@zackbart/connecta 0.25.0 → 0.26.1

package/dist/routes/oauth-management.js

@@ -1,10 +1,31 @@
 import { Effect, Result } from "effect";
+import { drainOAuthStartResets } from "../auth/oauth-start-reset.js";
 import { closeScope } from "../runtime/connector-scope.js";
+import { withDeadlineEffect } from "../runtime/run.js";
 import { isSafeHttpUrl } from "../ui.js";
 import { authorizedPerson, refuse, serveOperator, visibleRegistry, } from "./operator.js";
 import { mayManageConnector, isSameOrigin, msg, privateJson, } from "./shared.js";
+/** Bounds the start and its handoff; invalidation and scope close finish after it. */
+const OAUTH_START_TIMEOUT_MS = 30_000;
+/**
+ * How a POST starts authorization, from its `mode` query parameter:
+ * `restart` (the default) resets the connector to a fresh epoch — wiping the
+ * grant, the client registration, and discovery — before starting over;
+ * `continue` hands back a recent pending authorization URL when one exists
+ * and otherwise starts a flow in the current epoch, keeping the stored
+ * registration. `null` is a malformed request.
+ */
+function startMode(url) {
+    const modes = url.searchParams.getAll("mode");
+    if (modes.length === 0)
+        return "restart";
+    const [mode] = modes;
+    return modes.length === 1 && (mode === "continue" || mode === "restart")
+        ? mode
+        : null;
+}
 function oauthManagementRequest(context, connectorId) {
-    const { request, baseUrl, defer } = context;
+    const { request, baseUrl, defer, opts } = context;
     return Effect.gen(function* () {
         if (!isSameOrigin(request, baseUrl)) {
             return yield* refuse("same-origin request required", 403);
@@ -27,35 +48,81 @@ function oauthManagementRequest(context, connectorId) {
         if (!disconnecting && request.method !== "POST") {
             return yield* refuse("method not allowed", 405);
         }
-        const ctx = registry.contextFor(connectorId, baseUrl, {});
+        const mode = disconnecting ? undefined : startMode(context.url);
+        if (mode === null) {
+            return yield* refuse('mode must be "continue" or "restart"', 400);
+        }
+        let ctx;
         // The connector scope this request opened ends with it, however it ends.
-        yield* Effect.addFinalizer(() => closeScope(connector, ctx, defer));
-        const operation = yield* Effect.result(Effect.tryPromise({
+        yield* Effect.addFinalizer(() => ctx ? closeScope(connector, ctx, defer) : Effect.void);
+        const timeoutError = new Error("OAuth authorization start timed out");
+        const operation = yield* Effect.result(withDeadlineEffect((signal) => Effect.tryPromise({
             try: async () => {
+                ctx = registry.contextFor(connectorId, baseUrl, {}, { signal });
                 if (disconnecting) {
                     await disconnectAuth(ctx);
                     return undefined;
                 }
-                const started = await startAuth(ctx, { force: true });
+                const started = await startAuth(ctx, { force: mode === "restart" });
+                if (signal.aborted)
+                    throw signal.reason;
                 if (started.authorizationUrl) {
                     await registry.bindOAuthHandoff(connectorId, started.authorizationUrl);
                 }
                 return started;
             },
             catch: (error) => error,
+        }), {
+            // A disconnect deliberately ignores both browser cancellation and
+            // this start deadline so its reset reaches invalidation.
+            ...(disconnecting ? {} : { timeoutMs: OAUTH_START_TIMEOUT_MS }),
+            ...(disconnecting ? {} : { signal: request.signal }),
+            timeoutError,
         }));
-        // The old grant and its cached catalog are invalid after either operation,
-        // including a partially failed physical cleanup whose epoch fence succeeded.
-        const invalidated = yield* Effect.result(Effect.tryPromise({
-            try: () => registry.invalidateStored(connectorId),
-            catch: (error) => error,
-        }));
+        const opened = ctx;
+        if (Result.isFailure(operation) && opened) {
+            // Storage has no abort contract. If a reset's generation write is still
+            // pending, answering now would let it publish over a newer flow.
+            yield* Effect.promise(() => drainOAuthStartResets(opened.requestScope ?? opened));
+        }
+        // A disconnect or a restart invalidates the old grant and its cached
+        // catalog, even when a partially failed physical cleanup left its epoch
+        // fence standing. So does a continued start that had to begin a new flow:
+        // the grant it found was missing or refused. A continued start that
+        // reused a pending URL or found the connection healthy changed nothing,
+        // so the catalog stays. (A continue does reset a disconnected connector,
+        // but the disconnect already invalidated that catalog.)
+        const started = Result.isSuccess(operation) ? operation.success : undefined;
+        const reused = mode === "continue" && started?.authorizationReused === true;
+        const unchanged = mode === "continue" && (reused || started?.state === "ok");
+        const invalidated = unchanged
+            ? Result.succeed(undefined)
+            : yield* Effect.result(Effect.tryPromise({
+                try: () => registry.invalidateStored(connectorId),
+                catch: (error) => error,
+            }));
+        // Every failure below answers in the route's own fixed words. A hook's
+        // rejection and a status message can quote a token endpoint's error body
+        // or a provider's refusal, either of which can quote the secret it was
+        // sent, so that text goes to the deployment's log and nowhere else.
+        const failed = (detail, fixed, status) => {
+            opts.logger.warn(`[connecta] connector "${connectorId}" OAuth ${disconnecting ? "disconnect" : mode} failed: ${detail}`);
+            return refuse(fixed, status);
+        };
+        const couldNot = disconnecting
+            ? "OAuth disconnect failed"
+            : "OAuth authorization could not start";
         // A Result, not a caught value, decides whether it failed: a hook that
         // rejects with no reason at all still failed.
-        if (Result.isFailure(operation))
-            return yield* refuse(msg(operation.failure), 400);
-        if (Result.isFailure(invalidated))
-            return yield* refuse(msg(invalidated.failure), 400);
+        if (Result.isFailure(operation)) {
+            if (operation.failure === timeoutError) {
+                return yield* failed(`start exceeded ${OAUTH_START_TIMEOUT_MS} ms`, "OAuth authorization start timed out", 504);
+            }
+            return yield* failed(msg(operation.failure), couldNot, 400);
+        }
+        if (Result.isFailure(invalidated)) {
+            return yield* failed(`stored-state invalidation: ${msg(invalidated.failure)}`, couldNot, 400);
+        }
         const result = operation.success;
         if (!result) {
             return new Response(null, {
@@ -70,16 +137,16 @@ function oauthManagementRequest(context, connectorId) {
             ? result.authorizationUrl
             : undefined;
         if (result.state === "error") {
-            return yield* refuse(result.message || "OAuth authorization could not start", 502);
+            return yield* failed(result.message || "the connector reported an error state", couldNot, 502);
         }
         if (result.state === "auth_required" && !authorizationUrl) {
-            return yield* refuse(result.message ||
-                "OAuth authorization requires consent but no safe URL is available", 502);
+            return yield* failed(result.message || "consent is required but no safe authorization URL was returned", "OAuth authorization requires consent but no safe URL is available", 502);
         }
+        // No message: a status message is the same text the Connections page
+        // stopped shipping, and the state and the link are the whole answer.
         return privateJson({
             state: result.state,
-            ...(result.message ? { message: result.message } : {}),
-            ...(authorizationUrl ? { authorizationUrl } : {}),
+            ...(authorizationUrl ? { authorizationUrl, reused } : {}),
         });
     }).pipe(Effect.scoped);
 }

package/dist/routes/oauth.js

@@ -1,92 +1,59 @@
 import { Effect } from "effect";
 import { oauthValueStorageKey } from "../auth/downstream-oauth.js";
-import { resolveBranding } from "../branding.js";
+import { escapeHtml, renderPage, resolveBranding, STATUS_ICONS } from "../branding.js";
 import { oauthCallbackOutcome, providerErrorReason, } from "../oauth-callback-outcome.js";
 import { authorizeUiIdentity, mayManageConnector, validateAuthPermissions, loggableValue, msg, } from "./shared.js";
-function escapeHtml(value) {
-    return value
-        .replaceAll("&", "&")
-        .replaceAll("<", "&lt;")
-        .replaceAll(">", "&gt;")
-        .replaceAll('"', "&quot;");
-}
+const TONE_MARKS = {
+    ok: { className: " ok", icon: STATUS_ICONS.ok, label: "Connected" },
+    declined: { className: "", icon: STATUS_ICONS.declined, label: "Not connected" },
+    problem: { className: " danger", icon: STATUS_ICONS.problem, label: "Not connected" },
+};
 /**
- * The callback's one page. It renders a reason from a closed set and that
- * reason's fixed copy, so nothing the request carried — the provider's `error`
- * parameter, an exchange failure's message — can reach the body. Escaping
- * stays anyway: branding and the configured connector id are still strings.
+ * The callback's one page, in the shared layout. It renders a reason from a
+ * closed set and that reason's fixed copy, so nothing the request carried —
+ * the provider's `error` parameter, an exchange failure's message — can reach
+ * the body. The connector's title appears only when `connector` is passed,
+ * which the route does only after the state check, and `oauthCallbackOutcome`
+ * gates it by reason again; every refusal before that point is the same bytes
+ * for every connector id and path. Escaping stays anyway: branding and a
+ * configured title are still strings.
+ *
+ * The fix prompt is for whoever runs the deployment, and the person reading
+ * this page is often a teammate finishing personal auth, so it sits folded
+ * under a quiet disclosure rather than in the message.
  */
-function html(reason, branding, hasUi = false, connectorId) {
-    const outcome = oauthCallbackOutcome(reason, connectorId);
-    const brand = resolveBranding(branding);
-    const title = brand.pageTitle;
-    const owner = brand.ownerName
-        ? brand.ownerUrl
-            ? `<a class="brand" href="${escapeHtml(brand.ownerUrl)}">${escapeHtml(brand.ownerName)}</a>`
-            : `<span class="brand">${escapeHtml(brand.ownerName)}</span>`
-        : brand.productUrl
-            ? `<a class="brand" href="${escapeHtml(brand.productUrl)}">${escapeHtml(brand.productName)}</a>`
-            : `<span class="brand">${escapeHtml(brand.productName)}</span>`;
-    const product = brand.ownerName
-        ? brand.productUrl
-            ? `<a class="product" href="${escapeHtml(brand.productUrl)}">${escapeHtml(brand.productName)}</a>`
-            : `<span class="product">${escapeHtml(brand.productName)}</span>`
+function html(reason, opts, connector) {
+    const brand = resolveBranding(opts.branding);
+    const outcome = oauthCallbackOutcome(reason, connector, brand.productName);
+    const mark = TONE_MARKS[outcome.tone];
+    const uiMounted = Boolean(opts.ui);
+    const home = uiMounted
+        ? `<div class="status-actions"><a class="btn${outcome.tone === "ok" ? "" : " primary"}" href="/">Return to ${escapeHtml(brand.productName)}</a></div>`
+        : "";
+    const details = outcome.fixPrompt
+        ? `<details class="status-details">
+      <summary>Details for the operator</summary>
+      <p>If this keeps happening, send this to whoever runs ${escapeHtml(brand.productName)}. It is written for a coding agent working on the deployment and carries nothing from the provider's response.</p>
+      <pre>${escapeHtml(outcome.fixPrompt)}</pre>
+    </details>`
         : "";
-    return new Response(`<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<meta name="theme-color" content="${escapeHtml(brand.themeColor)}">
-<link rel="icon" href="${escapeHtml(brand.faviconHref)}" type="image/svg+xml">
-<link rel="shortcut icon" href="/favicon.ico">
-<title>${escapeHtml(title)}</title>
-<style>
-  * { border-radius: 0; box-sizing: border-box; }
-  html { color: #000; background: #fff; font: 16px/1.5 "Helvetica Neue",
-    Helvetica, Arial, sans-serif; -webkit-font-smoothing: antialiased; }
-  body { margin: 0; min-height: 100vh; }
-  ::selection { color: #fff; background: #000; }
-  .shell { margin: 0 auto; max-width: 70rem; padding: 1rem; }
-  .grid { display: grid; gap: 1rem 1.5rem;
-    grid-template-columns: repeat(3, minmax(0, 1fr)); }
-  .brand { font-weight: 500; grid-column: 1; text-decoration: none; }
-  .product { grid-column: 2 / -1; }
-  main { margin-top: 5rem; }
-  h1, p { font: inherit; margin: 0; }
-  h1 { grid-column: 1; }
-  .copy { grid-column: 2 / -1; max-width: 34em; }
-  .copy > * + * { margin-top: 1.5rem; }
-  a { color: inherit; text-decoration: underline; text-decoration-thickness: 1.5px;
-    text-underline-offset: .22em; }
-  a:hover { text-decoration-color: transparent; }
-  a:focus-visible, summary:focus-visible { outline: 1px solid #000; outline-offset: 2px; }
-  summary { cursor: pointer; }
-  pre { font: 13px/1.5 ui-monospace, Menlo, Consolas, monospace; margin: .75rem 0 0;
-    padding: .75rem; white-space: pre-wrap; border: 1px solid #000; user-select: all; }
-  @media (max-width: 36.99rem) {
-    .grid { grid-template-columns: repeat(2, minmax(0, 1fr)); }
-    .product { grid-column: 2; }
-    main { margin-top: 3rem; }
-    h1, .copy { grid-column: 1 / -1; }
-  }
-</style>
-</head>
-<body>
-  <header class="shell grid">
-    ${owner}
-    ${product}
-  </header>
-  <main class="shell grid" data-oauth-callback="${outcome.reason}">
-    <h1>Connection status</h1>
-    <div class="copy">
-      <p>${escapeHtml(outcome.message)}</p>
-      ${outcome.fixPrompt ? `<details><summary>Fix prompt for a coding agent</summary><pre>${escapeHtml(outcome.fixPrompt)}</pre></details>` : ""}
-      ${hasUi ? `<p><a href="/">Return to ${escapeHtml(brand.productName)}</a></p>` : ""}
+    const body = `<main class="page shell" data-oauth-callback="${outcome.reason}">
+  <section class="status-page">
+    <div class="status-head">
+      <span class="status-mark${mark.className}" aria-hidden="true">${mark.icon}</span>
+      <p class="status-label${mark.className}">${mark.label}</p>
     </div>
-  </main>
-</body>
-</html>`, { status: outcome.status, headers: { "Content-Type": "text/html; charset=utf-8" } });
+    <h1>${escapeHtml(outcome.heading)}</h1>
+    <p class="status-copy">${escapeHtml(outcome.message)}</p>
+    ${home}
+    ${details}
+  </section>
+</main>`;
+    return new Response(renderPage(opts.branding, {
+        title: `${outcome.heading} — ${brand.pageTitle}`,
+        uiMounted,
+        body,
+    }), { status: outcome.status, headers: { "Content-Type": "text/html; charset=utf-8" } });
 }
 /**
  * Pay the storage read a real downstream-OAuth refusal pays, on the refusal
@@ -138,10 +105,10 @@ async function finishOAuthCallback(context) {
     const { path, url, baseUrl, opts } = context;
     const error = url.searchParams.get("error");
     if (error)
-        return html(providerErrorReason(error), opts.branding, Boolean(opts.ui));
+        return html(providerErrorReason(error), opts);
     const code = url.searchParams.get("code");
     if (!code)
-        return html("invalid_callback", opts.branding, Boolean(opts.ui));
+        return html("invalid_callback", opts);
     const id = path.slice("/oauth/callback/".length);
     const state = url.searchParams.get("state");
     const callbackTarget = await opts.registry.oauthCallbackView(id, state);
@@ -155,7 +122,7 @@ async function finishOAuthCallback(context) {
     const connectorContext = callbackRegistry
         ? callbackRegistry.contextFor(id, baseUrl)
         : opts.registry.contextFor(id, baseUrl);
-    const refused = () => html("invalid_callback", opts.branding, Boolean(opts.ui));
+    const refused = () => html("invalid_callback", opts);
     if (!connector || !connector.finishAuth) {
         await equalizeRefusalCost(connectorContext);
         return refused();
@@ -220,19 +187,19 @@ async function finishOAuthCallback(context) {
             opts.logger.warn(`[connecta] refused an OAuth callback for connector ` +
                 `${loggableValue(id)} with 500: its principal handoff could not be ` +
                 `consumed (${loggableValue(msg(err))}). No authorization code was exchanged.`);
-            return html("handoff_failed", opts.branding, Boolean(opts.ui), id);
+            return html("handoff_failed", opts, connector);
         }
     }
     try {
         await connector.finishAuth(code, connectorContext, url.searchParams);
         await callbackRegistry.invalidateStored(id);
-        return html("connected", opts.branding, Boolean(opts.ui), id);
+        return html("connected", opts, connector);
     }
     catch (err) {
         // The page names the reason and nothing else; what the exchange threw can
         // quote a token endpoint's body, so it goes only to the operator log.
         opts.logger.warn(`[connecta] OAuth callback for connector ${loggableValue(id)} failed ` +
             `with 500: the authorization code exchange threw ${loggableValue(msg(err))}.`);
-        return html("exchange_failed", opts.branding, Boolean(opts.ui), id);
+        return html("exchange_failed", opts, connector);
     }
 }

package/dist/routes/operator.js

@@ -51,6 +51,7 @@ export function scopeFor(authz, connectorIds = authz.connectorIds) {
     return {
         connectorIds,
         ...(authz.toolAccess ? { toolAccess: authz.toolAccess } : {}),
+        ...(authz.guardedToolAccess ? { guardedToolAccess: authz.guardedToolAccess } : {}),
         ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
         ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
     };

package/dist/routes/shared.d.ts

@@ -1,5 +1,5 @@
 import type { Implementation } from "@modelcontextprotocol/server";
-import type { ActivityModule, OperatorSurface } from "../module-contracts.js";
+import type { ActivityModule, ArtifactsModule, OperatorSurface } from "../module-contracts.js";
 import type { ActivityActor, ActivityReadGate, ActivityStore } from "../activity.js";
 import type { CredentialVault } from "../credential-contract.js";
 import type { DeferredWork } from "../connector-scope.js";
@@ -7,6 +7,7 @@ import type { AdmissionController } from "../executor-admission.js";
 import type { Registry, ToolAccess } from "../registry.js";
 import type { ResolvedPool } from "../connector-access.js";
 import type { AuthenticatedIdentity, ConnectaBranding, Executor, InboundAuth, InboundAuthRuntimeContext, Logger } from "../types.js";
+import type { ApprovalPolicy } from "../tool-safety.js";
 import type { ConnectorPermission, ConnectaIdentityConfig } from "../index.js";
 export { msg } from "../errors.js";
 export interface ServerOptions {
@@ -16,6 +17,7 @@ export interface ServerOptions {
     /** Validated named pools served at `/mcp/<name>`; empty when none declared. */
     pools?: ReadonlyMap<string, ResolvedPool> | undefined;
     publicUrl?: string | undefined;
+    artifactOrigin?: string | undefined;
     allowedOrigins?: readonly string[] | "*" | undefined;
     serverInfo: Implementation;
     logger: Logger;
@@ -39,6 +41,15 @@ export interface ServerOptions {
     hostCallTimeoutMs?: number | undefined;
     /** Hard ceiling on one execute_code run, outside the sandbox. Default 120_000. */
     watchdogMs?: number | undefined;
+    /** Resumable writes' settings; absent when they are off. */
+    resumable?: {
+        maxWrites: number;
+        ttlSeconds: number;
+    } | undefined;
+    /** Config approval exemptions (`execute.approval`), resolved at construction. */
+    approval?: ApprovalPolicy | undefined;
+    /** Writes one program may send (`execute.maxWrites`), exempt ones included. */
+    maxWrites?: number | undefined;
     /** Required sandbox backing the execute_code meta-tool. */
     executor: Executor;
     /** Sanitized identity of the configured sandbox, when it has one. */
@@ -50,6 +61,8 @@ export interface ServerOptions {
     /** Optional browser routes, with no implementation import in core. */
     ui?: OperatorSurface | undefined;
     activityModule?: ActivityModule | undefined;
+    /** Optional team pages; their routes mount only beside `ui`. */
+    artifactsModule?: ArtifactsModule | undefined;
     /** Optional browser UI and OAuth result-page labels. */
     branding?: ConnectaBranding | undefined;
 }
@@ -86,6 +99,8 @@ export declare function authorize(request: Request, baseUrl: string, auth: Inbou
     connectorIds: "all" | readonly string[];
     /** Per-connector tool allowlist for connectors granted by address only. */
     toolAccess?: ToolAccess;
+    /** Granted addresses that still require the catalog's read-only hint. */
+    guardedToolAccess?: ToolAccess;
     operator: boolean;
     credentialAdministration: ConnectorPermission;
     personalConnection: ConnectorPermission;
@@ -108,6 +123,13 @@ type AuthorizedIdentity = Extract<Awaited<ReturnType<typeof authorize>>, {
 }>;
 /** Unknown configured ids refuse the complete view, including management rights. */
 export declare function validateAuthPermissions(authz: AuthorizedIdentity, registry: Registry): void;
+/**
+ * Whether this identity may open artifact pages: exactly whoever may read the
+ * `artifacts` connector — it is visible to them and `get_artifact` is among
+ * its tools they were granted. Viewing grants nothing a program could not
+ * already read (ethos, "Human routes manage auth, never capability").
+ */
+export declare function mayViewArtifacts(authz: AuthorizedIdentity, registry: Registry): boolean;
 export declare function mayManageConnector(authz: AuthorizedIdentity, connector: {
     id: string;
     authScope?: "shared" | "personal";

package/dist/routes/shared.js

@@ -1,5 +1,6 @@
 import { parseConnectorAccess } from "../connector-access.js";
 import { identityStorageKey, validIdentityReference } from "../identity.js";
+import { isExplicitlyReadOnly } from "../tool-safety.js";
 export { msg } from "../errors.js";
 export function privateJson(body, init = {}) {
     const headers = new Headers(init.headers);
@@ -36,7 +37,7 @@ export async function authorize(request, baseUrl, auth, runtimeContext, identity
         const identity = { actor, interactive: false };
         let access;
         try {
-            access = parseConnectorAccess(identityConfig?.connectorAccess ? await identityConfig.connectorAccess(identity) : "all");
+            access = parseConnectorAccess(identityConfig?.connectorAccess ? await identityConfig.connectorAccess(identity) : "all", { allowReadOnly: true });
         }
         catch {
             return {
@@ -83,7 +84,7 @@ export async function authorize(request, baseUrl, auth, runtimeContext, identity
                         ? await identityConfig.activityAccess(principal)
                         : false;
                 }
-                access = parseConnectorAccess(identityConfig?.connectorAccess ? await identityConfig.connectorAccess(identity) : "all");
+                access = parseConnectorAccess(identityConfig?.connectorAccess ? await identityConfig.connectorAccess(identity) : "all", { allowReadOnly: true });
                 if (interactive) {
                     credentialAdministration = identityConfig?.credentialAdministration ? await identityConfig.credentialAdministration(identity) : "none";
                     personalConnection = principal && identityConfig?.personalConnection ? await identityConfig.personalConnection(identity) : "none";
@@ -194,6 +195,23 @@ export function validateAuthPermissions(authz, registry) {
         }
     }
 }
+/**
+ * Whether this identity may open artifact pages: exactly whoever may read the
+ * `artifacts` connector — it is visible to them and `get_artifact` is among
+ * its tools they were granted. Viewing grants nothing a program could not
+ * already read (ethos, "Human routes manage auth, never capability").
+ */
+export function mayViewArtifacts(authz, registry) {
+    if (authz.connectorIds !== "all" && !authz.connectorIds.includes("artifacts")) {
+        return false;
+    }
+    const tools = authz.toolAccess?.get("artifacts");
+    if (tools && !tools.has("get_artifact"))
+        return false;
+    if (!authz.guardedToolAccess?.get("artifacts")?.has("get_artifact"))
+        return true;
+    return registry.getConnector("artifacts")?.staticTools?.some((tool) => tool.name === "get_artifact" && isExplicitlyReadOnly(tool)) === true;
+}
 export function mayManageConnector(authz, connector) {
     if (!authz.identity.interactive)
         return false;

package/dist/routes/ui-data.js

@@ -10,6 +10,7 @@ import { resolveDiscoveryConcurrency } from "../concurrency.js";
 import { credentialTestRule, describeUndeclaredCredentialFields, storedCredentialShape, } from "../credential-rules.js";
 import { closeScope } from "../runtime/connector-scope.js";
 import { withDeadlineEffect } from "../runtime/run.js";
+import { isApprovalExempt, NO_EXEMPTIONS, } from "../tool-safety.js";
 import { uiProblemFor, uiToolSafety } from "../ui.js";
 import { CONNECTA_VERSION } from "../version.js";
 const DETAIL_TIMEOUT_MS = 30_000;
@@ -59,7 +60,7 @@ export function uiData(registry, baseUrl, options) {
                     name: t.name,
                     address: `${c.id}.${t.name}`,
                     ...(t.description ? { description: t.description } : {}),
-                    safety: uiToolSafety(t),
+                    safety: uiToolSafety(t, isApprovalExempt(options.approval ?? NO_EXEMPTIONS, c, t.name, t)),
                 }))).pipe(Effect.map((tools) => ({ status, tools, catalogFailed: false })), 
                 // The registry owns the failed catalog observation; the page only
                 // needs to know there was one.

package/dist/routes/ui.js

@@ -3,7 +3,7 @@ import { CONNECTA_VERSION } from "../version.js";
 import { CONNECTA_FAVICON_ICO } from "../favicon.js";
 import { CONNECTA_FAVICON_SVG, operatorPageForPath, renderUiHtml, } from "../ui.js";
 import { authorized, refuse, scopeFor, serveOperator, visibleRegistry, } from "./operator.js";
-import { mayManageConnector, privateJson, } from "./shared.js";
+import { mayManageConnector, mayViewArtifacts, privateJson, } from "./shared.js";
 import { uiData } from "./ui-data.js";
 /**
  * Headers that make an operator-supplied favicon body inert on this origin.
@@ -71,7 +71,10 @@ export async function routeUi(context) {
         });
     }
     const operatorPage = operatorPageForPath(path);
-    if (operatorPage && (operatorPage !== "activity" || opts.activity?.list)) {
+    const artifactPage = operatorPage === "artifacts" || operatorPage === "artifact";
+    if (operatorPage &&
+        (operatorPage !== "activity" || opts.activity?.list) &&
+        (!artifactPage || opts.artifactsModule)) {
         if (request.method !== "GET" && request.method !== "HEAD") {
             return privateJson({ error: "method not allowed" }, { status: 405 });
         }
@@ -89,14 +92,24 @@ export async function routeUi(context) {
         // style/font/network needs and the page's inline <style> stay unrestricted
         // — only script execution, the XSS sink, is gated.
         const nonce = uiScriptNonce();
+        // An artifact shell frames the sandboxed page from its own origin and
+        // nothing else; Connections stays on the deployment's public origin.
+        const homeUrl = opts.publicUrl ? new URL("/", opts.publicUrl).toString() : "/";
+        // The artifact host serves no favicon, so a shell there takes its icons
+        // from the public origin, as the 404 does; on the main host they stay
+        // root-relative.
+        const onArtifactHost = Boolean(opts.artifactOrigin) &&
+            url.origin === new URL(opts.artifactOrigin).origin;
+        const iconOrigin = onArtifactHost ? opts.publicUrl : undefined;
         return new Response(request.method === "HEAD"
             ? null
-            : renderUiHtml(uiAuth, mcpUrl, opts.branding, nonce, operatorPage), {
+            : renderUiHtml(uiAuth, mcpUrl, opts.branding, nonce, operatorPage, { homeUrl, iconOrigin }), {
             status: 200,
             headers: {
                 "Content-Type": "text/html; charset=utf-8",
                 "Content-Security-Policy": `script-src 'nonce-${nonce}' 'strict-dynamic' https: 'unsafe-inline'; ` +
-                    "object-src 'none'; base-uri 'none'; frame-ancestors 'none'",
+                    "object-src 'none'; base-uri 'none'; frame-ancestors 'none'" +
+                    (artifactPage ? "; frame-src 'self'" : ""),
                 "X-Content-Type-Options": "nosniff",
             },
         });
@@ -146,6 +159,7 @@ function connectorDetail(context, id) {
             mayManage,
             timeoutMs: opts.probeTimeoutMs ?? 30_000,
             signal: request.signal,
+            approval: opts.approval,
         });
         return privateJson({ ...data.connectors[0], permissions: permissions(connector) });
     });
@@ -173,6 +187,7 @@ function summary(context) {
             serverInfo: opts.serverInfo,
             connectaVersion: CONNECTA_VERSION,
             activityEnabled,
+            ...(opts.artifactsModule && mayViewArtifacts(authz, opts.registry) ? { artifactsEnabled: true } : {}),
             credentialManagement,
             oauthManagement: visible.some(c => mayManage(c.id)),
             connectors: visible.map(c => ({ id: c.id, ...(c.title ? { title: c.title } : {}), ...(c.description ? { description: c.description } : {}), authScope: c.authScope ?? "shared", status: "loading", toolCount: 0, tools: [], oauth: Boolean(c.startAuth && c.disconnectAuth), permissions: permissions(c) })),