@zackbart/connecta 0.24.2 → 0.24.3

package/dist/executors/quickjs-runtime.js

@@ -80,30 +80,43 @@ export function normalizeCode(code) {
  * and fail closed there.
  */
 function setupScript(providers) {
+    // X11: raw replies carry an authenticated frame. Capture the bridge and
+    // codec before guest code runs, and expose only the decoded provider calls.
     const lines = [
-        `globalThis.console = (() => {
-  const fmt = (x) => { if (typeof x === "string") return x; try { return JSON.stringify(x); } catch { return String(x); } };
-  const emit = (...a) => __log(a.map(fmt).join(" "));
-  return { log: emit, info: emit, warn: emit, error: emit, debug: emit };
-})();`,
-        `globalThis.__invoke = async (ns, fn, args) => {
-  const r = JSON.parse(await __call(ns, fn, JSON.stringify(args)));
-  if (!r.ok) throw new Error(r.error);
-  return r.value;
-};`,
-        `globalThis.__namespace = (ns) => Object.freeze(new Proxy(Object.create(null), {
-  get: (_target, key) => typeof key === "string" ? (...args) => __invoke(ns, key, args) : undefined
-}));`,
+        `(() => {
+  const call = globalThis.__call;
+  const log = globalThis.__log;
+  const parse = JSON.parse;
+  const stringify = JSON.stringify;
+  const freeze = Object.freeze;
+  const ProxyConstructor = Proxy;
+  const create = Object.create;
+  delete globalThis.__call;
+  delete globalThis.__log;
+  globalThis.console = (() => {
+    const fmt = (x) => { if (typeof x === "string") return x; try { return stringify(x); } catch { return String(x); } };
+    const emit = (...a) => log(a.map(fmt).join(" "));
+    return { log: emit, info: emit, warn: emit, error: emit, debug: emit };
+  })();
+  const invoke = async (ns, fn, args) => {
+    const r = parse(await call(ns, fn, stringify(args)));
+    if (!r.ok) throw new GuestError(r.error);
+    return r.value;
+  };
+  const namespace = (ns) => freeze(new ProxyConstructor(create(null), {
+    get: (_target, key) => typeof key === "string" ? (...args) => invoke(ns, key, args) : undefined
+  }));`,
     ];
     for (const p of providers) {
         const ns = JSON.stringify(p.name);
-        lines.push(`globalThis[${ns}] = __namespace(${ns});`);
+        lines.push(`globalThis[${ns}] = namespace(${ns});`);
     }
     for (const p of providers) {
         if (p.prelude)
             lines.push(p.prelude);
     }
-    lines.push(`delete globalThis.__namespace;`);
+    lines.push(`const GuestError = globalThis.Error;
+})();`);
     return lines.join("\n");
 }
 /** True when a dumped error is QuickJS's deadline-interrupt signal. */
@@ -145,7 +158,7 @@ function waitForHostOrDeadline(waitForSettle, remainingMs) {
         });
     });
 }
-function installBridge(ctx, providers, logs) {
+function installBridge(ctx, providers, logs, onLog) {
     const bridge = {
         pending: 0,
         aborted: false,
@@ -156,13 +169,17 @@ function installBridge(ctx, providers, logs) {
     // Keep both the in-memory character budget and the twice-JSON-encoded
     // transport budget. Reserve enough byte budget for whichever truncation
     // marker ends the stream.
+    const captureLog = (entry) => {
+        logs.push(entry);
+        onLog?.(entry);
+    };
     let logTotalChars = 0;
     let logTotalTransportBytes = 0;
     let logBudgetSpent = false;
     const logFn = ctx.newFunction("__log", (h) => {
         if (logs.length >= MAX_LOG_ENTRIES) {
             if (logs.length === MAX_LOG_ENTRIES) {
-                logs.push(LOG_ENTRY_LIMIT_MARKER);
+                captureLog(LOG_ENTRY_LIMIT_MARKER);
             }
             return;
         }
@@ -178,11 +195,11 @@ function installBridge(ctx, providers, logs) {
         if (logTotalChars + entry.length > MAX_LOG_TOTAL_CHARS ||
             logTotalTransportBytes + entryTransportBytes >
                 MAX_QUICKJS_LOG_TRANSPORT_BYTES - MAX_LOG_MARKER_TRANSPORT_BYTES) {
-            logs.push(LOG_SIZE_LIMIT_MARKER);
+            captureLog(LOG_SIZE_LIMIT_MARKER);
             logBudgetSpent = true;
             return;
         }
-        logs.push(entry);
+        captureLog(entry);
         logTotalChars += entry.length;
         logTotalTransportBytes += entryTransportBytes;
     });
@@ -248,7 +265,7 @@ function installBridge(ctx, providers, logs) {
  * CPU accumulates only while evalCode/executePendingJobs is synchronously
  * driving QuickJS, so a slow downstream does not consume the short CPU budget.
  */
-export async function executeQuickJs(code, providers, options) {
+export async function executeQuickJs(code, providers, options, onLog) {
     const { timeoutMs, cpuTimeMs, memoryLimitBytes, maxStackSizeBytes } = options;
     const QuickJS = await getQuickJS();
     const ctx = QuickJS.newContext();
@@ -282,7 +299,7 @@ export async function executeQuickJs(code, providers, options) {
         return wallInterrupted || cpuInterrupted;
     });
     const logs = [];
-    const bridge = installBridge(ctx, providers, logs);
+    const bridge = installBridge(ctx, providers, logs, onLog);
     const finish = (r) => {
         bridge.aborted = true;
         // Outstanding host calls still hold deferred-promise handles; their

package/dist/executors/quickjs.js

@@ -7,6 +7,7 @@ import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { AdmissionController, ExecutorAdmissionError, ExecutorExecutionError, } from "../executor-admission.js";
 import { msg } from "../errors.js";
+import { MAX_EXECUTE_LOG_CHARS } from "../executor-result.js";
 import { hostCallLabel, MAX_QUICKJS_IPC_BYTES, MAX_QUICKJS_HOST_RPC_BYTES, serializedBytes, stringifyBounded, } from "./quickjs-protocol.js";
 export { normalizeCode } from "./quickjs-runtime.js";
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -55,9 +56,14 @@ function nonNegativeWhole(value, fallback, name) {
     return resolved;
 }
 function errorPayload(error) {
+    // X11: a partial authenticated frame exposes its secret instead of decoding.
+    // Refuse it whole if a host ever bypasses execute.ts's framing bound.
+    const message = error.length > MAX_ERROR_CHARS && error.includes("\u001econnecta-error:")
+        ? `Host failure exceeded the ${MAX_ERROR_CHARS}-character bridge limit.`
+        : error.slice(0, MAX_ERROR_CHARS);
     return JSON.stringify({
         ok: false,
-        error: error.slice(0, MAX_ERROR_CHARS),
+        error: message,
     });
 }
 function delay(ms, signal) {
@@ -217,14 +223,13 @@ class QuickJsChildPool {
         child.channel?.ref();
         return new Promise((resolve, reject) => {
             const wallTimer = setTimeout(() => {
-                this.resolveActive(slot, {
-                    result: undefined,
-                    error: `QuickJS child exceeded the ${this.runtimeOptions.timeoutMs}ms wall budget and was terminated.`,
-                });
+                this.rejectActive(slot, new Error(`QuickJS child exceeded the ${this.runtimeOptions.timeoutMs}ms wall budget and was terminated.`));
                 this.recycle(slot);
             }, this.runtimeOptions.timeoutMs + CHILD_EXIT_GRACE_MS);
             const active = {
                 id,
+                logs: [],
+                logChars: 0,
                 providers: providerMap,
                 resolve,
                 reject,
@@ -328,7 +333,7 @@ class QuickJsChildPool {
                 return;
             this.recordCrash(slot);
             const error = childExitError(`QuickJS child exited unexpectedly (${exitDescription}).`, stderrTail);
-            this.resolveActive(slot, { result: undefined, error: error.message });
+            this.rejectActive(slot, error);
         });
         child.unref();
         child.channel?.unref();
@@ -350,19 +355,39 @@ class QuickJsChildPool {
             return;
         if (typeof message.payloadJson !== "string")
             return;
+        if (message.type === "log") {
+            if (message.jobId !== active.id)
+                return;
+            // Keep one extra character so the presentation layer can signal loss.
+            // The final reply owns complete successful logs; this prefix survives
+            // only when that reply cannot arrive. Bound even a compromised child.
+            if (active.logChars >= MAX_EXECUTE_LOG_CHARS + 1)
+                return;
+            if (serializedBytes(message.payloadJson) > MAX_QUICKJS_IPC_BYTES)
+                return;
+            try {
+                stringifyBounded(message, "QuickJS log IPC envelope");
+                const entry = JSON.parse(message.payloadJson);
+                if (typeof entry !== "string")
+                    return;
+                const separator = active.logs.length > 0 ? 1 : 0;
+                const retained = entry.slice(0, MAX_EXECUTE_LOG_CHARS + 1 - active.logChars - separator);
+                active.logs.push(retained);
+                active.logChars += separator + retained.length;
+            }
+            catch { /* Malformed log messages carry no output. */ }
+            return;
+        }
         if (message.type === "host-call") {
             if (message.jobId !== active.id)
                 return;
-            await this.handleHostCall(child, active, message);
+            await this.handleHostCall(slot, child, active, message);
             return;
         }
         if (message.type !== "result" || message.jobId !== active.id)
             return;
         if (serializedBytes(message.payloadJson) > MAX_QUICKJS_IPC_BYTES) {
-            this.resolveActive(slot, {
-                result: undefined,
-                error: "QuickJS execution result exceeded the IPC limit.",
-            });
+            this.rejectActive(slot, new Error("QuickJS execution result exceeded the IPC limit."));
             this.recycle(slot);
             return;
         }
@@ -380,14 +405,11 @@ class QuickJsChildPool {
             }
         }
         catch (err) {
-            this.resolveActive(slot, {
-                result: undefined,
-                error: `QuickJS child returned an invalid result: ${msg(err)}`,
-            });
+            this.rejectActive(slot, new Error(`QuickJS child returned an invalid result: ${msg(err)}`));
             this.recycle(slot);
         }
     }
-    async handleHostCall(child, active, message) {
+    async handleHostCall(slot, child, active, message) {
         let payloadJson;
         try {
             if (serializedBytes(message.payloadJson) >
@@ -422,35 +444,54 @@ class QuickJsChildPool {
         catch (err) {
             payloadJson = errorPayload(msg(err));
         }
-        if (!child.connected)
+        if (!child.connected || slot.active !== active)
             return;
+        const response = {
+            type: "host-result",
+            jobId: message.jobId,
+            callId: message.callId,
+            payloadJson,
+        };
         try {
-            const response = {
-                type: "host-result",
-                jobId: message.jobId,
-                callId: message.callId,
-                payloadJson,
-            };
             stringifyBounded(response, "QuickJS host-result IPC envelope");
-            child.send(response);
         }
         catch {
-            // The execution has already ended or the child is exiting. Its exit
-            // handler owns the structured failure for any still-active job.
+            // L6/X10: settle the rejected call even if the outer encoding overflows.
+            response.payloadJson = errorPayload(`QuickJS host-result IPC envelope could not be serialized within the ${MAX_QUICKJS_IPC_BYTES}-byte IPC limit.`);
+        }
+        const failedSend = (error) => {
+            if (!error || slot.active !== active)
+                return;
+            this.rejectActive(slot, error);
+            this.recycle(slot);
+        };
+        try {
+            stringifyBounded(response, "QuickJS host-result IPC envelope");
+            child.send(response, failedSend);
+        }
+        catch (err) {
+            failedSend(err instanceof Error ? err : new Error(msg(err)));
         }
     }
     resolveActive(slot, outcome) {
         const active = slot.active;
         if (!active)
             return;
+        // Never concatenate the stream with the final reply: those entries are
+        // the same logs. A normal reply retains its existing full log contract.
+        const resolved = outcome.logs === undefined && active.logs.length > 0
+            ? { ...outcome, logs: active.logs }
+            : outcome;
         this.clearActive(slot, active);
-        active.resolve(outcome);
+        active.resolve(resolved);
     }
     rejectActive(slot, error) {
         const active = slot.active;
         if (!active)
             return;
         this.clearActive(slot, active);
+        if (active.logs.length > 0)
+            Object.assign(error, { logs: active.logs });
         active.reject(error);
     }
     clearActive(slot, active) {

package/dist/index.d.ts

@@ -51,6 +51,13 @@ export interface ConnectaCallsConfig {
      */
     maxResultBytes?: number;
 }
+/** Runtime-wide bounds for transient direct-call result paging. */
+export interface ConnectaResultsConfig {
+    /** Stored bytes, including the paging envelope. Default 8 MiB. Zero disables stashing. */
+    maxStashBytes?: number;
+    /** Stored or in-flight entries. Default 64. Zero disables stashing. */
+    maxStashEntries?: number;
+}
 /** Budgets for execute_code programs: host calls and rich output (`connecta.emit`). */
 export interface ConnectaExecuteConfig {
     /**
@@ -149,6 +156,11 @@ export interface ConnectaConfig {
      * HTTPS URL also redirects matching inbound HTTP requests to HTTPS.
      */
     publicUrl?: string;
+    /**
+     * Exact browser MCP origins, or "*". Defaults to publicUrl's origin and
+     * HTTP(S) loopback origins at any port. Originless clients are admitted.
+     */
+    allowedOrigins?: readonly string[] | "*";
     /** Optional recorder and reader, created by activityHistory() from /activity. */
     activity?: ActivityModule;
     /** Replaceable owner-partitioned credential storage. Omit for config-owned secrets. */
@@ -159,6 +171,8 @@ export interface ConnectaConfig {
     discovery?: ConnectaDiscoveryConfig;
     /** Deployment-wide call deadlines and result paging threshold. */
     calls?: ConnectaCallsConfig;
+    /** Runtime-wide transient result stash limits, shared across subjects. */
+    results?: ConnectaResultsConfig;
     /** Budgets for the `connecta.emit` rich-output channel in execute_code. */
     execute?: ConnectaExecuteConfig;
     /** Bounded MCP and fallback code-mode admission. */

package/dist/index.js

@@ -60,6 +60,7 @@ const CONFIG_SCHEMA = {
     pools: null,
     storage: null,
     publicUrl: null,
+    allowedOrigins: null,
     activity: null,
     vault: null,
     ui: null,
@@ -70,6 +71,10 @@ const CONFIG_SCHEMA = {
         staleCatalogSeconds: null,
         probeTimeoutMs: null,
     },
+    results: {
+        maxStashBytes: null,
+        maxStashEntries: null,
+    },
     calls: {
         defaultTimeoutMs: null,
         maxResultBytes: null,
@@ -135,6 +140,17 @@ function rejectUnknownOptions(paths) {
 /** Reject JavaScript typos and removed options before construction does work. */
 function assertKnownConfig(config) {
     rejectUnknownOptions(unknownOptionPaths(config, "ConnectaConfig", CONFIG_SCHEMA));
+    if (config.results !== undefined) {
+        if (!config.results || typeof config.results !== "object" || Array.isArray(config.results)) {
+            throw new Error("ConnectaConfig.results must be an object");
+        }
+        for (const key of ["maxStashBytes", "maxStashEntries"]) {
+            const value = config.results[key];
+            if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
+                throw new Error(`ConnectaConfig.results.${key} must be a non-negative safe integer`);
+            }
+        }
+    }
     if (config.vault && ["get", "getAll", "set", "setAll", "metadata", "delete"].some(key => typeof config.vault[key] !== "function"))
         throw new Error("ConnectaConfig.vault must implement CredentialVault");
     if (config.ui && (typeof config.ui.handle !== "function" || typeof config.ui.credentialHandoffUrl !== "function" || !Array.isArray(config.ui.reservedPaths)))
@@ -217,12 +233,15 @@ function resolvePools(pools, registry) {
 function warnInsecureConfig(config, inboundAuth, logger) {
     const oauthConnectors = config.connectors.filter((c) => c.finishAuth);
     const hasCredentialConnector = config.connectors.some((c) => c.credential);
-    // Open mode (no inbound auth) with connectors that expose credentials or
-    // downstream OAuth: any caller reaches everything, including the vault.
+    // Static API headers can carry secrets without declaring credential hooks.
+    // Any configured connector warrants the open-deployment warning.
     if (inboundAuth.length === 0 &&
-        (hasCredentialConnector || oauthConnectors.length > 0)) {
+        config.connectors.length > 0) {
         logger.warn("[connecta] running with no inbound authentication: any caller can " +
             "invoke every shared connector. " +
+            (hasCredentialConnector || oauthConnectors.length > 0
+                ? "Configured credentials and downstream OAuth grants are exposed to those calls. "
+                : "") +
             "Configure `auth` (for example bearerToken(...) or Clerk) to gate access.");
     }
     // Unset publicUrl with OAuth connectors: the downstream redirect_uri is
@@ -330,6 +349,7 @@ export function createConnecta(config) {
         persistToolCatalog: config.discovery?.persistCatalog,
         toolCatalogStaleSeconds: config.discovery?.staleCatalogSeconds,
         maxResultBytes: config.calls?.maxResultBytes,
+        results: config.results,
     });
     const inboundAuth = configuredAuth;
     const pools = resolvePools(config.pools, registry);
@@ -356,6 +376,7 @@ export function createConnecta(config) {
         identity: config.identity,
         pools,
         publicUrl: config.publicUrl,
+        allowedOrigins: config.allowedOrigins,
         serverInfo,
         logger,
         activity: config.activity?.store,