@tokenoftrust/storefront-runner 4.11.7 → 4.11.9

package/apps/storefront/src/lib/access/shared/viewerGrant.ts

@@ -50,14 +50,19 @@ export class FetchShipGrantTransport implements ViewerShipGrantGetTransport {
     // every admin tab), so an unbounded hang stalls the whole document stream. A
     // timeout aborts to the documented deny-default (the resolver maps any transport/
     // timeout fault to `preview-access`) — never a render-blocking wait on a slow MCP.
-    // `redirect: "error"`: a redirect would carry the service-secret header to another origin,
-    // so it rejects (a transport fault, so a deny) and nothing is sent to the redirect target.
+    // `redirect: "manual"`, then a 3xx throws: a followed redirect would carry the service-secret
+    // header to another origin, so a redirect is a transport fault (a deny) and nothing is sent to
+    // its target. Not `redirect: "error"`: the Workers runtime rejects that value before the request
+    // leaves, so every lookup would deny without ever reaching tot-mcp.
     const res = await fetch(url, {
       method: "GET",
       headers,
-      redirect: "error",
+      redirect: "manual",
       signal: AbortSignal.timeout(2500),
     });
+    if ((res.status >= 300 && res.status < 400) || res.type === "opaqueredirect") {
+      throw new Error("grant authority answered a redirect; refused");
+    }
     return { status: res.status, json: () => res.json() };
   }
 }

package/apps/storefront/src/lib/developer-experience/http/mcpServiceCall.ts

@@ -14,7 +14,10 @@
  *
  * Every outcome but `ok` logs one `[mcp-service-seam]` line naming the method, the contract path
  * and a fixed reason: the env name for `not-configured` / `bad-url`, the error class (from a fixed
- * list) for `transport-error`, the status otherwise. Never the URL, query, secret or thrown text.
+ * list) for `transport-error`, the status otherwise. A `TypeError` also carries its message and its
+ * cause's message, scrubbed of URLs, email addresses and the secret, because fetch's wording is
+ * what separates a lost connection from one refused before connecting or a TLS trust failure.
+ * Never the URL, query or secret, and no other thrown value's text.
  *
  * A 401 or 404 from a seam route is misconfiguration, never a business answer: tot-mcp's
  * routes answer 200 for every absent/unknown case, so 401 means the secret or URL is wrong
@@ -87,6 +90,33 @@ export function transportErrorClass(thrown: unknown): string {
   return thrown instanceof Error && TRANSPORT_ERROR_CLASSES.has(thrown.name) ? thrown.name : "Error";
 }
 
+/** A thrown text with every URL, email address and the given secret removed, whitespace folded, capped. */
+function scrubbed(text: string, secret: string): string {
+  let out = text;
+  if (secret) out = out.split(secret).join("<secret>");
+  return out
+    .replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s'"<>)]+/gi, "<url>")
+    .replace(/[^\s@'"<>(),;:]+@[^\s@'"<>(),;:]+\.[a-z]{2,}/gi, "<email>")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 160);
+}
+
+/**
+ * For a `TypeError` (how a Workers fetch reports a connection it could not make: lost, refused
+ * before connecting, TLS trust), its message and its cause's message, scrubbed of URLs, email
+ * addresses and the service secret. Those words are what tell the network causes apart. Any other
+ * thrown value yields nothing: its text is not a fetch's own wording.
+ */
+export function transportErrorDetail(thrown: unknown, secret: string): string {
+  if (!(thrown instanceof TypeError)) return "";
+  const cause = (thrown as { cause?: unknown }).cause;
+  const causeText = cause instanceof Error ? cause.message : typeof cause === "string" ? cause : "";
+  const parts = [`message "${scrubbed(thrown.message, secret)}"`];
+  if (causeText) parts.push(`cause "${scrubbed(causeText, secret)}"`);
+  return `: ${parts.join(", ")}`;
+}
+
 export async function callMcpService(req: McpServiceRequest): Promise<McpServiceOutcome> {
   const urlEnv = AUTHORITY_ENV[req.authority ?? "binding"];
   const authorityUrl = await readEnv(urlEnv);
@@ -125,7 +155,9 @@ export async function callMcpService(req: McpServiceRequest): Promise<McpService
       res = await req.transport.post(url, headers, req.body);
     }
   } catch (thrown) {
-    console.error(`[mcp-service-seam] ${req.method} ${req.path} transport-error: ${transportErrorClass(thrown)} (${urlEnv})`);
+    console.error(
+      `[mcp-service-seam] ${req.method} ${req.path} transport-error: ${transportErrorClass(thrown)} (${urlEnv})${transportErrorDetail(thrown, secret)}`,
+    );
     return { kind: "transport-error", message: MCP_SERVICE_TRANSPORT_FAILURE };
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.7",
+  "version": "4.11.9",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",