@stage-labs/metro 0.1.0-beta.293 → 0.1.0-beta.294

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.293",
+  "version": "0.1.0-beta.294",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.293",
+  "version": "0.1.0-beta.294",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-control.ts

@@ -71,7 +71,9 @@ function callFailure(error: unknown, action: string): ApiError {
 
 function received(record: MigrationRecord, snapshot: DeliverySnapshot): boolean {
   const delivered = snapshot.connectors.find((row) => row.id === record.destinationId);
-  return delivered?.state === 'ready' && delivered.name === record.name && samePolicy(delivered.policy, record.policy);
+  if (delivered?.state !== 'ready' || delivered.name !== record.name) return false;
+  const layers = delivered.policyLayers;
+  return layers === undefined ? samePolicy(delivered.policy, record.policy) : samePolicy(layers.organization, record.policy) && samePolicy(layers.agent, {});
 }
 
 export class ConnectorMigrations {

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-runtime-discovery.ts

@@ -1,7 +1,7 @@
 import type { FetchLike } from '@metro-labs/core/stations/oauth';
 import type { ToolGroup } from '@metro-labs/core/stations/types';
 import { ApiError } from '@metro-labs/http/api-error';
-import type { DeliveredConnector } from '@metro-labs/http/connector-delivery';
+import { validConnectorToolName, type DeliveredConnector } from '@metro-labs/http/connector-delivery';
 import { MetroApiRefusal } from './metro-api.js';
 import { listRemoteTools } from './tools.js';
 
@@ -106,8 +106,8 @@ export async function discoverOrgGroups(url: string, guard: DiscoveryGuard): Pro
     if (failure.error !== null) throw failure.error;
     guard.current();
     guard.signal.throwIfAborted();
-    if (tools.length > MAX_TOOLS) throw orgUnavailable();
-    return Object.fromEntries(tools.filter((tool) => /^[A-Za-z0-9_.-]{1,128}$/.test(tool.name)).map((tool) => [tool.name, tool.readOnly ? 'read' : 'write']));
+    if (tools.length > MAX_TOOLS || tools.some((tool) => !validConnectorToolName(tool.name))) throw orgUnavailable();
+    return Object.fromEntries(tools.map((tool) => [tool.name, tool.readOnly ? 'read' : 'write']));
   } catch (error) {
     throw orgRuntimeError(error);
   }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-runtime.ts

@@ -3,7 +3,7 @@ import { agentsDir } from '../agents/files.js';
 import { assertMigrationOutcomeKnown, beginMigrationOperation, migrationRequestEffectful, type MigrationOperation } from './migration-operations.js';
 import type { FetchLike } from '@metro-labs/core/stations/oauth';
 import type { ToolGroup } from '@metro-labs/core/stations/types';
-import type { DeliveredConnector } from '@metro-labs/http/connector-delivery';
+import { effectiveConnectorPolicy, type DeliveredConnector } from '@metro-labs/http/connector-delivery';
 import type { ApiError } from '@metro-labs/http/api-error';
 import { requestConnectorBlocker, type GateRow } from './gates.js';
 import { publishOrgConnectors } from './publication.js';
@@ -49,7 +49,7 @@ interface Session {
 
 const stampOf = (row: RuntimeRow): string => JSON.stringify([
   row.relayId, row.relayName, row.name, row.url, row.auth, row.policy.read ?? 'allow', row.policy.write ?? 'allow',
-  Object.entries(row.policy.tools ?? {}).sort(([a], [b]) => a.localeCompare(b)),
+  Object.entries(row.policy.tools ?? {}).sort(([a], [b]) => a.localeCompare(b)), row.policyLayers,
 ]);
 
 const rowError = (row: DeliveredConnector | undefined): ApiError | null => {
@@ -94,7 +94,7 @@ export class OrgConnectorRuntime {
   private publish(rows: RuntimeRow[]): void {
     const metadata: GateRow[] = rows.filter((row) => row.state === 'ready').map((row) => ({
       id: row.relayId, name: row.relayName,
-      config: { policy: structuredClone(row.policy), toolGroups: { ...this.entries.get(row.id)?.groups } },
+      config: { policy: effectiveConnectorPolicy(row, this.entries.get(row.id)?.groups ?? {}), toolGroups: { ...this.entries.get(row.id)?.groups } },
     }));
     const text = JSON.stringify(metadata);
     if (text === this.published) return;
@@ -230,15 +230,21 @@ export class OrgConnectorRuntime {
   private discover(entry: Entry): Promise<void> | null {
     if (entry.scan !== null) return entry.scan;
     if (performance.now() < entry.nextScan) {
-      if (entry.error !== null) throw entry.error;
+      if (entry.error !== null) {
+        log.debug({ stage: 'discovery_backoff', status: entry.error.status }, 'organization connectors: request unavailable');
+        throw entry.error;
+      }
       return null;
     }
-    if (this.scans >= 4) throw orgUnavailable();
+    if (this.scans >= 4) {
+      log.debug({ stage: 'discovery_capacity', active: this.scans }, 'organization connectors: request unavailable');
+      throw orgUnavailable();
+    }
     this.scans += 1;
     entry.scan = this.scan(entry).catch((error: unknown) => {
       entry.error = orgRuntimeError(error);
       entry.nextScan = performance.now() + 30_000;
-      log.debug({ status: entry.error.status }, 'organization connectors: tool discovery failed');
+      log.debug({ stage: 'tool_discovery', status: entry.error.status }, 'organization connectors: tool discovery failed');
       throw entry.error;
     }).finally(() => {
       this.scans -= 1;

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync-control.ts

@@ -11,6 +11,7 @@ import type { RelaySession } from './relay-session.js';
 import type { DeliverySnapshot } from '@metro-labs/http/connector-delivery';
 import { localMigrationIdle, migrationRuntimeMapping } from './migration-guard.js';
 import { publishConnectors } from './publication.js';
+import { orgRuntimeError, orgUnavailable } from './org-runtime-discovery.js';
 
 type ControlDeps = Pick<OrgSyncDeps, 'owner' | 'key' | 'monotonic'> & { api?: MetroApi; dir?: string };
 type Context = Pick<ConnectorSyncStatus, 'owner' | 'agentId' | 'scope' | 'enrolled'>;
@@ -163,10 +164,22 @@ export class OrgConnectorControl {
     this.clear();
   }
 
-  open(id: string): RelaySession {
+  async open(id: string): Promise<RelaySession> {
     if (this.runtime === null && !syncOptedIn(this.dir)) throw new ApiError('Organization connectors are not available on this agent.', 503);
     this.reconcile(true);
-    if (this.runtime === null) throw new ApiError('Organization connectors are not available on this agent.', 503);
-    return this.runtime.open(id);
+    const runtime = this.runtime;
+    const sync = this.sync;
+    if (runtime === null || sync === null) throw new ApiError('Organization connectors are not available on this agent.', 503);
+    const state = sync.status().state;
+    try {
+      await sync.recover();
+      this.reconcile(false);
+      if (this.runtime !== runtime || this.sync !== sync) throw orgUnavailable();
+    } catch (error) {
+      const safe = orgRuntimeError(error);
+      log.debug({ stage: 'receipt_open', state, status: safe.status }, 'organization connectors: request unavailable');
+      throw safe;
+    }
+    return runtime.open(id);
   }
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync-watch.ts

@@ -13,7 +13,7 @@ function control(): OrgConnectorControl {
   return active;
 }
 
-export function orgConnectorRelaySession(id: string): RelaySession | null {
+export function orgConnectorRelaySession(id: string): Promise<RelaySession> | null {
   return isOrgRelayId(id) || migrationSource(id)?.phase === 'active' ? control().open(id) : null;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync.ts

@@ -47,6 +47,7 @@ export class OrgConnectorSync {
   private wallDeadline = 0;
   private generation = 0;
   private running: Promise<void> | null = null;
+  private recovery: Promise<void> | null = null;
   private expiry: ReturnType<typeof setTimeout> | null = null;
   private readonly monotonic: () => number;
   private readonly listeners = new Set<() => void>();
@@ -153,6 +154,12 @@ export class OrgConnectorSync {
     return this.running;
   }
 
+  recover(): Promise<void> {
+    if (this.read() !== null) return Promise.resolve();
+    this.recovery ??= this.syncFresh().finally(() => { this.recovery = null; });
+    return this.recovery;
+  }
+
   async syncFresh(refresh?: RefreshRequest): Promise<void> {
     if (this.running !== null) {
       await this.running.catch(() => {
@@ -167,7 +174,7 @@ export class OrgConnectorSync {
     const context = { ...identity.context, requestId };
     const started = this.deps.api.now();
     const clock = this.monotonic();
-    const response = await agentCall(this.deps.api, identity.key, '/api/agents/connectors', { requestId, ...(refresh === undefined ? {} : { refresh }) }, { answerMax: CONNECTOR_DELIVERY_MAX_BYTES, timeoutMs: 60_000, signal });
+    const response = await agentCall(this.deps.api, identity.key, '/api/agents/connectors?policy_layers=1', { requestId, ...(refresh === undefined ? {} : { refresh }) }, { answerMax: CONNECTOR_DELIVERY_MAX_BYTES, timeoutMs: 60_000, signal });
     this.validate(this.identity());
     if (generation !== this.generation || this.token !== identity.token) throw invalid();
     const snapshot = openConnectorDelivery(identity.key.sealing, context, response.sealed);

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay.ts

@@ -19,7 +19,7 @@ export interface RelayApiDeps {
   identify: (req: IncomingMessage) => { subject: string; agentId: string } | null;
   signedOut: (connectorId: string) => void;
   blocked?: BlockedReason;
-  open?: (connectorId: string) => RelaySession | null;
+  open?: (connectorId: string) => RelaySession | Promise<RelaySession> | null;
 }
 
 const ID_PATH_RE = /^\/relay\/((?:org-)?[A-Za-z0-9][A-Za-z0-9_-]{10})$/;
@@ -306,7 +306,7 @@ async function deliver(
 }
 
 async function relayOrg(req: IncomingMessage, res: ServerResponse, id: string, deps: RelayApiDeps, read: Uint8Array<ArrayBuffer> | null, signal: AbortSignal): Promise<void> {
-  const session = deps.open?.(id);
+  const session = await deps.open?.(id);
   if (session === undefined || session === null) throw new ApiError('Organization connector tools are not switched on yet.', 503);
   try {
     const out = await exchangeOrg(id, session, read, signal, (target, body, guard) => {

package/runtime/node_modules/@metro-labs/daemon/src/connectors/tools.ts

@@ -1,85 +1 @@
-import { isRecord } from '@metro-labs/core/is-record';
-import { errMsg, log } from '@metro-labs/core/log';
-import type { FetchLike } from '@metro-labs/core/stations/oauth';
-import { authHeaders, INITIALIZE, mcpPost, payloadOf, type ConnectorAuth } from '@metro-labs/http/connector-mcp';
-import { refused } from '@metro-labs/http/connector-url';
-
-export interface RemoteTool {
-  name: string;
-  title: string;
-  description: string;
-  readOnly: boolean;
-}
-
-const TIMEOUT_MS = 15_000;
-const MAX_PAGES = 10;
-
-function resultOf(text: string, contentType: string): Record<string, unknown> | null {
-  let parsed: unknown = null;
-  try {
-    parsed = JSON.parse(payloadOf(text, contentType));
-  } catch {
-    return null;
-  }
-  return isRecord(parsed) && isRecord(parsed.result) ? parsed.result : null;
-}
-
-async function rpc(url: URL, auth: ConnectorAuth, session: Map<string, string>, body: unknown, fetchImpl?: FetchLike): Promise<Record<string, unknown> | null> {
-  const res = await mcpPost(url, auth, body, { timeoutMs: TIMEOUT_MS, headers: Object.fromEntries(session), fetch: fetchImpl });
-  const id = res.headers.get('mcp-session-id');
-  if (id !== null && id !== '') session.set('mcp-session-id', id);
-  const text = await res.text().catch(() => '');
-  if (res.status === 401 || res.status === 403) throw refused(`${url.hostname} rejected the credential; connect it again`);
-  if (!res.ok) throw refused(`${url.hostname} answered ${String(res.status)}`);
-  return resultOf(text, res.headers.get('content-type') ?? '');
-}
-
-function toTool(raw: unknown): RemoteTool | null {
-  if (!isRecord(raw) || typeof raw.name !== 'string') return null;
-  const annotations = isRecord(raw.annotations) ? raw.annotations : {};
-  const title = typeof raw.title === 'string' && raw.title !== '' ? raw.title : raw.name;
-  return { name: raw.name, title, description: typeof raw.description === 'string' ? raw.description : '', readOnly: annotations.readOnlyHint === true };
-}
-
-async function endSession(url: URL, auth: ConnectorAuth, session: Map<string, string>, fetchImpl?: FetchLike): Promise<void> {
-  if (!session.has('mcp-session-id')) return;
-  try {
-    const send = fetchImpl ?? fetch;
-    const res = await send(url.toString(), { method: 'DELETE', redirect: 'manual', signal: AbortSignal.timeout(TIMEOUT_MS), headers: { ...authHeaders(auth), ...Object.fromEntries(session) } });
-    if (res.ok) await res.body?.pipeTo(new WritableStream<Uint8Array>());
-    else await res.body?.cancel();
-  } catch (err) {
-    log.debug(fetchImpl === undefined ? { host: url.hostname, err: errMsg(err) } : {}, 'connector-tools: the remote declined to end the session');
-  }
-}
-
-const toolsOf = (result: Record<string, unknown>): RemoteTool[] =>
-  Array.isArray(result.tools) ? result.tools.flatMap((raw: unknown) => toTool(raw) ?? []) : [];
-
-function nextCursor(result: Record<string, unknown>, current: string): string | null {
-  const next = result.nextCursor;
-  return typeof next !== 'string' || next === '' || next === current ? null : next;
-}
-
-async function walkTools(url: URL, auth: ConnectorAuth, session: Map<string, string>, fetchImpl?: FetchLike): Promise<RemoteTool[]> {
-  const tools: RemoteTool[] = [];
-  let cursor: string | null = '';
-  for (let page = 0; page < MAX_PAGES && cursor !== null; page += 1) {
-    const result = await rpc(url, auth, session, { jsonrpc: '2.0', id: 2 + page, method: 'tools/list', params: cursor === '' ? {} : { cursor } }, fetchImpl);
-    if (result === null) break;
-    tools.push(...toolsOf(result));
-    cursor = nextCursor(result, cursor);
-  }
-  return tools;
-}
-
-export async function listRemoteTools(url: URL, auth: ConnectorAuth, fetchImpl?: FetchLike): Promise<RemoteTool[]> {
-  const session = new Map<string, string>();
-  const init = await rpc(url, auth, session, INITIALIZE, fetchImpl);
-  if (init === null || typeof init.protocolVersion !== 'string') throw refused(`${url.hostname} answered, but it does not speak MCP.`);
-  session.set('mcp-protocol-version', init.protocolVersion);
-  await rpc(url, auth, session, { jsonrpc: '2.0', method: 'notifications/initialized' }, fetchImpl);
-  const tools = await walkTools(url, auth, session, fetchImpl);
-  await endSession(url, auth, session, fetchImpl);
-  return tools;
-}
+export { listRemoteTools, type RemoteTool } from '@metro-labs/http/connector-tools';

package/runtime/node_modules/@metro-labs/http/package.json

@@ -18,6 +18,7 @@
     "./connector-resource": "./src/connector-resource.ts",
     "./connector-reach": "./src/connector-reach.ts",
     "./connector-mcp": "./src/connector-mcp.ts",
+    "./connector-tools": "./src/connector-tools.ts",
     "./connector-discovery": "./src/connector-discovery.ts",
     "./connector-oauth": "./src/connector-oauth.ts",
     "./connector-input": "./src/connector-input.ts",

package/runtime/node_modules/@metro-labs/http/src/connector-delivery-validation.ts

@@ -1,7 +1,7 @@
 import { parseId } from '@metro-labs/core/ids';
 import { isRecord } from '@metro-labs/core/is-record';
 import { connectorName } from './connector-input.js';
-import { connectorPolicyOf, type ConnectorPolicy } from './connector-policy.js';
+import { connectorPolicyLayersOf, connectorPolicyOf, type ConnectorPolicy, type ConnectorPolicyLayers } from './connector-policy.js';
 import { parsePublicConnectorUrl } from './connector-public-url.js';
 import { isOrganizationId } from './workos-token.js';
 
@@ -23,6 +23,7 @@ export interface DeliveredConnector {
   auth: 'none' | 'header' | 'oauth';
   headers: Record<string, string>;
   policy: ConnectorPolicy;
+  policyLayers?: ConnectorPolicyLayers;
   revision: string;
   state: 'ready' | 'signin' | 'unavailable';
   expiresAt?: number;
@@ -91,7 +92,7 @@ function urlOf(value: unknown): string {
 }
 
 function connectorOf(raw: unknown): DeliveredConnector {
-  const value = deliveryRecord(raw, ['id', 'name', 'url', 'auth', 'headers', 'policy', 'revision', 'state', 'expiresAt']);
+  const value = deliveryRecord(raw, ['id', 'name', 'url', 'auth', 'headers', 'policy', 'policyLayers', 'revision', 'state', 'expiresAt']);
   const id = parseId(value.id);
   if (id === null || typeof value.name !== 'string' || connectorName(value.name) !== value.name) throw new Error('Invalid delivered connector.');
   const url = urlOf(value.url);
@@ -99,7 +100,7 @@ function connectorOf(raw: unknown): DeliveredConnector {
   const state = stateOf(value.state, auth);
   deliveryBytes(value.revision, 32);
   if (Object.hasOwn(value, 'expiresAt') && !timestamp(value.expiresAt)) throw new Error('Invalid delivered connector expiry.');
-  return { id, name: value.name, url, auth, state, revision: String(value.revision), headers: headersOf(value.headers, auth, state), policy: connectorPolicyOf(value.policy), ...(timestamp(value.expiresAt) ? { expiresAt: value.expiresAt } : {}) };
+  return { id, name: value.name, url, auth, state, revision: String(value.revision), headers: headersOf(value.headers, auth, state), policy: connectorPolicyOf(value.policy), ...(Object.hasOwn(value, 'policyLayers') ? { policyLayers: connectorPolicyLayersOf(value.policyLayers) } : {}), ...(timestamp(value.expiresAt) ? { expiresAt: value.expiresAt } : {}) };
 }
 
 export function deliverySnapshotOf(raw: unknown): DeliverySnapshot {

package/runtime/node_modules/@metro-labs/http/src/connector-delivery.ts

@@ -2,8 +2,8 @@ import type { KeyObject } from 'node:crypto';
 import { CONNECTOR_DELIVERY_MAX_BYTES, DELIVERY_PLAINTEXT_MAX, deliveryContextBytes, deliverySnapshotOf, type DeliveryContext, type DeliverySnapshot } from './connector-delivery-validation.js';
 import { openTransfer, sealTransfer, type SealedTransfer } from './transfer-crypto.js';
 
-export { CONNECTOR_DELIVERY_LEASE_MS, CONNECTOR_DELIVERY_MAX_BYTES, deliverySnapshotOf, type DeliveryContext, type DeliverySnapshot, type DeliveredConnector } from './connector-delivery-validation.js';
-export { combineConnectorPolicies, connectorPolicyOf, type ConnectorPolicy } from './connector-policy.js';
+export { CONNECTOR_DELIVERY_LEASE_MS, CONNECTOR_DELIVERY_MAX_BYTES, DELIVERY_PLAINTEXT_MAX, deliverySnapshotOf, type DeliveryContext, type DeliverySnapshot, type DeliveredConnector } from './connector-delivery-validation.js';
+export { combineConnectorPolicies, connectorPolicyOf, effectiveConnectorPolicy, connectorPoliciesBlocked, validConnectorToolName, type ConnectorPolicy, type ConnectorPolicyLayers } from './connector-policy.js';
 export type SealedDelivery = SealedTransfer;
 
 export function sealConnectorDelivery(publicKey: string, context: DeliveryContext, snapshot: DeliverySnapshot): SealedDelivery {

package/runtime/node_modules/@metro-labs/http/src/connector-policy.ts

@@ -2,15 +2,24 @@ import { isRecord } from '@metro-labs/core/is-record';
 
 export type ConnectorDecision = 'allow' | 'ask' | 'deny';
 
+type ToolGroup = 'read' | 'write';
+
 export interface ConnectorPolicy {
   read?: ConnectorDecision;
   write?: ConnectorDecision;
   tools?: Record<string, ConnectorDecision>;
 }
 
+export interface ConnectorPolicyLayers {
+  organization: ConnectorPolicy;
+  agent: ConnectorPolicy;
+}
+
 const RANK: Record<ConnectorDecision, number> = { allow: 0, ask: 1, deny: 2 };
 const TOOL_RE = /^[A-Za-z0-9_.:/-]{1,256}$/;
 
+export const validConnectorToolName = (name: string): boolean => TOOL_RE.test(name) && !['__proto__', 'constructor', 'prototype'].includes(name);
+
 const decision = (value: unknown): value is ConnectorDecision => value === 'allow' || value === 'ask' || value === 'deny';
 
 export function connectorPolicyOf(value: unknown): ConnectorPolicy {
@@ -30,15 +39,23 @@ function toolPolicyOf(value: unknown): Record<string, ConnectorDecision> {
   if (!isRecord(value) || Object.keys(value).length > 2000) throw new Error('Invalid connector policy.');
   const out: Record<string, ConnectorDecision> = {};
   for (const [name, rule] of Object.entries(value)) {
-    if (!TOOL_RE.test(name) || ['__proto__', 'constructor', 'prototype'].includes(name) || !decision(rule)) throw new Error('Invalid connector policy.');
+    if (!validConnectorToolName(name) || !decision(rule)) throw new Error('Invalid connector policy.');
     out[name] = rule;
   }
   return out;
 }
 
+export function connectorPolicyLayersOf(value: unknown): ConnectorPolicyLayers {
+  if (!isRecord(value) || Object.keys(value).some((key) => !['organization', 'agent'].includes(key))) throw new Error('Invalid connector policy layers.');
+  return { organization: connectorPolicyOf(value.organization), agent: connectorPolicyOf(value.agent) };
+}
+
 const strictest = (...values: (ConnectorDecision | undefined)[]): ConnectorDecision => values.reduce<ConnectorDecision>((held, next) => next !== undefined && RANK[next] > RANK[held] ? next : held, 'allow');
+const toolRule = (policy: ConnectorPolicy, name: string): ConnectorDecision | undefined => policy.tools !== undefined && Object.hasOwn(policy.tools, name) ? policy.tools[name] : undefined;
+const toolGroup = (groups: Record<string, ToolGroup>, name: string): ToolGroup => Object.hasOwn(groups, name) && groups[name] === 'read' ? 'read' : 'write';
+const access = (policy: ConnectorPolicy, name: string, group: ToolGroup): ConnectorDecision => toolRule(policy, name) ?? policy[group] ?? 'allow';
 
-export function combineConnectorPolicies(global: ConnectorPolicy, assignment: ConnectorPolicy): ConnectorPolicy {
+export function combineConnectorPolicies(global: ConnectorPolicy, assignment: ConnectorPolicy, groups?: Record<string, ToolGroup>): ConnectorPolicy {
   const policies = [connectorPolicyOf(global), connectorPolicyOf(assignment)];
   const neutral = (policy: ConnectorPolicy): boolean => (policy.read ?? 'allow') === 'allow' && (policy.write ?? 'allow') === 'allow' && Object.keys(policy.tools ?? {}).length === 0;
   if (neutral(assignment)) return connectorPolicyOf(global);
@@ -48,9 +65,28 @@ export function combineConnectorPolicies(global: ConnectorPolicy, assignment: Co
     write: strictest(...policies.map((policy) => policy.write)),
   };
   const names = new Set(policies.flatMap((policy) => Object.keys(policy.tools ?? {})));
+  if (groups === undefined && names.size > 2000) return { read: 'deny', write: 'deny' };
   if (names.size > 0) {
     out.tools = {};
-    for (const name of names) out.tools[name] = strictest(...policies.flatMap((policy) => [policy.read, policy.write, policy.tools?.[name]]));
+    for (const name of names) {
+      out.tools[name] = groups === undefined
+        ? strictest(...policies.flatMap((policy) => [policy.read, policy.write, toolRule(policy, name)]))
+        : strictest(...policies.map((policy) => access(policy, name, toolGroup(groups, name))));
+    }
   }
   return out;
 }
+
+export function effectiveConnectorPolicy(row: { policy: ConnectorPolicy; policyLayers?: ConnectorPolicyLayers }, groups: Record<string, ToolGroup>): ConnectorPolicy {
+  const layers = row.policyLayers;
+  return layers === undefined ? connectorPolicyOf(row.policy) : combineConnectorPolicies(layers.organization, layers.agent, groups);
+}
+
+export function connectorPoliciesBlocked(layers: ConnectorPolicyLayers): boolean {
+  const policies = [layers.organization, layers.agent];
+  const names = new Set(policies.flatMap((policy) => Object.keys(policy.tools ?? {})));
+  return (['read', 'write'] as const).every((group) =>
+    strictest(...policies.map((policy) => policy[group])) === 'deny' &&
+    [...names].every((name) => strictest(...policies.map((policy) => access(policy, name, group))) === 'deny'),
+  );
+}

package/runtime/node_modules/@metro-labs/http/src/connector-tools.ts

@@ -0,0 +1,94 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import type { FetchLike } from '@metro-labs/core/stations/oauth';
+import { authHeaders, INITIALIZE, mcpPost, payloadOf, type ConnectorAuth } from './connector-mcp.js';
+import { ConnectorUnauthorized, refused } from './connector-url.js';
+
+export interface RemoteTool {
+  name: string;
+  title: string;
+  description: string;
+  readOnly: boolean;
+}
+
+const TIMEOUT_MS = 15_000;
+const MAX_PAGES = 100;
+const MAX_TOOLS = 2000;
+
+function resultOf(text: string, contentType: string): Record<string, unknown> | null {
+  let parsed: unknown = null;
+  try {
+    parsed = JSON.parse(payloadOf(text, contentType));
+  } catch {
+    return null;
+  }
+  return isRecord(parsed) && isRecord(parsed.result) ? parsed.result : null;
+}
+
+async function rpc(url: URL, auth: ConnectorAuth, session: Map<string, string>, body: unknown, fetchImpl?: FetchLike): Promise<Record<string, unknown> | null> {
+  const res = await mcpPost(url, auth, body, { timeoutMs: TIMEOUT_MS, headers: Object.fromEntries(session), fetch: fetchImpl });
+  const id = res.headers.get('mcp-session-id');
+  if (id !== null && id !== '') session.set('mcp-session-id', id);
+  const text = await res.text().catch(() => '');
+  if (res.status === 401 || res.status === 403) throw new ConnectorUnauthorized(`${url.hostname} rejected the credential; connect it again`, 400);
+  if (!res.ok) throw refused(`${url.hostname} answered ${String(res.status)}`);
+  return resultOf(text, res.headers.get('content-type') ?? '');
+}
+
+function toTool(raw: unknown): RemoteTool | null {
+  if (!isRecord(raw) || typeof raw.name !== 'string') return null;
+  const annotations = isRecord(raw.annotations) ? raw.annotations : {};
+  const title = typeof raw.title === 'string' && raw.title !== '' ? raw.title : raw.name;
+  return { name: raw.name, title, description: typeof raw.description === 'string' ? raw.description : '', readOnly: annotations.readOnlyHint === true };
+}
+
+async function endSession(url: URL, auth: ConnectorAuth, session: Map<string, string>, fetchImpl?: FetchLike): Promise<void> {
+  if (!session.has('mcp-session-id')) return;
+  try {
+    const send = fetchImpl ?? fetch;
+    const res = await send(url.toString(), { method: 'DELETE', redirect: 'manual', signal: AbortSignal.timeout(TIMEOUT_MS), headers: { ...authHeaders(auth), ...Object.fromEntries(session) } });
+    if (res.ok) await res.body?.pipeTo(new WritableStream<Uint8Array>());
+    else await res.body?.cancel();
+  } catch (err) {
+    log.debug(fetchImpl === undefined ? { host: url.hostname, err: errMsg(err) } : {}, 'connector-tools: the remote declined to end the session');
+  }
+}
+
+function addTools(result: Record<string, unknown> | null, tools: Map<string, RemoteTool>): unknown {
+  if (result === null || !Array.isArray(result.tools)) throw refused('The provider did not return a complete tool list.');
+  for (const raw of result.tools) {
+    const tool = toTool(raw);
+    if (tool === null || tools.has(tool.name)) throw refused('The provider returned an invalid tool list.');
+    tools.set(tool.name, tool);
+    if (tools.size > MAX_TOOLS) throw refused('The provider returned too many tools.');
+  }
+  return result.nextCursor;
+}
+
+async function walkTools(url: URL, auth: ConnectorAuth, session: Map<string, string>, fetchImpl?: FetchLike): Promise<RemoteTool[]> {
+  const tools = new Map<string, RemoteTool>();
+  const cursors = new Set<string>();
+  let cursor = '';
+  for (let page = 0; page < MAX_PAGES; page += 1) {
+    const result = await rpc(url, auth, session, { jsonrpc: '2.0', id: 2 + page, method: 'tools/list', params: cursor === '' ? {} : { cursor } }, fetchImpl);
+    const next = addTools(result, tools);
+    if (next === undefined || next === null || next === '') return [...tools.values()];
+    if (typeof next !== 'string' || cursors.has(next)) throw refused('The provider did not return a complete tool list.');
+    cursors.add(next);
+    cursor = next;
+  }
+  throw refused('The provider did not return a complete tool list.');
+}
+
+export async function listRemoteTools(url: URL, auth: ConnectorAuth, fetchImpl?: FetchLike): Promise<RemoteTool[]> {
+  const session = new Map<string, string>();
+  try {
+    const init = await rpc(url, auth, session, INITIALIZE, fetchImpl);
+    if (init === null || typeof init.protocolVersion !== 'string') throw refused(`${url.hostname} answered, but it does not speak MCP.`);
+    session.set('mcp-protocol-version', init.protocolVersion);
+    await rpc(url, auth, session, { jsonrpc: '2.0', method: 'notifications/initialized' }, fetchImpl);
+    return await walkTools(url, auth, session, fetchImpl);
+  } finally {
+    await endSession(url, auth, session, fetchImpl);
+  }
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.293"
+  "version": "0.1.0-beta.294"
 }

package/runtime/sdk-runner/runner.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-beta.293",
+  "version": "0.1.0-beta.294",
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.287",
     "@modelcontextprotocol/sdk": "^1.29.0",