
-import type { ConnectorCollectionRow } from '../db/connector-collections.js';
-import type { RelayServerEntry } from './connector-json.js';
+  stringOf,
+} from '@metro-labs/http/api-http';
+import { parseId } from '@metro-labs/core/ids';
 import {
   handleCallback,
   handleConnect,
   hostOf,
   startOAuth,
   type OAuthRouteDeps,
-} from './connector-oauth-routes.js';
-import { ConnectorUnauthorized } from './connector-verify.js';
+} from './oauth-routes.js';
+import { ConnectorUnauthorized } from './verify.js';
 import type {
   Connector,
   ConnectorCheck,
   ConnectorInput,
   DeletedConnector,
-} from '../db/connectors.js';
+} from './store.js';
 
 const PREFIX = '/api/connectors';
 
-const asText = (value: unknown): string =>
-  typeof value === 'string' ? value : '';
-
 export interface ConnectorApiDeps extends OAuthRouteDeps {
-  listConnectors: (email: string, project: string) => Promise<Connector[]>;
-  connectorNamesByIds: (ids: string[]) => Promise<RelayServerEntry[]>;
-  listCollections: (
-    email: string,
-    project: string,
-  ) => Promise<ConnectorCollectionRow[]>;
-  getCollection: (email: string, id: string) => Promise<ConnectorCollectionRow>;
-  createCollection: (
-    email: string,
-    project: string,
-    name: string,
-  ) => Promise<ConnectorCollectionRow>;
-  renameCollection: (
-    email: string,
-    id: string,
-    name: string,
-  ) => Promise<ConnectorCollectionRow>;
-  deleteCollection: (
-    email: string,
-    id: string,
-  ) => Promise<{ id: string; name: string }>;
-  addToCollection: (
-    email: string,
-    id: string,
-    connectorId: string,
-  ) => Promise<ConnectorCollectionRow>;
-  removeFromCollection: (
-    email: string,
-    id: string,
-    connectorId: string,
-  ) => Promise<ConnectorCollectionRow>;
-  createConnector: (
-    email: string,
-    project: string,
-    input: ConnectorInput,
-  ) => Promise<Connector>;
-  verifyConnector: (email: string, id: string) => Promise<ConnectorCheck>;
-  disconnectConnector: (email: string, id: string) => Promise<Connector>;
-  renameConnector: (
-    email: string,
-    id: string,
-    name: string,
-  ) => Promise<Connector>;
-  deleteConnector: (email: string, id: string) => Promise<DeletedConnector>;
+  listConnectors: () => Promise<Connector[]>;
+  createConnector: (input: ConnectorInput) => Promise<Connector>;
+  verifyConnector: (id: string) => Promise<ConnectorCheck>;
+  connectorTools: (id: string) => Promise<RemoteTool[]>;
+  disconnectConnector: (id: string) => Promise<Connector>;
+  renameConnector: (id: string, name: string) => Promise<Connector>;
+  deleteConnector: (id: string) => Promise<DeletedConnector>;
+  setConnectorPolicy: (id: string, policy: ToolPolicy) => Promise<Connector>;
 }
 
 type Routable =
@@ -85,9 +46,11 @@ type Routable =
   | { kind: 'callback' }
   | { kind: 'connector'; id: string }
   | { kind: 'verify'; id: string }
+  | { kind: 'tools'; id: string }
   | { kind: 'connect'; id: string }
   | { kind: 'disconnect'; id: string }
-  | { kind: 'rename'; id: string };
+  | { kind: 'rename'; id: string }
+  | { kind: 'policy'; id: string };
 
 type Target = Routable | { kind: 'unknown' } | null;
 
@@ -96,9 +59,11 @@ function subTarget(id: string, rest: string[]): Target {
   if (rest.length > 1) return { kind: 'unknown' };
   const head = rest[0];
   if (head === 'verify') return { kind: 'verify', id };
+  if (head === 'tools') return { kind: 'tools', id };
   if (head === 'connect') return { kind: 'connect', id };
   if (head === 'disconnect') return { kind: 'disconnect', id };
   if (head === 'rename') return { kind: 'rename', id };
+  if (head === 'policy') return { kind: 'policy', id };
   return { kind: 'unknown' };
 }
 
@@ -113,20 +78,18 @@ function target(path: string): Target {
   return id === null ? { kind: 'unknown' } : subTarget(id, segments.slice(1));
 }
 
-function connectorPayload(
-  row: Connector,
-  detail = false,
-): Record<string, unknown> {
-  const { catalog, ...summary } = row.verified;
+function connectorPayload(row: Connector): Record<string, unknown> {
   return {
     id: row.id,
     name: row.name,
     url: row.url,
-    transport: row.transport,
     auth: row.auth,
     header: row.header,
+    clientId: row.client?.clientId ?? null,
     signIn: row.signIn,
-    verified: detail ? { ...summary, catalog } : summary,
+    verified: row.verified,
+    policy: row.policy,
+    health: healthOf(row.id),
   };
 }
 
@@ -134,14 +97,8 @@ async function handleList(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
 ): Promise<void> {
-  const project = projectParam(req);
-  if (project === null) {
-    sendJson(req, res, 400, { error: 'a project is required' });
-    return;
-  }
-  const rows = await deps.listConnectors(session.email, project);
+  const rows = await deps.listConnectors();
   sendJson(req, res, 200, {
     connectors: rows.map((row) => connectorPayload(row)),
   });
@@ -151,21 +108,17 @@ async function handleCreate(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
 ): Promise<void> {
   const body = await readJsonBody(req);
-  const project = projectParam(req);
-  if (project === null) {
-    sendJson(req, res, 400, { error: 'a project is required' });
-    return;
-  }
-  const offered = asText(bodyField(body, 'value')).trim() !== '';
+  const offered = stringOf(bodyField(body, 'value')).trim() !== '';
   try {
-    const created = await deps.createConnector(session.email, project, {
+    const created = await deps.createConnector({
       name: bodyField(body, 'name'),
       url: bodyField(body, 'url'),
       header: bodyField(body, 'header'),
       value: bodyField(body, 'value'),
+      clientId: bodyField(body, 'clientId'),
+      clientSecret: bodyField(body, 'clientSecret'),
     });
     log.info(
       { id: created.id, name: created.name, host: hostOf(created.url) },
@@ -174,7 +127,7 @@ async function handleCreate(
     sendJson(req, res, 201, connectorPayload(created));
   } catch (err) {
     if (offered || !(err instanceof ConnectorUnauthorized)) throw err;
-    await startOAuth(req, res, deps, session, project, body, (row) =>
+    await startOAuth(req, res, deps, body, (row) =>
       connectorPayload(row),
     );
   }
@@ -184,10 +137,9 @@ async function handleVerify(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   id: string,
 ): Promise<void> {
-  const check = await deps.verifyConnector(session.email, id);
+  const check = await deps.verifyConnector(id);
   log.info(
     { id: check.id, name: check.name, ok: check.ok },
     'connector-api: re-verified connector',
@@ -199,10 +151,9 @@ async function handleDisconnect(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   id: string,
 ): Promise<void> {
-  const row = await deps.disconnectConnector(session.email, id);
+  const row = await deps.disconnectConnector(id);
   log.info(
     { id: row.id, name: row.name },
     'connector-api: signed the connector out',
@@ -214,10 +165,9 @@ async function handleDelete(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   id: string,
 ): Promise<void> {
-  const gone = await deps.deleteConnector(session.email, id);
+  const gone = await deps.deleteConnector(id);
   log.info(
     { id: gone.id, name: gone.name },
     'connector-api: deleted connector',
@@ -229,22 +179,20 @@ async function handleConnector(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   id: string,
 ): Promise<void> {
   if (req.method !== 'GET') {
-    await handleDelete(req, res, deps, session, id);
+    await handleDelete(req, res, deps, id);
     return;
   }
-  const row = await deps.getConnector(session.email, id);
-  sendJson(req, res, 200, connectorPayload(row, true));
+  const row = await deps.getConnector(id);
+  sendJson(req, res, 200, connectorPayload(row));
 }
 
 async function handleRename(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   id: string,
 ): Promise<void> {
   const name = bodyField(await readJsonBody(req), 'name');
@@ -252,32 +200,48 @@ async function handleRename(
     sendJson(req, res, 400, { error: 'name is required' });
     return;
   }
-  const row = await deps.renameConnector(session.email, id, name);
+  const row = await deps.renameConnector(id, name);
   log.info({ id: row.id, name: row.name }, 'connector-api: renamed connector');
   sendJson(req, res, 200, connectorPayload(row));
 }
 
+async function handlePolicy(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ConnectorApiDeps,
+  id: string,
+): Promise<void> {
+  const policy = normalizePolicy(bodyField(await readJsonBody(req), 'policy'));
+  const row = await deps.setConnectorPolicy(id, policy);
+  log.info({ id: row.id, name: row.name, policy: row.policy }, 'connector-api: tool policy set');
+  sendJson(req, res, 200, connectorPayload(row));
+}
+
+type ById = Exclude<Routable['kind'], 'collection' | 'callback'>;
+
+const BY_ID: Record<ById, (req: IncomingMessage, res: ServerResponse, deps: ConnectorApiDeps, id: string) => Promise<void>> = {
+  verify: handleVerify,
+  tools: async (req, res, deps, id) => {
+    sendJson(req, res, 200, { tools: await deps.connectorTools(id) });
+  },
+  connect: handleConnect,
+  disconnect: handleDisconnect,
+  rename: handleRename,
+  policy: handlePolicy,
+  connector: handleConnector,
+};
+
 async function route(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   tgt: Routable,
 ): Promise<void> {
   try {
     if (tgt.kind === 'callback') return;
-    if (tgt.kind === 'verify')
-      await handleVerify(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'connect')
-      await handleConnect(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'disconnect')
-      await handleDisconnect(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'rename')
-      await handleRename(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'connector')
-      await handleConnector(req, res, deps, session, tgt.id);
-    else if (req.method === 'GET') await handleList(req, res, deps, session);
-    else await handleCreate(req, res, deps, session);
+    if (tgt.kind !== 'collection') await BY_ID[tgt.kind](req, res, deps, tgt.id);
+    else if (req.method === 'GET') await handleList(req, res, deps);
+    else await handleCreate(req, res, deps);
   } catch (err) {
     apiFailure(req, res, err, 'connector-api');
   }
@@ -288,12 +252,14 @@ const ALLOWED: Record<Routable['kind'], string[]> = {
   callback: ['GET'],
   connector: ['GET', 'DELETE'],
   verify: ['POST'],
+  tools: ['GET'],
   connect: ['POST'],
   disconnect: ['POST'],
   rename: ['POST'],
+  policy: ['PUT'],
 };
 
-function dispatch(
+async function dispatch(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
@@ -301,14 +267,14 @@ function dispatch(
 ): Promise<void> {
   if (tgt.kind === 'callback') {
     handleCallback(req, res, deps);
-    return Promise.resolve();
+    return;
   }
-  const session = apiSession(req);
+  const session = await apiSession(req);
   if (!session) {
     sendJson(req, res, 401, { error: 'unauthorized' });
-    return Promise.resolve();
+    return;
   }
-  return route(req, res, deps, session, tgt);
+  await route(req, res, deps, tgt);
 }
 
 export function handleConnectorApiRequest(
@@ -331,9 +297,8 @@ export function handleConnectorApiRequest(
     return true;
   }
   dispatch(req, res, deps, tgt).catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'connector-api: unhandled error');
-    if (!res.headersSent)
-      sendJson(req, res, 500, { error: 'connector api failed' });
+    if (res.headersSent) return;
+    apiFailure(req, res, err, 'connector-api');
   });
   return true;
 }

package/runtime/node_modules/@metro-labs/{mcp/src/db/connector-config.ts → daemon/src/connectors/config.ts}

@@ -1,14 +1,20 @@
-import { ApiError } from '../daemon/api-error.js';
+import { ApiError } from '@metro-labs/http/api-error';
+import { stringOf } from '@metro-labs/http/api-http';
 import type {
   ConnectorAuth,
   VerifiedRecord,
   VerifiedServer,
-} from '../daemon/connector-verify.js';
-import { readStoredTools } from '../daemon/connector-tools.js';
+} from './verify.js';
+import type { OAuthClient } from './oauth-client.js';
+import { isRecord } from '@metro-labs/core/is-record';
+import type { ToolGroup } from '@metro-labs/core/stations/types';
+import { parsePolicy, type ToolPolicy } from '../policy/policy.js';
 
 const CONNECTOR_NAME_MAX = 64;
 const HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;
 const HEADER_VALUE_RE = /^[\x20-\x7e]{1,4096}$/;
+const CLIENT_ID_RE = /^[\x21-\x7e]{1,256}$/;
+const CLIENT_SECRET_RE = /^[\x21-\x7e]{1,1024}$/;
 const DEFAULT_HEADER = 'Authorization';
 
 export class ConnectorError extends ApiError {}
@@ -20,14 +26,9 @@ export interface ConnectorConfig {
   createdAt: string;
   verified: VerifiedRecord;
   oauth: boolean;
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-function text(value: unknown): string {
-  return typeof value === 'string' ? value : '';
+  client: OAuthClient | null;
+  policy?: ToolPolicy;
+  toolGroups?: Record<string, ToolGroup>;
 }
 
 function hasControlChar(value: string): boolean {
@@ -58,8 +59,8 @@ export function connectorAuth(
   rawHeader: unknown,
   rawValue: unknown,
 ): ConnectorAuth {
-  const header = text(rawHeader).trim();
-  const value = text(rawValue).trim();
+  const header = stringOf(rawHeader).trim();
+  const value = stringOf(rawValue).trim();
   if (header === '' && value === '') return { kind: 'none' };
   if (value === '')
     throw new ConnectorError(
@@ -74,22 +75,48 @@ export function connectorAuth(
   return { kind: 'header', name, value };
 }
 
+export function connectorClient(
+  rawId: unknown,
+  rawSecret: unknown,
+): OAuthClient | null {
+  const clientId = stringOf(rawId).trim();
+  const clientSecret = stringOf(rawSecret).trim();
+  if (clientId === '' && clientSecret === '') return null;
+  if (clientId === '')
+    throw new ConnectorError('a client secret needs the client ID it belongs to', 400);
+  if (!CLIENT_ID_RE.test(clientId))
+    throw new ConnectorError('that is not a client ID Metro can send', 400);
+  if (clientSecret !== '' && !CLIENT_SECRET_RE.test(clientSecret))
+    throw new ConnectorError('that client secret is not sendable', 400);
+  return { clientId, ...(clientSecret === '' ? {} : { clientSecret }) };
+}
+
+function readClient(raw: unknown): OAuthClient | null {
+  if (!isRecord(raw)) return null;
+  const clientId = stringOf(raw.clientId);
+  if (clientId === '') return null;
+  const clientSecret = stringOf(raw.clientSecret);
+  return { clientId, ...(clientSecret === '' ? {} : { clientSecret }) };
+}
+
 function readOAuth(raw: Record<string, unknown>): ConnectorAuth {
-  const accessToken = text(raw.accessToken);
-  const clientId = text(raw.clientId);
-  const tokenEndpoint = text(raw.tokenEndpoint);
+  const accessToken = stringOf(raw.accessToken);
+  const clientId = stringOf(raw.clientId);
+  const tokenEndpoint = stringOf(raw.tokenEndpoint);
   if (accessToken === '' || clientId === '' || tokenEndpoint === '')
     return { kind: 'none' };
-  const refreshToken = text(raw.refreshToken);
-  const clientSecret = text(raw.clientSecret);
+  const refreshToken = stringOf(raw.refreshToken);
+  const clientSecret = stringOf(raw.clientSecret);
+  const scope = stringOf(raw.scope);
   return {
     kind: 'oauth',
     accessToken,
     clientId,
     tokenEndpoint,
-    issuer: text(raw.issuer),
+    issuer: stringOf(raw.issuer),
     ...(refreshToken === '' ? {} : { refreshToken }),
     ...(clientSecret === '' ? {} : { clientSecret }),
+    ...(scope === '' ? {} : { scope }),
     ...(typeof raw.expiresAt === 'number' ? { expiresAt: raw.expiresAt } : {}),
   };
 }
@@ -98,34 +125,41 @@ function readAuth(raw: unknown): ConnectorAuth {
   if (!isRecord(raw)) return { kind: 'none' };
   if (raw.kind === 'oauth') return readOAuth(raw);
   if (raw.kind !== 'header') return { kind: 'none' };
-  const name = text(raw.name);
-  const value = text(raw.value);
+  const name = stringOf(raw.name);
+  const value = stringOf(raw.value);
   if (name === '' || value === '') return { kind: 'none' };
   return { kind: 'header', name, value };
 }
 
 function readVerified(raw: unknown): VerifiedRecord {
   const record = isRecord(raw) ? raw : {};
-  const catalog = readStoredTools(record.catalog);
-  return {
-    at: text(record.at),
-    server: text(record.server),
-    version: text(record.version),
-    protocol: text(record.protocol),
-    icon: text(record.icon),
-    tools: typeof record.tools === 'number' ? record.tools : 0,
-    catalog,
-  };
+  return { at: stringOf(record.at), server: stringOf(record.server) };
+}
+
+const TOOL_NAME_MAX = 128;
+const TOOL_GROUPS_MAX = 1000;
+
+function readToolGroups(raw: unknown): Record<string, ToolGroup> | undefined {
+  if (!isRecord(raw)) return undefined;
+  const kept = Object.entries(raw)
+    .filter((entry): entry is [string, ToolGroup] => entry[0].length <= TOOL_NAME_MAX && (entry[1] === 'read' || entry[1] === 'write'))
+    .slice(0, TOOL_GROUPS_MAX);
+  return kept.length > 0 ? Object.fromEntries(kept) : undefined;
 }
 
 export function readConfig(raw: unknown): ConnectorConfig {
   const record = isRecord(raw) ? raw : {};
   const auth = readAuth(record.auth);
+  const policy = parsePolicy(record.policy, 'connectors.json');
+  const toolGroups = readToolGroups(record.toolGroups);
   return {
     auth,
-    createdAt: text(record.createdAt),
+    createdAt: stringOf(record.createdAt),
     verified: readVerified(record.verified),
     oauth: record.oauth === true || auth.kind === 'oauth',
+    client: readClient(record.client),
+    ...(policy === undefined || Object.keys(policy).length === 0 ? {} : { policy }),
+    ...(toolGroups === undefined ? {} : { toolGroups }),
   };
 }
 
@@ -135,13 +169,5 @@ export function signInState(config: ConnectorConfig): ConnectorSignIn {
 }
 
 export function stamp(server: VerifiedServer): VerifiedRecord {
-  return {
-    at: new Date().toISOString(),
-    server: server.server,
-    version: server.version,
-    protocol: server.protocol,
-    icon: server.icon,
-    tools: server.tools,
-    catalog: server.catalog,
-  };
+  return { at: new Date().toISOString(), server: server.server };
 }