@zackbart/connecta 0.24.2 → 0.24.4

package/dist/index.js

@@ -2,7 +2,7 @@ import { credentialTestRule, describeCredentialTestMismatch, } from "./credentia
 import { Registry } from "./registry.js";
 import { parseConnectorAccess, POOL_NAME_RE } from "./connector-access.js";
 import { createFetchHandler } from "./server.js";
-import { droppedBrandingUrls, droppedUiAuthUrls } from "./branding.js";
+import { droppedBrandingUrls, droppedThemeTokens, droppedUiAuthUrls, } from "./branding.js";
 import { memoryStorage } from "./storage/memory.js";
 import { CONNECTA_VERSION } from "./version.js";
 import { AdmissionController, executorName, isAdmittingExecutor, withExecutorAdmission, } from "./executor-admission.js";
@@ -60,6 +60,7 @@ const CONFIG_SCHEMA = {
     pools: null,
     storage: null,
     publicUrl: null,
+    allowedOrigins: null,
     activity: null,
     vault: null,
     ui: null,
@@ -70,6 +71,10 @@ const CONFIG_SCHEMA = {
         staleCatalogSeconds: null,
         probeTimeoutMs: null,
     },
+    results: {
+        maxStashBytes: null,
+        maxStashEntries: null,
+    },
     calls: {
         defaultTimeoutMs: null,
         maxResultBytes: null,
@@ -135,6 +140,17 @@ function rejectUnknownOptions(paths) {
 /** Reject JavaScript typos and removed options before construction does work. */
 function assertKnownConfig(config) {
     rejectUnknownOptions(unknownOptionPaths(config, "ConnectaConfig", CONFIG_SCHEMA));
+    if (config.results !== undefined) {
+        if (!config.results || typeof config.results !== "object" || Array.isArray(config.results)) {
+            throw new Error("ConnectaConfig.results must be an object");
+        }
+        for (const key of ["maxStashBytes", "maxStashEntries"]) {
+            const value = config.results[key];
+            if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
+                throw new Error(`ConnectaConfig.results.${key} must be a non-negative safe integer`);
+            }
+        }
+    }
     if (config.vault && ["get", "getAll", "set", "setAll", "metadata", "delete"].some(key => typeof config.vault[key] !== "function"))
         throw new Error("ConnectaConfig.vault must implement CredentialVault");
     if (config.ui && (typeof config.ui.handle !== "function" || typeof config.ui.credentialHandoffUrl !== "function" || !Array.isArray(config.ui.reservedPaths)))
@@ -217,12 +233,15 @@ function resolvePools(pools, registry) {
 function warnInsecureConfig(config, inboundAuth, logger) {
     const oauthConnectors = config.connectors.filter((c) => c.finishAuth);
     const hasCredentialConnector = config.connectors.some((c) => c.credential);
-    // Open mode (no inbound auth) with connectors that expose credentials or
-    // downstream OAuth: any caller reaches everything, including the vault.
+    // Static API headers can carry secrets without declaring credential hooks.
+    // Any configured connector warrants the open-deployment warning.
     if (inboundAuth.length === 0 &&
-        (hasCredentialConnector || oauthConnectors.length > 0)) {
+        config.connectors.length > 0) {
         logger.warn("[connecta] running with no inbound authentication: any caller can " +
             "invoke every shared connector. " +
+            (hasCredentialConnector || oauthConnectors.length > 0
+                ? "Configured credentials and downstream OAuth grants are exposed to those calls. "
+                : "") +
             "Configure `auth` (for example bearerToken(...) or Clerk) to gate access.");
     }
     // Unset publicUrl with OAuth connectors: the downstream redirect_uri is
@@ -243,6 +262,17 @@ function warnInsecureConfig(config, inboundAuth, logger) {
             "used as an href, so it must be an absolute http(s) URL (favicon.href " +
             "may also be a root-relative path). The default is rendered instead.");
     }
+    // Theme tokens are written into a `:root` block, so each is gated
+    // syntactically and a rejected value takes the stylesheet's default. Same
+    // reason as the branding URLs above: the page still renders, so without this
+    // line the only evidence is that the operator's color never showed up.
+    const droppedTheme = droppedThemeTokens(config.ui?.branding?.theme);
+    if (droppedTheme.length > 0) {
+        logger.warn(`[connecta] branding ${droppedTheme.join(", ")} dropped: accent must be ` +
+            "a hex color, radius a CSS length, the font families a plain " +
+            "font-family list, and colorScheme one of system/light/dark. The " +
+            "default is rendered instead.");
+    }
     // Operator shells render exactly one provider's browser sign-in config — the
     // first that offers one, matching the server route's `find` — and that
     // provider's URLs reach the browser: frontendApiUrl as the loader's
@@ -330,6 +360,7 @@ export function createConnecta(config) {
         persistToolCatalog: config.discovery?.persistCatalog,
         toolCatalogStaleSeconds: config.discovery?.staleCatalogSeconds,
         maxResultBytes: config.calls?.maxResultBytes,
+        results: config.results,
     });
     const inboundAuth = configuredAuth;
     const pools = resolvePools(config.pools, registry);
@@ -356,6 +387,7 @@ export function createConnecta(config) {
         identity: config.identity,
         pools,
         publicUrl: config.publicUrl,
+        allowedOrigins: config.allowedOrigins,
         serverInfo,
         logger,
         activity: config.activity?.store,

package/dist/invocation.js

@@ -1,5 +1,5 @@
 import { isCallAdmissionError } from "./call-admission.js";
-import { classifyCallError, ConnectorCallError, echoedCallArgs, framingError, } from "./errors.js";
+import { boundedEchoText, classifyCallError, ConnectorCallError, echoedCallArgs, framingError, } from "./errors.js";
 import { unwrapMcpResult } from "./mcp-result.js";
 import { splitAddress } from "./registry.js";
 import { isExplicitlyReadOnly } from "./tool-safety.js";
@@ -43,10 +43,10 @@ function assertRawMcpSuccess(kind, result) {
     const mcpResult = result;
     if (!mcpResult.isError)
         return;
-    throw new Error(mcpResult.content
+    throw new Error(boundedEchoText(mcpResult.content
         ?.filter((block) => block.type === "text")
         .map((block) => block.text ?? "")
-        .join("") || "Downstream tool call failed");
+        .join("") || "Downstream tool call failed"));
 }
 export class InvocationFailure extends Error {
     details;
@@ -196,6 +196,8 @@ export class InvocationService {
                     tool: target.toolName,
                     source: context.source,
                     code: details.code,
+                    // Sanitized transport diagnostics (origin and errno only, #539).
+                    ...(details.details ? { details: details.details } : {}),
                     attempts,
                     durationMs: Date.now() - started,
                     message: String(details.message ?? "").slice(0, 300),
@@ -215,111 +217,150 @@ export class InvocationService {
                 error: details,
             };
         };
-        const resolution = await this.catalog.resolveTool(address, defined({ signal: context.requestSignal }));
-        catalogMs += resolution.catalogMs;
-        if (!resolution.ok) {
-            if (resolution.connector && resolution.toolName) {
-                activityTarget = {
-                    connector: resolution.connector,
-                    toolName: resolution.toolName,
-                };
-            }
-            if (resolution.cause && context.requestSignal?.aborted) {
-                return failed(callerCancelledDetails());
-            }
-            return failed(resolution.error);
-        }
-        resolved = resolution.resolved;
-        activityTarget = resolved;
-        if (!isExplicitlyReadOnly(resolved.definition) && !context.allowDestructive) {
-            const canonicalAddress = `${resolved.connector.id}.${resolved.toolName}`;
-            return failed(framingError("destructive_tool_requires_approval", `Tool "${canonicalAddress}" is not explicitly read-only. Invoke it through call_destructive_tool so the MCP host can request explicit approval.`));
-        }
-        // Remote MCP tools advertise their input schema in the catalog. Validate
-        // against that same request-local definition before admission or provider
-        // dispatch, so a predictable mismatch stays structured instead of being
-        // flattened into provider-specific error prose. Unsupported schemas retain
-        // validateToolInput's fail-open behavior and reach the downstream normally.
-        if (resolved.connector.kind === "mcp" &&
-            resolved.definition.inputSchema) {
-            const invalid = validateToolInput(resolved.definition.inputSchema, args ?? {}, {
-                address: `${resolved.connector.id}.${resolved.toolName}`,
-                logger: this.registry.contextFor(resolved.connector.id, this.catalog.baseUrl, this.catalog.requestScope).logger,
-            });
-            if (invalid)
-                return failed(classifyCallError(invalid));
-        }
-        try {
-            context.beforeDispatch?.();
-        }
-        catch (error) {
-            return failed(error instanceof InvocationFailure
-                ? error.details
-                : classifyCallError(error));
+        if (context.requestSignal?.aborted) {
+            // Preserve the cancelled admission-attempt count without starting discovery.
+            attempts = 1;
+            return failed(callerCancelledDetails());
         }
         let result;
         let observedResult;
-        attempts = 1;
-        let permit;
-        let attemptError;
-        let attemptFailed = false;
+        // One deadline owns discovery, queue admission, and provider dispatch.
+        // Only the caller of this function records the final outcome, so a late
+        // cancellation cannot append a second activity event after the deadline.
+        const dispatch = async (callSignal) => {
+            const resolution = await this.catalog.resolveTool(address, defined({ signal: callSignal }));
+            catalogMs += resolution.catalogMs;
+            if (callSignal?.aborted)
+                throw callSignal.reason;
+            if (!resolution.ok) {
+                if (resolution.connector && resolution.toolName) {
+                    activityTarget = {
+                        connector: resolution.connector,
+                        toolName: resolution.toolName,
+                    };
+                }
+                if (resolution.cause && context.requestSignal?.aborted) {
+                    return callerCancelledDetails();
+                }
+                return resolution.error;
+            }
+            const target = resolution.resolved;
+            resolved = target;
+            activityTarget = target;
+            if (!isExplicitlyReadOnly(target.definition) && !context.allowDestructive) {
+                const canonicalAddress = `${target.connector.id}.${target.toolName}`;
+                return framingError("destructive_tool_requires_approval", `Tool "${canonicalAddress}" is not explicitly read-only. Invoke it through call_destructive_tool so the MCP host can request explicit approval.`);
+            }
+            // Remote MCP tools advertise their input schema in the catalog. Validate
+            // against that same request-local definition before admission or provider
+            // dispatch, so a predictable mismatch stays structured instead of being
+            // flattened into provider-specific error prose. Unsupported schemas retain
+            // validateToolInput's fail-open behavior and reach the downstream normally.
+            if (target.connector.kind === "mcp" &&
+                target.definition.inputSchema) {
+                const invalid = validateToolInput(target.definition.inputSchema, args ?? {}, {
+                    address: `${target.connector.id}.${target.toolName}`,
+                    logger: this.registry.contextFor(target.connector.id, this.catalog.baseUrl, this.catalog.requestScope).logger,
+                });
+                if (invalid)
+                    return classifyCallError(invalid);
+            }
+            try {
+                context.beforeDispatch?.();
+            }
+            catch (error) {
+                return error instanceof InvocationFailure
+                    ? error.details
+                    : classifyCallError(error);
+            }
+            if (callSignal?.aborted)
+                throw callSignal.reason;
+            attempts = 1;
+            let permit;
+            let attemptError;
+            let attemptFailed = false;
+            try {
+                permit = await timed((elapsed) => { admissionMs += elapsed; }, () => this.registry.admitCall(target.connector.id, {
+                    toolName: target.toolName,
+                    args: args ?? {},
+                    ...defined({ signal: callSignal }),
+                }));
+                const raw = await timed((elapsed) => { connectorMs += elapsed; }, () => {
+                    const call = () => {
+                        const connectorContext = this.registry.contextFor(target.connector.id, this.catalog.baseUrl, this.catalog.requestScope, defined({ signal: callSignal, timeoutMs: context.timeoutMs }));
+                        if (target.connector.credential &&
+                            !connectorContext.credential) {
+                            throw new ConnectorCallError("auth_required", "Operator-managed credential storage is not configured. Call " +
+                                `authorize_connector({ connector: "${target.connector.id}" }).`);
+                        }
+                        // Cancellation can arrive during admission or context construction.
+                        if (callSignal?.aborted)
+                            throw callSignal.reason;
+                        return target.connector.callTool(target.toolName, args ?? {}, connectorContext);
+                    };
+                    // Race cancellation here too, so an uncooperative connector cannot
+                    // retain its admission permit after the enclosing deadline expires.
+                    return callSignal
+                        ? withDeadline(call, {
+                            signal: callSignal,
+                            timeoutError: new ConnectorCallError("timeout", "Tool call timed out"),
+                        })
+                        : call();
+                });
+                // isError is checked here for BOTH result shapes so every adapter
+                // reports the same downstream-failure wording, and the throw lands
+                // inside the attempt where it feeds health.
+                assertRawMcpSuccess(target.connector.kind, raw);
+                observedResult = unwrapMcpResult(target.connector.kind, raw);
+                result = context.unwrapResult ? observedResult : raw;
+            }
+            catch (error) {
+                attemptFailed = true;
+                attemptError = error;
+            }
+            finally {
+                permit?.release();
+            }
+            if (attemptFailed) {
+                if (callSignal?.aborted)
+                    throw callSignal.reason;
+                const callerCancelled = isCallerCancellation(attemptError, context.requestSignal);
+                const details = callerCancelled
+                    ? callerCancelledDetails()
+                    : classifyCallError(attemptError);
+                return details;
+            }
+            return undefined;
+        };
         try {
-            permit = await timed((elapsed) => { admissionMs += elapsed; }, () => this.registry.admitCall(resolved.connector.id, {
-                toolName: resolved.toolName,
-                args: args ?? {},
-                ...defined({ signal: context.requestSignal }),
-            }));
-            const raw = await timed((elapsed) => { connectorMs += elapsed; }, () => {
-                const call = (callSignal) => {
-                    const connectorContext = this.registry.contextFor(resolved.connector.id, this.catalog.baseUrl, this.catalog.requestScope, defined({ signal: callSignal, timeoutMs: context.timeoutMs }));
-                    if (resolved.connector.credential &&
-                        !connectorContext.credential) {
-                        throw new ConnectorCallError("auth_required", "Operator-managed credential storage is not configured. Call " +
-                            `authorize_connector({ connector: "${resolved.connector.id}" }).`);
-                    }
-                    // Cancellation can arrive during admission or context construction.
-                    if (callSignal?.aborted)
-                        throw callSignal.reason;
-                    return resolved.connector.callTool(resolved.toolName, args ?? {}, connectorContext);
-                };
-                if (!context.timeoutMs && !context.requestSignal)
-                    return call();
-                return withDeadline(call, {
+            const error = context.timeoutMs || context.requestSignal
+                ? await withDeadline(dispatch, {
                     ...defined({
                         timeoutMs: context.timeoutMs,
                         signal: context.requestSignal,
                     }),
                     timeoutError: new ConnectorCallError("timeout", `Tool call timed out after ${context.timeoutMs}ms`),
-                });
-            });
-            // isError is checked here for BOTH result shapes so every adapter
-            // reports the same downstream-failure wording, and the throw lands
-            // inside the attempt where it feeds health.
-            assertRawMcpSuccess(resolved.connector.kind, raw);
-            observedResult = unwrapMcpResult(resolved.connector.kind, raw);
-            result = context.unwrapResult ? observedResult : raw;
+                })
+                : await dispatch();
+            if (error)
+                return failed(error);
         }
         catch (error) {
-            attemptFailed = true;
-            attemptError = error;
-        }
-        finally {
-            permit?.release();
-        }
-        if (attemptFailed) {
-            const callerCancelled = isCallerCancellation(attemptError, context.requestSignal);
-            const details = callerCancelled
+            return failed(context.requestSignal?.aborted
                 ? callerCancelledDetails()
-                : classifyCallError(attemptError);
-            return failed(details);
+                : classifyCallError(error));
         }
+        // A dispatch that returned no refusal resolved a concrete tool.
+        const completed = resolved;
+        if (!completed)
+            throw new Error("Invocation completed without a resolved tool");
         try {
             const value = await timed((elapsed) => { resultProcessingMs += elapsed; }, async () => {
                 const processed = context.processResult
-                    ? await context.processResult(result, resolved)
+                    ? await context.processResult(result, completed)
                     : result;
                 try {
-                    this.registry.observeOutputShape(resolved.connector.id, resolved.definition, observedResult);
+                    this.registry.observeOutputShape(completed.connector.id, completed.definition, observedResult);
                 }
                 catch {
                     // Shape learning is advisory. It cannot change a completed call.
@@ -332,14 +373,14 @@ export class InvocationService {
             return {
                 ok: true,
                 value,
-                resolved,
+                resolved: completed,
                 durationMs: Date.now() - started,
                 attempts,
                 timing: diagnostics,
             };
         }
-        catch (error) {
-            return failed(framingError("result_processing_failed", error instanceof Error ? error.message : String(error)));
+        catch {
+            return failed(framingError("result_processing_failed", "The downstream call completed, but its result could not be processed. Do not repeat the call to recover its result."));
         }
     }
 }

package/dist/mcp-result.js

@@ -1,3 +1,4 @@
+import { boundedEchoText } from "./errors.js";
 /**
  * Unwrap an MCP CallToolResult into an ordinary JavaScript value:
  * `toolResult` wins when present, then `structuredContent`; all-text content is
@@ -17,9 +18,9 @@ export function unwrapMcpResult(kind, result) {
             .filter((c) => c.type === "text")
             .map((c) => c.text ?? "")
             .join("\n");
-        throw new Error(text || "Tool call failed");
+        throw new Error(boundedEchoText(text || "Tool call failed"));
     }
-    if (r.structuredContent != null)
+    if (r.structuredContent !== undefined)
         return r.structuredContent;
     if (content.length > 0 && content.every((c) => c.type === "text")) {
         const text = content.map((c) => c.text ?? "").join("\n");