@stage-labs/metro 0.1.0-beta.302 → 0.1.0-beta.304

package/runtime/node_modules/@metro-labs/daemon/src/mcp-server/link.ts

@@ -0,0 +1,186 @@
+import { errMsg, log } from '@metro-labs/core/log';
+import { MCP_APPROVAL_WAIT_MS, MCP_PATHS, mcpApprovalsOf, type McpApproval, type McpDecision } from '@metro-labs/http/mcp-server-protocol';
+import { agentsDir } from '../agents/files.js';
+import { readAgentKey, type AgentKey } from '../connectors/agent-key.js';
+import { agentCall, MetroApiRefusal, type AgentFetch, type MetroApi } from '../connectors/metro-api.js';
+import { mcpServerUrl } from './config.js';
+import { ensureMcpToken } from './token.js';
+
+export type AnswerOutcome = 'acknowledged' | 'gone' | 'stopped';
+
+export type HoldApproval = (approval: McpApproval, answer: (decision: McpDecision) => Promise<AnswerOutcome>) => void;
+
+export interface McpTiming {
+  retryMs: number;
+  retryMaxMs: number;
+  idleMs: number;
+  minPollMs: number;
+  pollTimeoutMs: number;
+}
+
+export interface McpLinkDeps {
+  url: string;
+  owner: () => string | null;
+  key: () => AgentKey | null;
+  dir: () => string;
+  hold: HoldApproval;
+  fetch?: AgentFetch;
+  timing?: Partial<McpTiming>;
+}
+
+const TIMING: McpTiming = { retryMs: 2_000, retryMaxMs: 60_000, idleMs: 30_000, minPollMs: 1_000, pollTimeoutMs: MCP_APPROVAL_WAIT_MS + 15_000 };
+const APPROVALS_MAX = 256 * 1024;
+
+const refusedWith = (err: unknown, status: number): boolean => err instanceof MetroApiRefusal && err.upstreamStatus === status;
+
+export class McpServerLink {
+  private readonly api: MetroApi;
+  private readonly timing: McpTiming;
+  private readonly abort = new AbortController();
+  private registered: string | null = null;
+  private failures = 0;
+  private running: Promise<void> | null = null;
+
+  constructor(private readonly deps: McpLinkDeps) {
+    this.api = { base: deps.url, fetch: deps.fetch ?? ((url, init) => fetch(url, init)), now: () => Date.now() };
+    this.timing = { ...TIMING, ...deps.timing };
+  }
+
+  private get stopped(): boolean {
+    return this.abort.signal.aborted;
+  }
+
+  start(): void {
+    this.running ??= this.run().catch((err: unknown) => {
+      log.error({ err: errMsg(err) }, 'mcp-server: the token and approval loop stopped');
+    });
+  }
+
+  async stop(): Promise<void> {
+    this.abort.abort();
+    await this.running;
+  }
+
+  async answer(id: string, decision: McpDecision): Promise<AnswerOutcome> {
+    for (let attempt = 0; !this.stopped; attempt += 1) {
+      if (attempt > 0) await this.pause(this.delay(attempt));
+      const key = this.enrolledKey();
+      if (key === null || this.stopped) continue;
+      try {
+        await agentCall(this.api, key, MCP_PATHS.answer, { id, decision }, { signal: this.abort.signal });
+        log.info({ id, decision }, 'mcp-server: the owner answer reached the server');
+        return 'acknowledged';
+      } catch (err) {
+        if (refusedWith(err, 404)) return 'gone';
+        if (refusedWith(err, 401)) this.registered = null;
+        if (!this.stopped) log.warn({ id, attempt: attempt + 1, err: errMsg(err) }, 'mcp-server: the owner answer did not reach the server; trying again');
+      }
+    }
+    return 'stopped';
+  }
+
+  private enrolledKey(): AgentKey | null {
+    try {
+      const key = this.deps.key();
+      const owner = this.deps.owner();
+      return key !== null && owner !== null && key.enrollment?.organization === owner ? key : null;
+    } catch (err) {
+      log.warn({ err: errMsg(err) }, 'mcp-server: the agent key could not be read');
+      return null;
+    }
+  }
+
+  private async run(): Promise<void> {
+    while (!this.stopped) {
+      const key = this.enrolledKey();
+      if (key === null) {
+        this.registered = null;
+        await this.pause(this.timing.idleMs);
+      } else if (await this.step(key)) this.failures = 0;
+      else await this.pause(this.delay(++this.failures));
+    }
+  }
+
+  private async step(key: AgentKey): Promise<boolean> {
+    let doing = 'register the MCP token';
+    try {
+      await this.register(key);
+      doing = 'ask for approvals';
+      await this.poll(key);
+      return true;
+    } catch (err) {
+      if (this.stopped) return true;
+      if (refusedWith(err, 401)) this.registered = null;
+      log.warn({ server: this.deps.url, failures: this.failures + 1, err: errMsg(err) }, `mcp-server: could not ${doing}; trying again`);
+      return false;
+    }
+  }
+
+  private async register(key: AgentKey): Promise<void> {
+    const token = ensureMcpToken(key.keyId, this.deps.dir());
+    if (token.fresh) log.info({ keyId: key.keyId }, 'mcp-server: made a new MCP token for this agent');
+    const binding = `${key.keyId} ${token.hash}`;
+    if (this.registered === binding) return;
+    await agentCall(this.api, key, MCP_PATHS.token, { tokenHash: token.hash }, { signal: this.abort.signal });
+    this.registered = binding;
+    log.info({ server: this.deps.url, keyId: key.keyId }, 'mcp-server: the MCP token is registered');
+  }
+
+  private async poll(key: AgentKey): Promise<void> {
+    const started = Date.now();
+    const answer = await agentCall(this.api, key, MCP_PATHS.approvals, {}, { signal: this.abort.signal, timeoutMs: this.timing.pollTimeoutMs, answerMax: APPROVALS_MAX });
+    const approvals = mcpApprovalsOf(answer);
+    for (const approval of approvals) this.receive(approval);
+    const rest = this.timing.minPollMs - (Date.now() - started);
+    if (approvals.length === 0 && rest > 0) await this.pause(rest);
+  }
+
+  private receive(approval: McpApproval): void {
+    try {
+      this.deps.hold(approval, (decision) => this.answer(approval.id, decision));
+    } catch (err) {
+      log.warn({ id: approval.id, err: errMsg(err) }, 'mcp-server: an approval could not be held');
+    }
+  }
+
+  private delay(attempt: number): number {
+    return Math.min(this.timing.retryMs * 2 ** Math.min(attempt - 1, 20), this.timing.retryMaxMs);
+  }
+
+  private pause(ms: number): Promise<void> {
+    if (this.stopped) return Promise.resolve();
+    const signal = this.abort.signal;
+    return new Promise((resolve) => {
+      const done = (): void => {
+        clearTimeout(timer);
+        signal.removeEventListener('abort', done);
+        resolve();
+      };
+      const timer = setTimeout(done, ms);
+      timer.unref();
+      signal.addEventListener('abort', done, { once: true });
+    });
+  }
+}
+
+let active: McpServerLink | null = null;
+
+export interface McpServerWatch {
+  owner: () => string | null;
+  hold: HoldApproval;
+}
+
+export function watchMcpServer(watch: McpServerWatch, env: NodeJS.ProcessEnv = process.env): boolean {
+  const url = mcpServerUrl(env);
+  if (url === null || active !== null) return false;
+  active = new McpServerLink({ url, owner: watch.owner, key: () => readAgentKey(), dir: agentsDir, hold: watch.hold });
+  active.start();
+  log.info({ server: url }, 'mcp-server: connector approvals relay from this server once the agent is enrolled');
+  return true;
+}
+
+export async function stopMcpServer(): Promise<void> {
+  const link = active;
+  active = null;
+  await link?.stop();
+}

package/runtime/node_modules/@metro-labs/daemon/src/mcp-server/token.ts

@@ -0,0 +1,50 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isRecord } from '@metro-labs/core/is-record';
+import { writeSecure } from '@metro-labs/core/secure-fs';
+import { MCP_TOKEN_RE } from '@metro-labs/http/mcp-server-protocol';
+
+export const MCP_TOKEN_FILE = 'mcp-token';
+const BINDING_FILE = 'mcp-token.json';
+
+export interface McpToken {
+  token: string;
+  hash: string;
+  fresh: boolean;
+}
+
+export const mcpTokenHash = (token: string): string => createHash('sha256').update(token).digest('base64url');
+
+const readText = (path: string): string | null => {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch {
+    return null;
+  }
+};
+
+export function readMcpToken(dir: string): string | null {
+  const text = readText(join(dir, MCP_TOKEN_FILE))?.trim() ?? '';
+  return MCP_TOKEN_RE.test(text) ? text : null;
+}
+
+function boundKeyId(dir: string): string | null {
+  const text = readText(join(dir, BINDING_FILE));
+  if (text === null) return null;
+  try {
+    const parsed: unknown = JSON.parse(text);
+    return isRecord(parsed) && parsed.version === 1 && typeof parsed.keyId === 'string' ? parsed.keyId : null;
+  } catch {
+    return null;
+  }
+}
+
+export function ensureMcpToken(keyId: string, dir: string): McpToken {
+  const kept = readMcpToken(dir);
+  if (kept !== null && boundKeyId(dir) === keyId) return { token: kept, hash: mcpTokenHash(kept), fresh: false };
+  const token = `mcp_${randomBytes(32).toString('base64url')}`;
+  writeSecure(join(dir, MCP_TOKEN_FILE), `${token}\n`);
+  writeSecure(join(dir, BINDING_FILE), `${JSON.stringify({ version: 1, keyId })}\n`);
+  return { token, hash: mcpTokenHash(token), fresh: true };
+}

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -6,7 +6,6 @@ import { assertAttachOwner, finishGmailUpgrade, startGmailAttach } from './gmail
 import { detachWithGmailRevocation } from './gmail-detach.js';
 import { recentSenders } from '../agents/senders.js';
 import { forwardTrainCall } from '../stations/train-call.js';
-import { publishLocalConnectors } from '../connectors/publication.js';
 import { invalidateOrgConnectorSync, orgConnectorRelaySession, orgConnectorSyncStatus, setOrgConnectorSync } from '../connectors/org-sync-watch.js';
 import type { AgentApiDeps } from '../agents/api.js';
 import { ATTACHABLE, type AccountApiDeps } from '../agents/accounts-api.js';
@@ -14,32 +13,9 @@ import type { SessionApis } from './session-apis.js';
 import type { ModeInfo } from '@metro-labs/http/mode-api';
 import { loadedAgentOf, type AgentBundle, type BundleApiDeps } from '../agents/bundle.js';
 import { METRO_VERSION } from '@metro-labs/core/version';
-import type { ConnectorApiDeps } from '../connectors/api.js';
-import { connectorMigrationPreview } from '../connectors/migration-preview.js';
-import { ConnectorMigrations } from '../connectors/migration-control.js';
-import { migrationExportableRows } from '../connectors/migration-guard.js';
-import { ConnectorTransfers } from '../connectors/transfer-api.js';
-import { copyConnectorRows } from '../connectors/transfer-store.js';
 import { authenticate } from '../mcp/request-identity.js';
 import type { RelayApiDeps } from '../connectors/relay.js';
-import {
-  readLocalConnectors,
-  localImportConnectors,
-  localCreateConnector,
-  localCreatePendingConnector,
-  localDeleteConnector,
-  localDisconnectConnector,
-  localGetConnector,
-  localListConnectors,
-  localReconnectConnector,
-  localRelayTarget,
-  localRenameConnector,
-  localVerifyConnector,
-  localMarkSignedOut,
-  localConnectorTools,
-  localSetConnectorPolicy,
-} from '../connectors/store.js';
-import { blockedReason } from '../connectors/gates.js';
+import { connectorGates } from '../connectors/gates.js';
 import {
   setLocalOwner,
   localAttachAccount,
@@ -117,43 +93,17 @@ function agentApi(deps: LocalModeDeps): AgentApiDeps {
   };
 }
 
-const allConnectorIds = (): string[] => readLocalConnectors().map((c) => c.id);
-
 function connectorIdsOfLocalAgents(ids: string[]): Promise<Map<string, string[]>> {
-  const all = allConnectorIds();
+  const all = connectorGates().map((gate) => gate.id);
   return Promise.resolve(new Map(ids.map((id) => [id, all] as const)));
 }
 
-const connectorApi: ConnectorApiDeps = {
-  migrationPreview: () => connectorMigrationPreview(localOwner()),
-  listConnectors: async () => {
-    const rows = await localListConnectors();
-    publishLocalConnectors(readLocalConnectors());
-    return rows;
-  },
-  createConnector: localCreateConnector,
-  verifyConnector: localVerifyConnector,
-  connectorTools: localConnectorTools,
-  disconnectConnector: localDisconnectConnector,
-  renameConnector: localRenameConnector,
-  deleteConnector: localDeleteConnector,
-  setConnectorPolicy: (id, policy) => localSetConnectorPolicy(id, policy),
-  createPendingConnector: localCreatePendingConnector,
-  reconnectConnector: localReconnectConnector,
-  getConnector: localGetConnector,
-};
-
 const relayApi: RelayApiDeps = {
-  target: (connectorId, force) => localRelayTarget(connectorId, force),
   open: orgConnectorRelaySession,
   identify: (req) => {
     const who = authenticate(req);
     return who?.kind === 'agent' ? { subject: 'agent-key', agentId: who.agentId } : null;
   },
-  signedOut: (id) => {
-    localMarkSignedOut(id);
-  },
-  blocked: blockedReason,
 };
 
 
@@ -164,18 +114,17 @@ function bundleApi(deps: LocalModeDeps): BundleApiDeps {
       const bundle: AgentBundle = {
         version: 1,
         agent: { id: file.id, name: file.name ?? '', stations: file.stations.filter((a) => a.station !== 'gmail' || a.config.managed !== true) },
-        connectors: migrationExportableRows(readLocalConnectors()).map((c) => ({ id: c.id, name: c.name, url: c.url, config: { ...c.config } })),
+        connectors: [],
       };
       return Promise.resolve(bundle);
     },
     restore: async (bundle, mode) => {
       const made = await localImportAgent(loadedAgentOf(bundle), undefined, mode);
-      const connectors = localImportConnectors(bundle.connectors, undefined, mode);
       for (const station of new Set(bundle.agent.stations.map((a) => a.station)))
         await deps.syncStations(station).catch((err: unknown) => {
           log.warn({ station, err: errMsg(err) }, 'restore: station reload failed, the change lands at the next boot');
         });
-      return { id: made.id, name: made.name, stations: made.stations, connectors };
+      return { id: made.id, name: made.name, stations: made.stations, connectors: 0 };
     },
   };
 }
@@ -206,10 +155,7 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
   return {
     agentApi: agentApi(deps),
     bundleApi: bundleApi(deps),
-    connectorApi,
     connectorSyncApi: { status: orgConnectorSyncStatus, set: setOrgConnectorSync },
-    connectorMigrationApi: new ConnectorMigrations(),
-    connectorTransfers: new ConnectorTransfers({ read: () => migrationExportableRows(readLocalConnectors()), copy: copyConnectorRows }),
     enrollApi: { owner: () => localOwner(), invalidate: invalidateOrgConnectorSync },
     relayApi,
     claudeApi: { liveEvents: deps.liveEvents },

package/runtime/node_modules/@metro-labs/daemon/src/routes/session-apis.ts

@@ -2,14 +2,8 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import { handleSessionApiRequest } from './session.js';
 import { handleApprovalsRequest } from '../approvals/api.js';
 import { handleAgentApiRequest, type AgentApiDeps } from '../agents/api.js';
-import {
-  handleConnectorApiRequest,
-  type ConnectorApiDeps,
-} from '../connectors/api.js';
 import type { RelayApiDeps } from '../connectors/relay.js';
-import type { ConnectorTransfers } from '../connectors/transfer-api.js';
 import { handleConnectorSyncRequest, type ConnectorSyncApiDeps } from '../connectors/org-sync-api.js';
-import { handleMigrationRequest, type MigrationApiDeps } from '../connectors/migration-api.js';
 import { handleEnrollRequest, type EnrollApiDeps } from '../connectors/enroll-api.js';
 import { handleClaudeRequest, type ClaudeApiDeps } from '../claude/api.js';
 import type { ModeInfo } from '@metro-labs/http/mode-api';
@@ -38,11 +32,8 @@ export interface SessionApis {
   gateway?: GatewayDeps;
   terminalApi?: TerminalApiDeps;
   claudeApi?: ClaudeApiDeps;
-  connectorApi?: ConnectorApiDeps;
-  connectorTransfers?: ConnectorTransfers;
   enrollApi?: EnrollApiDeps;
   connectorSyncApi?: ConnectorSyncApiDeps;
-  connectorMigrationApi?: MigrationApiDeps;
   relayApi?: RelayApiDeps;
   mode?: () => ModeInfo;
 }
@@ -59,11 +50,8 @@ export function handleSessionApis(
     () => handleSessionApiRequest(req, res),
     () => handleRunEventsRequest(req, res),
     () => handleApprovalsRequest(req, res),
-    ...when(apis.connectorTransfers, (d) => d.handle(req, res)),
     ...when(apis.enrollApi, (d) => handleEnrollRequest(req, res, d)),
     ...when(apis.connectorSyncApi, (d) => handleConnectorSyncRequest(req, res, d)),
-    ...when(apis.connectorMigrationApi, (d) => handleMigrationRequest(req, res, d)),
-    ...when(apis.connectorApi, (d) => handleConnectorApiRequest(req, res, d)),
     ...when(apis.bundleApi, (d) => handleBundleRequest(req, res, d)),
     ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),
     ...when(apis.controlApi, (d) => handleControlRequest(req, res, d)),

package/runtime/node_modules/@metro-labs/daemon/src/stations/materialize.ts

@@ -39,13 +39,6 @@ export interface LoadedAccount {
   config: Record<string, unknown>;
 }
 
-export interface LoadedConnector {
-  id: string;
-  name: string;
-  url: string;
-  config: Record<string, unknown>;
-}
-
 export interface LoadedAgent {
   id: string;
   name: string;

package/runtime/node_modules/@metro-labs/http/package.json

@@ -24,7 +24,8 @@
     "./connector-input": "./src/connector-input.ts",
     "./connector-delivery": "./src/connector-delivery.ts",
     "./connector-migration": "./src/connector-migration.ts",
-    "./connector-grant": "./src/connector-grant.ts"
+    "./connector-grant": "./src/connector-grant.ts",
+    "./mcp-server-protocol": "./src/mcp-server-protocol.ts"
   },
   "scripts": {
     "build": "tsc",

package/runtime/node_modules/@metro-labs/http/src/connector-tools.ts

@@ -9,6 +9,7 @@ export interface RemoteTool {
   title: string;
   description: string;
   readOnly: boolean;
+  inputSchema?: Record<string, unknown>;
 }
 
 const TIMEOUT_MS = 15_000;
@@ -39,7 +40,7 @@ function toTool(raw: unknown): RemoteTool | null {
   if (!isRecord(raw) || typeof raw.name !== 'string') return null;
   const annotations = isRecord(raw.annotations) ? raw.annotations : {};
   const title = typeof raw.title === 'string' && raw.title !== '' ? raw.title : raw.name;
-  return { name: raw.name, title, description: typeof raw.description === 'string' ? raw.description : '', readOnly: annotations.readOnlyHint === true };
+  return { name: raw.name, title, description: typeof raw.description === 'string' ? raw.description : '', readOnly: annotations.readOnlyHint === true, ...(isRecord(raw.inputSchema) ? { inputSchema: raw.inputSchema } : {}) };
 }
 
 async function endSession(url: URL, auth: ConnectorAuth, session: Map<string, string>, fetchImpl?: FetchLike): Promise<void> {

package/runtime/node_modules/@metro-labs/http/src/mcp-server-protocol.ts

@@ -0,0 +1,81 @@
+import { isRecord } from '@metro-labs/core/is-record';
+
+export const MCP_PATHS = { token: '/v1/token', approvals: '/v1/approvals', answer: '/v1/approvals/answer' } as const;
+export const MCP_FIND_DEFAULT = 5;
+export const MCP_FIND_MAX = 20;
+export const MCP_CALLS_MAX = 10;
+export const MCP_QUERY_MAX = 500;
+export const MCP_APPROVAL_WAIT_MS = 25_000;
+export const MCP_APPROVAL_ID_RE = /^[a-km-z]{5}$/;
+export const MCP_TOKEN_RE = /^mcp_[A-Za-z0-9_-]{43}$/;
+
+export type McpErrorCode = 'blocked' | 'needs_approval' | 'denied' | 'not_found' | 'signin' | 'unavailable' | 'vendor_error' | 'invalid';
+
+export interface McpFindRequest {
+  query: string;
+  max_results: number;
+}
+
+export interface McpCall {
+  tool: string;
+  arguments: Record<string, unknown>;
+  approval?: string;
+}
+
+export interface McpApproval {
+  id: string;
+  connector: string;
+  tool: string;
+  preview: string;
+  requestedAt: number;
+}
+
+export type McpDecision = 'allow' | 'deny';
+
+const TOOL_RE = /^([a-z0-9][a-z0-9-]{0,62})\.([A-Za-z0-9_][A-Za-z0-9_.:/-]{0,127})$/;
+
+export function splitMcpTool(name: string): { connector: string; tool: string } | null {
+  const match = TOOL_RE.exec(name);
+  return match === null ? null : { connector: match[1] ?? '', tool: match[2] ?? '' };
+}
+
+export function mcpFindRequestOf(raw: unknown): McpFindRequest {
+  if (!isRecord(raw) || typeof raw.query !== 'string' || raw.query.trim() === '' || raw.query.length > MCP_QUERY_MAX) throw new Error('find_tools needs a query of 1 to 500 characters.');
+  const wanted = raw.max_results ?? MCP_FIND_DEFAULT;
+  if (typeof wanted !== 'number' || !Number.isInteger(wanted) || wanted < 1) throw new Error('max_results must be a whole number from 1.');
+  return { query: raw.query.trim(), max_results: Math.min(wanted, MCP_FIND_MAX) };
+}
+
+function callOf(raw: unknown): McpCall {
+  if (!isRecord(raw) || typeof raw.tool !== 'string' || splitMcpTool(raw.tool) === null) throw new Error('Each call needs a tool named <connector>.<tool>, as find_tools returns it.');
+  const args = raw.arguments ?? {};
+  if (!isRecord(args)) throw new Error(`The arguments of ${raw.tool} must be an object.`);
+  if (raw.approval !== undefined && (typeof raw.approval !== 'string' || !MCP_APPROVAL_ID_RE.test(raw.approval))) throw new Error('approval must be the 5-letter id the approval request gave.');
+  return { tool: raw.tool, arguments: args, ...(typeof raw.approval === 'string' ? { approval: raw.approval } : {}) };
+}
+
+export function mcpCallsOf(raw: unknown): McpCall[] {
+  const calls = isRecord(raw) ? raw.calls : undefined;
+  if (!Array.isArray(calls) || calls.length === 0 || calls.length > MCP_CALLS_MAX) throw new Error(`call_tool needs 1 to ${String(MCP_CALLS_MAX)} calls.`);
+  return calls.map(callOf);
+}
+
+export function mcpTokenHashOf(raw: unknown): string {
+  if (!isRecord(raw) || typeof raw.tokenHash !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(raw.tokenHash)) throw new Error('tokenHash must be the base64url SHA-256 of the MCP token.');
+  return raw.tokenHash;
+}
+
+function approvalOf(raw: unknown): McpApproval | null {
+  if (!isRecord(raw) || typeof raw.id !== 'string' || !MCP_APPROVAL_ID_RE.test(raw.id) || typeof raw.connector !== 'string' || typeof raw.tool !== 'string' || typeof raw.preview !== 'string' || typeof raw.requestedAt !== 'number') return null;
+  return { id: raw.id, connector: raw.connector, tool: raw.tool, preview: raw.preview, requestedAt: raw.requestedAt };
+}
+
+export function mcpApprovalsOf(raw: unknown): McpApproval[] {
+  if (!isRecord(raw) || !Array.isArray(raw.approvals)) throw new Error('Mcp sent an unreadable approval list.');
+  return raw.approvals.map(approvalOf).filter((row): row is McpApproval => row !== null);
+}
+
+export function mcpAnswerOf(raw: unknown): { id: string; decision: McpDecision } {
+  if (!isRecord(raw) || typeof raw.id !== 'string' || !MCP_APPROVAL_ID_RE.test(raw.id) || (raw.decision !== 'allow' && raw.decision !== 'deny')) throw new Error('An answer needs the approval id and allow or deny.');
+  return { id: raw.id, decision: raw.decision };
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.302"
+  "version": "0.1.0-beta.304"
 }

package/runtime/sdk-runner/runner.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-beta.302",
+  "version": "0.1.0-beta.304",
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.287",
     "@modelcontextprotocol/sdk": "^1.29.0",