@zackbart/connecta 0.24.1 → 0.24.3

package/dist/index.js

@@ -1,5 +1,6 @@
 import { credentialTestRule, describeCredentialTestMismatch, } from "./credential-rules.js";
 import { Registry } from "./registry.js";
+import { parseConnectorAccess, POOL_NAME_RE } from "./connector-access.js";
 import { createFetchHandler } from "./server.js";
 import { droppedBrandingUrls, droppedUiAuthUrls } from "./branding.js";
 import { memoryStorage } from "./storage/memory.js";
@@ -56,8 +57,10 @@ const CONFIG_SCHEMA = {
         credentialAdministration: null,
         personalConnection: null,
     },
+    pools: null,
     storage: null,
     publicUrl: null,
+    allowedOrigins: null,
     activity: null,
     vault: null,
     ui: null,
@@ -68,6 +71,10 @@ const CONFIG_SCHEMA = {
         staleCatalogSeconds: null,
         probeTimeoutMs: null,
     },
+    results: {
+        maxStashBytes: null,
+        maxStashEntries: null,
+    },
     calls: {
         defaultTimeoutMs: null,
         maxResultBytes: null,
@@ -133,6 +140,17 @@ function rejectUnknownOptions(paths) {
 /** Reject JavaScript typos and removed options before construction does work. */
 function assertKnownConfig(config) {
     rejectUnknownOptions(unknownOptionPaths(config, "ConnectaConfig", CONFIG_SCHEMA));
+    if (config.results !== undefined) {
+        if (!config.results || typeof config.results !== "object" || Array.isArray(config.results)) {
+            throw new Error("ConnectaConfig.results must be an object");
+        }
+        for (const key of ["maxStashBytes", "maxStashEntries"]) {
+            const value = config.results[key];
+            if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
+                throw new Error(`ConnectaConfig.results.${key} must be a non-negative safe integer`);
+            }
+        }
+    }
     if (config.vault && ["get", "getAll", "set", "setAll", "metadata", "delete"].some(key => typeof config.vault[key] !== "function"))
         throw new Error("ConnectaConfig.vault must implement CredentialVault");
     if (config.ui && (typeof config.ui.handle !== "function" || typeof config.ui.credentialHandoffUrl !== "function" || !Array.isArray(config.ui.reservedPaths)))
@@ -145,6 +163,67 @@ function assertKnownConfig(config) {
         throw new Error("ConnectaConfig.activity must be created with activityHistory(...)");
     }
 }
+/**
+ * Validate declared pools against the connector set. Everything checkable at
+ * construction throws here: a malformed name, an unparseable grant, an
+ * unknown connector id, a tool address on an `api()` connector whose static
+ * catalog lacks it. Remote catalogs load lazily, so their addresses are
+ * checked at catalog load instead and stay unreachable until they match.
+ */
+function resolvePools(pools, registry) {
+    const resolved = new Map();
+    if (!pools)
+        return resolved;
+    if (typeof pools !== "object" || Array.isArray(pools)) {
+        throw new Error("ConnectaConfig.pools must be an object keyed by pool name");
+    }
+    for (const [name, pool] of Object.entries(pools)) {
+        if (!POOL_NAME_RE.test(name)) {
+            throw new Error(`ConnectaConfig.pools: pool name "${name}" must match [a-z0-9_-]+`);
+        }
+        if (!pool || typeof pool !== "object" || !Array.isArray(pool.tools)) {
+            throw new Error(`ConnectaConfig.pools.${name}: tools must be an array of connector ids or connector.tool addresses`);
+        }
+        if (pool.grant !== undefined && typeof pool.grant !== "function") {
+            throw new Error(`ConnectaConfig.pools.${name}: grant must be a function`);
+        }
+        // A misspelled `grant` would otherwise boot as a deny-all pool with only a
+        // per-request log line to say so; that is fail-closed, but the rule here
+        // is that structural mistakes refuse to boot.
+        for (const key of Object.keys(pool)) {
+            if (key !== "tools" && key !== "grant") {
+                throw new Error(`ConnectaConfig.pools.${name}: unknown option "${key}"`);
+            }
+        }
+        let access;
+        try {
+            access = parseConnectorAccess(pool.tools);
+        }
+        catch {
+            throw new Error(`ConnectaConfig.pools.${name}: tools must be connector ids or connector.tool addresses`);
+        }
+        if (access.connectorIds === "all" || access.connectorIds.length === 0) {
+            throw new Error(`ConnectaConfig.pools.${name}: a pool must name at least one connector or tool`);
+        }
+        for (const id of access.connectorIds) {
+            const connector = registry.getConnector(id);
+            if (!connector) {
+                throw new Error(`ConnectaConfig.pools.${name}: unknown connector "${id}"`);
+            }
+            const granted = access.toolAccess?.get(id);
+            if (!granted || !connector.staticTools)
+                continue;
+            const known = new Set(connector.staticTools.map((tool) => tool.name));
+            for (const tool of granted) {
+                if (!known.has(tool)) {
+                    throw new Error(`ConnectaConfig.pools.${name}: connector "${id}" has no tool "${tool}"`);
+                }
+            }
+        }
+        resolved.set(name, { access, grant: pool.grant ?? (() => false) });
+    }
+    return resolved;
+}
 /**
  * One-time construction warnings for deployment shapes that run fine but are
  * usually unintended. Warning-only — never throws and never changes behavior;
@@ -154,12 +233,15 @@ function assertKnownConfig(config) {
 function warnInsecureConfig(config, inboundAuth, logger) {
     const oauthConnectors = config.connectors.filter((c) => c.finishAuth);
     const hasCredentialConnector = config.connectors.some((c) => c.credential);
-    // Open mode (no inbound auth) with connectors that expose credentials or
-    // downstream OAuth: any caller reaches everything, including the vault.
+    // Static API headers can carry secrets without declaring credential hooks.
+    // Any configured connector warrants the open-deployment warning.
     if (inboundAuth.length === 0 &&
-        (hasCredentialConnector || oauthConnectors.length > 0)) {
+        config.connectors.length > 0) {
         logger.warn("[connecta] running with no inbound authentication: any caller can " +
             "invoke every shared connector. " +
+            (hasCredentialConnector || oauthConnectors.length > 0
+                ? "Configured credentials and downstream OAuth grants are exposed to those calls. "
+                : "") +
             "Configure `auth` (for example bearerToken(...) or Clerk) to gate access.");
     }
     // Unset publicUrl with OAuth connectors: the downstream redirect_uri is
@@ -267,8 +349,10 @@ export function createConnecta(config) {
         persistToolCatalog: config.discovery?.persistCatalog,
         toolCatalogStaleSeconds: config.discovery?.staleCatalogSeconds,
         maxResultBytes: config.calls?.maxResultBytes,
+        results: config.results,
     });
     const inboundAuth = configuredAuth;
+    const pools = resolvePools(config.pools, registry);
     warnInsecureConfig(config, inboundAuth, logger);
     const requestAdmission = admissionController(config.admission?.requests, REQUEST_ADMISSION_DEFAULTS);
     const configuredCodeAdmission = admissionController(config.admission?.code, CODE_ADMISSION_DEFAULTS);
@@ -290,7 +374,9 @@ export function createConnecta(config) {
         registry,
         auth: inboundAuth,
         identity: config.identity,
+        pools,
         publicUrl: config.publicUrl,
+        allowedOrigins: config.allowedOrigins,
         serverInfo,
         logger,
         activity: config.activity?.store,

package/dist/invocation.js

@@ -1,5 +1,5 @@
 import { isCallAdmissionError } from "./call-admission.js";
-import { classifyCallError, ConnectorCallError, echoedCallArgs, framingError, } from "./errors.js";
+import { boundedEchoText, classifyCallError, ConnectorCallError, echoedCallArgs, framingError, } from "./errors.js";
 import { unwrapMcpResult } from "./mcp-result.js";
 import { splitAddress } from "./registry.js";
 import { isExplicitlyReadOnly } from "./tool-safety.js";
@@ -43,10 +43,10 @@ function assertRawMcpSuccess(kind, result) {
     const mcpResult = result;
     if (!mcpResult.isError)
         return;
-    throw new Error(mcpResult.content
+    throw new Error(boundedEchoText(mcpResult.content
         ?.filter((block) => block.type === "text")
         .map((block) => block.text ?? "")
-        .join("") || "Downstream tool call failed");
+        .join("") || "Downstream tool call failed"));
 }
 export class InvocationFailure extends Error {
     details;
@@ -196,6 +196,8 @@ export class InvocationService {
                     tool: target.toolName,
                     source: context.source,
                     code: details.code,
+                    // Sanitized transport diagnostics (origin and errno only, #539).
+                    ...(details.details ? { details: details.details } : {}),
                     attempts,
                     durationMs: Date.now() - started,
                     message: String(details.message ?? "").slice(0, 300),
@@ -215,111 +217,150 @@ export class InvocationService {
                 error: details,
             };
         };
-        const resolution = await this.catalog.resolveTool(address, defined({ signal: context.requestSignal }));
-        catalogMs += resolution.catalogMs;
-        if (!resolution.ok) {
-            if (resolution.connector && resolution.toolName) {
-                activityTarget = {
-                    connector: resolution.connector,
-                    toolName: resolution.toolName,
-                };
-            }
-            if (resolution.cause && context.requestSignal?.aborted) {
-                return failed(callerCancelledDetails());
-            }
-            return failed(resolution.error);
-        }
-        resolved = resolution.resolved;
-        activityTarget = resolved;
-        if (!isExplicitlyReadOnly(resolved.definition) && !context.allowDestructive) {
-            const canonicalAddress = `${resolved.connector.id}.${resolved.toolName}`;
-            return failed(framingError("destructive_tool_requires_approval", `Tool "${canonicalAddress}" is not explicitly read-only. Invoke it through call_destructive_tool so the MCP host can request explicit approval.`));
-        }
-        // Remote MCP tools advertise their input schema in the catalog. Validate
-        // against that same request-local definition before admission or provider
-        // dispatch, so a predictable mismatch stays structured instead of being
-        // flattened into provider-specific error prose. Unsupported schemas retain
-        // validateToolInput's fail-open behavior and reach the downstream normally.
-        if (resolved.connector.kind === "mcp" &&
-            resolved.definition.inputSchema) {
-            const invalid = validateToolInput(resolved.definition.inputSchema, args ?? {}, {
-                address: `${resolved.connector.id}.${resolved.toolName}`,
-                logger: this.registry.contextFor(resolved.connector.id, this.catalog.baseUrl, this.catalog.requestScope).logger,
-            });
-            if (invalid)
-                return failed(classifyCallError(invalid));
-        }
-        try {
-            context.beforeDispatch?.();
-        }
-        catch (error) {
-            return failed(error instanceof InvocationFailure
-                ? error.details
-                : classifyCallError(error));
+        if (context.requestSignal?.aborted) {
+            // Preserve the cancelled admission-attempt count without starting discovery.
+            attempts = 1;
+            return failed(callerCancelledDetails());
         }
         let result;
         let observedResult;
-        attempts = 1;
-        let permit;
-        let attemptError;
-        let attemptFailed = false;
+        // One deadline owns discovery, queue admission, and provider dispatch.
+        // Only the caller of this function records the final outcome, so a late
+        // cancellation cannot append a second activity event after the deadline.
+        const dispatch = async (callSignal) => {
+            const resolution = await this.catalog.resolveTool(address, defined({ signal: callSignal }));
+            catalogMs += resolution.catalogMs;
+            if (callSignal?.aborted)
+                throw callSignal.reason;
+            if (!resolution.ok) {
+                if (resolution.connector && resolution.toolName) {
+                    activityTarget = {
+                        connector: resolution.connector,
+                        toolName: resolution.toolName,
+                    };
+                }
+                if (resolution.cause && context.requestSignal?.aborted) {
+                    return callerCancelledDetails();
+                }
+                return resolution.error;
+            }
+            const target = resolution.resolved;
+            resolved = target;
+            activityTarget = target;
+            if (!isExplicitlyReadOnly(target.definition) && !context.allowDestructive) {
+                const canonicalAddress = `${target.connector.id}.${target.toolName}`;
+                return framingError("destructive_tool_requires_approval", `Tool "${canonicalAddress}" is not explicitly read-only. Invoke it through call_destructive_tool so the MCP host can request explicit approval.`);
+            }
+            // Remote MCP tools advertise their input schema in the catalog. Validate
+            // against that same request-local definition before admission or provider
+            // dispatch, so a predictable mismatch stays structured instead of being
+            // flattened into provider-specific error prose. Unsupported schemas retain
+            // validateToolInput's fail-open behavior and reach the downstream normally.
+            if (target.connector.kind === "mcp" &&
+                target.definition.inputSchema) {
+                const invalid = validateToolInput(target.definition.inputSchema, args ?? {}, {
+                    address: `${target.connector.id}.${target.toolName}`,
+                    logger: this.registry.contextFor(target.connector.id, this.catalog.baseUrl, this.catalog.requestScope).logger,
+                });
+                if (invalid)
+                    return classifyCallError(invalid);
+            }
+            try {
+                context.beforeDispatch?.();
+            }
+            catch (error) {
+                return error instanceof InvocationFailure
+                    ? error.details
+                    : classifyCallError(error);
+            }
+            if (callSignal?.aborted)
+                throw callSignal.reason;
+            attempts = 1;
+            let permit;
+            let attemptError;
+            let attemptFailed = false;
+            try {
+                permit = await timed((elapsed) => { admissionMs += elapsed; }, () => this.registry.admitCall(target.connector.id, {
+                    toolName: target.toolName,
+                    args: args ?? {},
+                    ...defined({ signal: callSignal }),
+                }));
+                const raw = await timed((elapsed) => { connectorMs += elapsed; }, () => {
+                    const call = () => {
+                        const connectorContext = this.registry.contextFor(target.connector.id, this.catalog.baseUrl, this.catalog.requestScope, defined({ signal: callSignal, timeoutMs: context.timeoutMs }));
+                        if (target.connector.credential &&
+                            !connectorContext.credential) {
+                            throw new ConnectorCallError("auth_required", "Operator-managed credential storage is not configured. Call " +
+                                `authorize_connector({ connector: "${target.connector.id}" }).`);
+                        }
+                        // Cancellation can arrive during admission or context construction.
+                        if (callSignal?.aborted)
+                            throw callSignal.reason;
+                        return target.connector.callTool(target.toolName, args ?? {}, connectorContext);
+                    };
+                    // Race cancellation here too, so an uncooperative connector cannot
+                    // retain its admission permit after the enclosing deadline expires.
+                    return callSignal
+                        ? withDeadline(call, {
+                            signal: callSignal,
+                            timeoutError: new ConnectorCallError("timeout", "Tool call timed out"),
+                        })
+                        : call();
+                });
+                // isError is checked here for BOTH result shapes so every adapter
+                // reports the same downstream-failure wording, and the throw lands
+                // inside the attempt where it feeds health.
+                assertRawMcpSuccess(target.connector.kind, raw);
+                observedResult = unwrapMcpResult(target.connector.kind, raw);
+                result = context.unwrapResult ? observedResult : raw;
+            }
+            catch (error) {
+                attemptFailed = true;
+                attemptError = error;
+            }
+            finally {
+                permit?.release();
+            }
+            if (attemptFailed) {
+                if (callSignal?.aborted)
+                    throw callSignal.reason;
+                const callerCancelled = isCallerCancellation(attemptError, context.requestSignal);
+                const details = callerCancelled
+                    ? callerCancelledDetails()
+                    : classifyCallError(attemptError);
+                return details;
+            }
+            return undefined;
+        };
         try {
-            permit = await timed((elapsed) => { admissionMs += elapsed; }, () => this.registry.admitCall(resolved.connector.id, {
-                toolName: resolved.toolName,
-                args: args ?? {},
-                ...defined({ signal: context.requestSignal }),
-            }));
-            const raw = await timed((elapsed) => { connectorMs += elapsed; }, () => {
-                const call = (callSignal) => {
-                    const connectorContext = this.registry.contextFor(resolved.connector.id, this.catalog.baseUrl, this.catalog.requestScope, defined({ signal: callSignal, timeoutMs: context.timeoutMs }));
-                    if (resolved.connector.credential &&
-                        !connectorContext.credential) {
-                        throw new ConnectorCallError("auth_required", "Operator-managed credential storage is not configured. Call " +
-                            `authorize_connector({ connector: "${resolved.connector.id}" }).`);
-                    }
-                    // Cancellation can arrive during admission or context construction.
-                    if (callSignal?.aborted)
-                        throw callSignal.reason;
-                    return resolved.connector.callTool(resolved.toolName, args ?? {}, connectorContext);
-                };
-                if (!context.timeoutMs && !context.requestSignal)
-                    return call();
-                return withDeadline(call, {
+            const error = context.timeoutMs || context.requestSignal
+                ? await withDeadline(dispatch, {
                     ...defined({
                         timeoutMs: context.timeoutMs,
                         signal: context.requestSignal,
                     }),
                     timeoutError: new ConnectorCallError("timeout", `Tool call timed out after ${context.timeoutMs}ms`),
-                });
-            });
-            // isError is checked here for BOTH result shapes so every adapter
-            // reports the same downstream-failure wording, and the throw lands
-            // inside the attempt where it feeds health.
-            assertRawMcpSuccess(resolved.connector.kind, raw);
-            observedResult = unwrapMcpResult(resolved.connector.kind, raw);
-            result = context.unwrapResult ? observedResult : raw;
+                })
+                : await dispatch();
+            if (error)
+                return failed(error);
         }
         catch (error) {
-            attemptFailed = true;
-            attemptError = error;
-        }
-        finally {
-            permit?.release();
-        }
-        if (attemptFailed) {
-            const callerCancelled = isCallerCancellation(attemptError, context.requestSignal);
-            const details = callerCancelled
+            return failed(context.requestSignal?.aborted
                 ? callerCancelledDetails()
-                : classifyCallError(attemptError);
-            return failed(details);
+                : classifyCallError(error));
         }
+        // A dispatch that returned no refusal resolved a concrete tool.
+        const completed = resolved;
+        if (!completed)
+            throw new Error("Invocation completed without a resolved tool");
         try {
             const value = await timed((elapsed) => { resultProcessingMs += elapsed; }, async () => {
                 const processed = context.processResult
-                    ? await context.processResult(result, resolved)
+                    ? await context.processResult(result, completed)
                     : result;
                 try {
-                    this.registry.observeOutputShape(resolved.connector.id, resolved.definition, observedResult);
+                    this.registry.observeOutputShape(completed.connector.id, completed.definition, observedResult);
                 }
                 catch {
                     // Shape learning is advisory. It cannot change a completed call.
@@ -332,14 +373,14 @@ export class InvocationService {
             return {
                 ok: true,
                 value,
-                resolved,
+                resolved: completed,
                 durationMs: Date.now() - started,
                 attempts,
                 timing: diagnostics,
             };
         }
-        catch (error) {
-            return failed(framingError("result_processing_failed", error instanceof Error ? error.message : String(error)));
+        catch {
+            return failed(framingError("result_processing_failed", "The downstream call completed, but its result could not be processed. Do not repeat the call to recover its result."));
         }
     }
 }

package/dist/mcp-result.js

@@ -1,3 +1,4 @@
+import { boundedEchoText } from "./errors.js";
 /**
  * Unwrap an MCP CallToolResult into an ordinary JavaScript value:
  * `toolResult` wins when present, then `structuredContent`; all-text content is
@@ -17,9 +18,9 @@ export function unwrapMcpResult(kind, result) {
             .filter((c) => c.type === "text")
             .map((c) => c.text ?? "")
             .join("\n");
-        throw new Error(text || "Tool call failed");
+        throw new Error(boundedEchoText(text || "Tool call failed"));
     }
-    if (r.structuredContent != null)
+    if (r.structuredContent !== undefined)
         return r.structuredContent;
     if (content.length > 0 && content.every((c) => c.type === "text")) {
         const text = content.map((c) => c.text ?? "").join("\n");