@zackbart/connecta 0.28.1 → 0.30.0

package/dist/routes/mcp.js

@@ -1,14 +1,76 @@
-import { createMcpHandler, isLegacyRequest, McpServer, WebStandardStreamableHTTPServerTransport, } from "@modelcontextprotocol/server";
+import { bindActivityRequest } from "../activity-request.js";
+import { closeConnectorScope } from "../connector-scope.js";
+import { executeLimits } from "../config.js";
+import { oauthConnectUrl, oauthConnectLink, oauthConnectLinkProgress, closeOAuthConnectLinks, claimAuthRetry, oauthConnectUnavailable, } from "../oauth-handoff.js";
+import { AuthElicitation } from "../auth-elicitation.js";
+import { classifyInboundRequest, createMcpHandler, isJSONRPCErrorResponse, isLegacyRequest, McpServer, WebStandardStreamableHTTPServerTransport, } from "@modelcontextprotocol/server";
 import { Duration, Effect, Exit, Option, Result, Scope } from "effect";
-import { notFoundResponse } from "../branding.js";
 import { registerExecuteTool } from "../execute.js";
-import { ExecutorAdmissionError, } from "../executor-admission.js";
+import { ExecutorAdmissionError } from "../executor-admission.js";
 import { registerMetaTools } from "../meta-tools.js";
 import { intersectAccess } from "../connector-access.js";
 import { CONNECTA_INSTRUCTIONS } from "../skills.js";
-import { msg } from "../errors.js";
+import { registerSkills } from "./skills.js";
+import { failureRecord, logFailure } from "../operator-record.js";
+import { redactAgentOutput, sentSecretsForRequest } from "../sent-secrets.js";
 import { detach } from "../runtime/run.js";
-import { authorize, loggableValue, mayManageConnector, validateAuthPermissions, } from "./shared.js";
+import { authorize, mayManageConnector, validateAuthPermissions, } from "./shared.js";
+/**
+ * The SDK's own bound on the body it reads. Since server 2.1.0 the SDK
+ * answers anything over 4 MiB with its own 413, which would quietly shadow
+ * the bound the host already enforces: `listen()`'s `maxBodyBytes` on Node,
+ * the platform's request limit on Workers. The host owns that decision, as it
+ * did before the SDK had an opinion, so the SDK is told to have none. Its
+ * option must be finite.
+ */
+const SDK_BODY_BOUND = { maxRequestBodySize: Number.MAX_SAFE_INTEGER };
+// Identity, not a status/header a custom auth response could imitate.
+const deadlineResponses = new WeakSet();
+async function isModernListen(request, signal) {
+    const reader = request.clone().body?.getReader();
+    if (!reader)
+        return false;
+    const onAbort = () => {
+        void reader.cancel(signal.reason).catch(() => { });
+        void request.body?.cancel(signal.reason).catch(() => { });
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted)
+        onAbort();
+    try {
+        const decoder = new TextDecoder();
+        let text = "";
+        let bytes = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            bytes += value.byteLength;
+            if (bytes > SDK_BODY_BOUND.maxRequestBodySize)
+                return false;
+            text += decoder.decode(value, { stream: true });
+        }
+        if (signal.aborted)
+            return false;
+        const protocolVersion = request.headers.get("MCP-Protocol-Version");
+        const method = request.headers.get("Mcp-Method");
+        const route = classifyInboundRequest({
+            httpMethod: request.method,
+            ...(protocolVersion !== null ? { protocolVersionHeader: protocolVersion } : {}),
+            ...(method !== null ? { mcpMethodHeader: method } : {}),
+            body: JSON.parse(text + decoder.decode()),
+        });
+        return (route.kind === "modern" && route.messageKind === "request" && route.message.method === "subscriptions/listen");
+    }
+    catch {
+        // Leave unreadable, malformed, and legacy bodies to the normal SDK path.
+        return false;
+    }
+    finally {
+        signal.removeEventListener("abort", onAbort);
+        reader.releaseLock();
+    }
+}
 export const MCP_CORS_HEADERS = {
     "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
@@ -30,28 +92,41 @@ function withMcpCors(response, request, allowedOrigin) {
         // Browsers do not interpret a prefix wildcard in Allow-Headers. Echo only
         // valid SEP-2243 field names; unrelated requested headers stay disallowed.
         const paramHeaders = (request.headers.get("Access-Control-Request-Headers") ?? "")
-            .toLowerCase().split(",").map(name => name.trim())
-            .filter(name => /^mcp-param-[!#$%&'*+.^_`|~0-9a-z-]+$/.test(name));
+            .toLowerCase()
+            .split(",")
+            .map((name) => name.trim())
+            .filter((name) => /^mcp-param-[!#$%&'*+.^_`|~0-9a-z-]+$/.test(name));
         if (paramHeaders.length) {
             headers.append("Access-Control-Allow-Headers", [...new Set(paramHeaders)].join(", "));
         }
         headers.append("Vary", "Access-Control-Request-Headers");
     }
-    headers.set("Access-Control-Expose-Headers", "WWW-Authenticate, Retry-After, mcp-session-id, mcp-protocol-version");
-    return new Response(response.body, {
+    headers.set("Access-Control-Expose-Headers", "WWW-Authenticate, Retry-After, mcp-session-id, mcp-protocol-version, Connecta-Error-Code, Connecta-Recovery");
+    const wrapped = new Response(response.body, {
         status: response.status,
         statusText: response.statusText,
         headers,
     });
+    if (deadlineResponses.has(response))
+        deadlineResponses.add(wrapped);
+    return wrapped;
 }
-function requestAdmissionFailure(error) {
+/** Transport refusals occur before the RPC body is decoded, so its id is unknown. */
+function mcpRefusal(sentSecrets, status, code, message) {
+    const response = Response.json(redactAgentOutput(sentSecrets, { jsonrpc: "2.0", error: { code, message } }), {
+        status,
+        headers: { "Cache-Control": "no-store" },
+    });
+    if (status === 504 && code === -33003)
+        deadlineResponses.add(response);
+    return response;
+}
+function requestAdmissionFailure(sentSecrets, error) {
     const overloaded = error.code === "executor_overloaded";
     const data = {
         code: overloaded ? "server_overloaded" : "server_shutting_down",
         retryable: overloaded,
-        ...(overloaded && error.retryAfterMs !== undefined
-            ? { retryAfterMs: error.retryAfterMs }
-            : {}),
+        ...(overloaded && error.retryAfterMs !== undefined ? { retryAfterMs: error.retryAfterMs } : {}),
     };
     const headers = new Headers({
         "Content-Type": "application/json",
@@ -60,20 +135,17 @@ function requestAdmissionFailure(error) {
     if (overloaded && error.retryAfterMs !== undefined) {
         headers.set("Retry-After", String(Math.max(1, Math.ceil(error.retryAfterMs / 1_000))));
     }
-    return new Response(JSON.stringify({
+    return new Response(JSON.stringify(redactAgentOutput(sentSecrets, {
         jsonrpc: "2.0",
-        id: null,
         error: {
             // MCP 2026-07-28 basic#error-codes forbids new allocations in the
             // legacy -32000..-32019 range. Use application codes outside the
             // JSON-RPC reserved range, avoiding retired protocol meanings.
-            code: overloaded ? -31001 : -31002,
-            message: overloaded
-                ? "Server capacity is exhausted. Retry later."
-                : "Server is shutting down.",
+            code: overloaded ? -33001 : -33002,
+            message: overloaded ? "Server capacity is exhausted. Retry later." : "Server is shutting down.",
             data,
         },
-    }), { status: 503, headers });
+    })), { status: 503, headers });
 }
 /**
  * Hand a response the Scope that holds what its request acquired.
@@ -153,6 +225,12 @@ function scopedToBody(handler, signal) {
             yield* Scope.close(scope, exit);
             return yield* exit;
         }
+        // A deadline can finish with a fresh error response after aborting the
+        // request. Release request resources now, without cancelling that body.
+        if (signal.aborted && deadlineResponses.has(exit.value)) {
+            yield* Scope.close(scope, Exit.void);
+            return exit.value;
+        }
         // Every finalizer in the scope is synchronous, so the close has run by
         // the time detach returns: the permit is back, and handed to the next
         // queued request, inside the read or cancel that ended the body.
@@ -177,8 +255,7 @@ function scopedToBody(handler, signal) {
 function admitted(controller, signal) {
     return Effect.acquireRelease(Effect.suspend(() => {
         const pending = controller.acquire({ signal });
-        return Effect.tryPromise({ try: () => pending, catch: (error) => error })
-            .pipe(Effect.onInterrupt(() => Effect.sync(() => {
+        return Effect.tryPromise({ try: () => pending, catch: (error) => error }).pipe(Effect.onInterrupt(() => Effect.sync(() => {
             pending.then((lease) => lease.release(), () => { });
         })));
     }), (lease) => Effect.sync(() => lease.release()), { interruptible: true });
@@ -194,13 +271,13 @@ function admitted(controller, signal) {
  * operator-side log line, which (as ever — issue #47) is the channel that
  * actually reaches a human.
  */
-function toolkitRetired(logger) {
+function toolkitRetired(logger, sentSecrets) {
     logger.warn("[connecta] rejected an /mcp connection carrying ?toolkit= with 404: " +
-        "toolkits were retired in issue #178 (see ethos.md) — one deployment " +
+        "toolkits were retired in issue #178 (see PRINCIPLES.md) — one deployment " +
         "serves one audience. The client sees a transport-level failure and " +
         "never the reason, so remove the ?toolkit= value from its MCP endpoint " +
         "URL, or point it at the deployment for its audience.");
-    return new Response(JSON.stringify({
+    return new Response(JSON.stringify(redactAgentOutput(sentSecrets, {
         jsonrpc: "2.0",
         id: null,
         error: {
@@ -209,7 +286,7 @@ function toolkitRetired(logger) {
                 "in issue #178 — remove the ?toolkit= value from the MCP endpoint " +
                 "URL, or ask the operator for the deployment serving this audience.",
         },
-    }), {
+    })), {
         status: 404,
         headers: {
             "Content-Type": "application/json",
@@ -217,89 +294,98 @@ function toolkitRetired(logger) {
         },
     });
 }
-function serveMcp(request, requestSignal, opts, baseUrl, actor, registry, canManageAuth, runtimeContext) {
+function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, registry, canManageAuth, principalKey, runtimeContext, trust = "read-only", pool, principalActor) {
+    const sentSecrets = sentSecretsForRequest(requestScope);
     // Every McpServer the request builds is fresh and closes with its scope.
     // The modern handler tears its own down after the exchange; the legacy
     // transport never does, and neither may stay wired to an ended request.
     const servers = [];
     const createServer = () => {
-        const server = new McpServer(opts.serverInfo, {
+        const authElicitation = new AuthElicitation({
+            vault: opts.config.vault,
+            publicUrl: opts.config.publicUrl,
+            endpoint: new URL(new URL(request.url).pathname, baseUrl).href,
+            principal: principalKey,
+            registry,
+            canManage: canManageAuth,
+            connectLink: (id, force, after) => oauthConnectLink(opts, opts.config.publicUrl ?? baseUrl, id, principalKey, force, Boolean(opts.config.vault?.seal && opts.config.vault.open), after),
+            linkProgress: (id, nonce) => oauthConnectLinkProgress(opts, baseUrl, id, nonce),
+            closeLinks: (id, nonces) => closeOAuthConnectLinks(opts, baseUrl, id, nonces),
+            claimRetry: (id, nonce) => claimAuthRetry(opts, baseUrl, id, nonce),
+            unavailable: oauthConnectUnavailable(opts),
+            credentialUi: Boolean(opts.config.ui && opts.config.vault),
+            requestSignal,
+            requestScope,
+            defer: runtimeContext?.waitUntil?.bind(runtimeContext),
+        });
+        const server = new McpServer(opts.config.serverInfo, {
+            // A request-local server cannot publish catalog changes. Set this before
+            // tool registration, whose SDK default otherwise advertises listChanged.
+            capabilities: { tools: { listChanged: false }, extensions: { "io.modelcontextprotocol/skills": {} } },
             instructions: CONNECTA_INSTRUCTIONS,
+            inputRequired: { legacyShim: false },
+            requestState: { verify: (state, context) => authElicitation.verify(state, context) },
             cacheHints: {
+                "server/discover": { ttlMs: 3_600_000, cacheScope: "private" },
                 "tools/list": {
                     ttlMs: 3_600_000,
                     cacheScope: "private",
                 },
             },
         });
-        const activity = opts.activity
+        const activity = opts.config.activity?.store
             ? {
-                sink: opts.activity,
-                recordTool: opts.activityModule?.recordTool,
+                sink: opts.config.activity?.store,
+                recordTool: opts.config.activity?.recordTool,
                 actor,
+                ...(principalActor ? { principalActor } : {}),
                 requestId: crypto.randomUUID(),
-                serverInfo: opts.serverInfo,
-                ...(opts.activityDeploymentId
-                    ? { deploymentId: opts.activityDeploymentId }
-                    : {}),
-                ...(runtimeContext?.waitUntil
-                    ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
-                    : {}),
-                logger: opts.logger,
+                ...(pool !== undefined ? { pool } : {}),
+                serverInfo: opts.config.serverInfo,
+                ...(opts.config.activity?.deploymentId ? { deploymentId: opts.config.activity?.deploymentId } : {}),
+                ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
+                logger: opts.config.logger,
             }
             : undefined;
+        if (activity)
+            bindActivityRequest(requestScope, activity);
+        const client = {};
+        registerSkills(server, registry, baseUrl, {
+            requestScope,
+            requestSignal,
+            probeTimeoutMs: opts.config.discovery.probeTimeoutMs,
+            ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
+        });
         registerMetaTools(server, registry, {
+            authElicitation,
+            client,
             baseUrl,
+            requestScope,
+            trust,
             canManageAuth,
-            credentialHandoffUrl: opts.ui?.credentialHandoffUrl(baseUrl),
+            oauthConnectUrl: (id, force) => oauthConnectUrl(opts, baseUrl, id, principalKey, force),
+            oauthConnectUnavailable: oauthConnectUnavailable(opts),
+            credentialHandoffUrl: opts.config.ui?.credentialHandoffUrl(baseUrl),
             ...(activity ? { activity } : {}),
-            ...(opts.defaultToolTimeoutMs !== undefined
-                ? { defaultToolTimeoutMs: opts.defaultToolTimeoutMs }
-                : {}),
-            ...(opts.probeTimeoutMs !== undefined
-                ? { probeTimeoutMs: opts.probeTimeoutMs }
-                : {}),
-            ...(opts.discoveryConcurrency !== undefined
-                ? { discoveryConcurrency: opts.discoveryConcurrency }
-                : {}),
+            defaultToolTimeoutMs: opts.config.calls.defaultTimeoutMs ?? opts.config.execute.hostCallTimeoutMs,
+            probeTimeoutMs: opts.config.discovery.probeTimeoutMs,
+            discoveryConcurrency: opts.config.discovery.concurrency,
             requestSignal,
-            ...(runtimeContext?.waitUntil
-                ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
-                : {}),
-            approval: opts.approval,
+            ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
         });
         registerExecuteTool(server, registry, {
+            authElicitation,
+            client,
             baseUrl,
+            requestScope,
             executor: opts.executor,
-            logger: opts.logger,
+            defaultToolTimeoutMs: opts.config.calls.defaultTimeoutMs ?? opts.config.execute.hostCallTimeoutMs,
+            logger: opts.config.logger,
             ...(activity ? { activity } : {}),
             requestSignal,
-            ...(runtimeContext?.waitUntil
-                ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
-                : {}),
-            ...(opts.discoveryConcurrency !== undefined
-                ? { discoveryConcurrency: opts.discoveryConcurrency }
-                : {}),
-            ...(opts.probeTimeoutMs !== undefined
-                ? { probeTimeoutMs: opts.probeTimeoutMs }
-                : {}),
-            ...(opts.maxEmittedBytes !== undefined
-                ? { maxEmittedBytes: opts.maxEmittedBytes }
-                : {}),
-            ...(opts.maxEmittedBlocks !== undefined
-                ? { maxEmittedBlocks: opts.maxEmittedBlocks }
-                : {}),
-            ...(opts.maxHostCalls !== undefined
-                ? { maxHostCalls: opts.maxHostCalls }
-                : {}),
-            ...(opts.hostCallTimeoutMs !== undefined
-                ? { hostCallTimeoutMs: opts.hostCallTimeoutMs }
-                : {}),
-            ...(opts.watchdogMs !== undefined
-                ? { watchdogMs: opts.watchdogMs }
-                : {}),
-            approval: opts.approval,
-            maxWrites: opts.maxWrites,
+            ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
+            ...executeLimits(opts.config),
+            trust,
         });
         servers.push(server);
         return server;
@@ -309,15 +395,33 @@ function serveMcp(request, requestSignal, opts, baseUrl, actor, registry, canMan
         // Connecta's established wire contract is JSON, so retain the documented
         // user-land legacy branch with the same transport setting while the modern
         // branch uses the fetch-native handler.
-        if (!(await isLegacyRequest(request))) {
-            return createMcpHandler(createServer, {
+        if (!(await isLegacyRequest(request, undefined, SDK_BODY_BOUND))) {
+            const response = await createMcpHandler(createServer, {
+                ...SDK_BODY_BOUND,
                 legacy: "reject",
-                onerror: (error) => opts.logger.error("[connecta] MCP handler error", error),
+                // Keep the SDK's validation and prevent it from opening an SSE stream.
+                // Its capacity error below becomes our permanent unsupported method.
+                maxSubscriptions: 0,
+                onerror: (error) => logFailure(opts.config.logger, "MCP handler error", failureRecord({}, error), "error"),
             }).fetch(request);
+            if (request.headers.get("Mcp-Method") === "subscriptions/listen" && response.status === 200) {
+                const body = await response.clone().json();
+                if (isJSONRPCErrorResponse(body) &&
+                    body.error.code === -32603 &&
+                    body.error.message === "Subscription limit reached") {
+                    return new Response(JSON.stringify({
+                        jsonrpc: "2.0",
+                        id: body.id,
+                        error: { code: -32601, message: "Method not found: subscriptions/listen" },
+                    }), { status: 404, headers: response.headers });
+                }
+            }
+            return response;
         }
         // Fresh server + transport per legacy request, stateless and JSON-shaped.
         const server = createServer();
         const transport = new WebStandardStreamableHTTPServerTransport({
+            ...SDK_BODY_BOUND,
             enableJsonResponse: true,
         });
         await server.connect(transport);
@@ -326,10 +430,34 @@ function serveMcp(request, requestSignal, opts, baseUrl, actor, registry, canMan
     return Effect.addFinalizer(() => Effect.sync(() => {
         for (const server of servers)
             void server.close().catch(() => { });
-    })).pipe(Effect.andThen(Effect.promise(exchange)));
+    })).pipe(Effect.andThen(Effect.promise(async () => {
+        const response = await exchange();
+        // Both SDK transports serialize here. This also covers SDK-generated
+        // JSON-RPC errors and allowed HTTP 4xx text, outside tool result shaping.
+        if (!response.body)
+            return response;
+        const body = await response.text();
+        let text;
+        if (response.headers.get("Content-Type")?.includes("application/json")) {
+            // Structured redaction also joins text blocks before a secret split
+            // across them can cross the serialization boundary.
+            try {
+                text = JSON.stringify(redactAgentOutput(sentSecrets, JSON.parse(body)));
+            }
+            catch {
+                /* Non-JSON diagnostics still pass through the text boundary. */
+            }
+        }
+        // Parsed JSON already passes every string through the boundary. A second
+        // serialized pass would mistake a blob's encoding for credential bytes.
+        text ??= redactAgentOutput(sentSecrets, body);
+        const headers = new Headers(response.headers);
+        headers.delete("Content-Length");
+        return new Response(text, { status: response.status, statusText: response.statusText, headers });
+    })));
 }
 export function createMcpRoute(opts) {
-    const configuredOrigins = opts.allowedOrigins;
+    const configuredOrigins = opts.config.allowedOrigins;
     const isExactOrigin = (value) => {
         if (typeof value !== "string")
             return false;
@@ -341,13 +469,14 @@ export function createMcpRoute(opts) {
             return false;
         }
     };
-    if (configuredOrigins !== undefined && configuredOrigins !== "*" &&
-        (!Array.isArray(configuredOrigins) || !configuredOrigins.every(isExactOrigin))) {
-        throw new TypeError('ConnectaConfig.allowedOrigins must be an array of exact HTTP(S) origins or "*".');
-    }
+    // The schema has already refused anything but exact origins or "*".
     const origins = new Set(configuredOrigins === undefined
-        ? opts.publicUrl ? [new URL(opts.publicUrl).origin] : []
-        : configuredOrigins === "*" ? [] : configuredOrigins);
+        ? opts.config.publicUrl
+            ? [new URL(opts.config.publicUrl).origin]
+            : []
+        : configuredOrigins === "*"
+            ? []
+            : configuredOrigins);
     const allowsOrigin = (origin) => {
         if (configuredOrigins === "*")
             return true;
@@ -367,10 +496,7 @@ export function createMcpRoute(opts) {
         const origin = request.headers.get("Origin");
         if (origin === null || allowsOrigin(origin))
             return null;
-        return withMcpCors(new Response('{"error":"origin not allowed"}', {
-            status: 403,
-            headers: { "Content-Type": "application/json", "Cache-Control": "no-store" },
-        }), request, null);
+        return withMcpCors(mcpRefusal(sentSecretsForRequest(request), 403, -33005, "MCP access is forbidden."), request, null);
     };
     let lastAdmissionWarningAt = 0;
     let suppressedAdmissionWarnings = 0;
@@ -380,7 +506,7 @@ export function createMcpRoute(opts) {
             suppressedAdmissionWarnings++;
             return;
         }
-        opts.logger.warn("[connecta] MCP request admission rejected", {
+        opts.config.logger.warn("[connecta] MCP request admission rejected", {
             retryAfterMs: error.retryAfterMs,
             active: opts.requestAdmission.activeCount,
             queued: opts.requestAdmission.queuedCount,
@@ -390,9 +516,14 @@ export function createMcpRoute(opts) {
         suppressedAdmissionWarnings = 0;
     };
     function routeMcp(context) {
-        const { path, request, baseUrl, runtimeContext, } = context;
+        const { path, request, baseUrl, runtimeContext } = context;
         if (path !== "/mcp" && !path.startsWith("/mcp/"))
             return Effect.succeed(null);
+        // Admission, refusal bodies, SDK serialization and connector work share
+        // one set. Connector contexts still receive an opaque scope, never the
+        // inbound Request or its headers.
+        const requestScope = {};
+        const sentSecrets = sentSecretsForRequest(requestScope, sentSecretsForRequest(request));
         const poolName = path === "/mcp" ? undefined : path.slice("/mcp/".length);
         const origin = request.headers.get("Origin");
         const allowed = origin === null || allowsOrigin(origin);
@@ -422,7 +553,25 @@ export function createMcpRoute(opts) {
                 if (deadlineTimer !== undefined)
                     clearTimeout(deadlineTimer);
             }));
-            const admission = yield* Effect.result(admitted(opts.requestAdmission, request.signal));
+            // Only a body-confirmed modern listen may skip admission. Trusting the
+            // method header alone would let a legacy tools/call bypass the pool.
+            const startedAt = Date.now();
+            const maxDurationMs = opts.requestAdmission.maxDurationMs;
+            let listen = false;
+            if (request.method === "POST" && request.headers.get("Mcp-Method") === "subscriptions/listen") {
+                const classify = Effect.promise(() => isModernListen(request, localAbort.signal));
+                const prepared = maxDurationMs === undefined
+                    ? Option.some(yield* classify)
+                    : yield* classify.pipe(Effect.timeoutOption(Duration.millis(maxDurationMs)));
+                if (Option.isNone(prepared)) {
+                    localAbort.abort(new Error("MCP request lifetime exceeded."));
+                    return cors(mcpRefusal(sentSecrets, 504, -33003, "MCP request lifetime exceeded."));
+                }
+                listen = prepared.value;
+            }
+            const admission = listen
+                ? Result.succeed(undefined)
+                : yield* Effect.result(admitted(opts.requestAdmission, request.signal));
             if (Result.isFailure(admission)) {
                 const error = admission.failure;
                 if (!(error instanceof ExecutorAdmissionError)) {
@@ -434,12 +583,16 @@ export function createMcpRoute(opts) {
                 if (error.code === "executor_overloaded") {
                     warnAdmissionRejected(error);
                 }
-                return cors(requestAdmissionFailure(error));
+                return cors(requestAdmissionFailure(sentSecrets, error));
             }
-            const remainingMs = admission.success.remainingMs();
+            const remainingMs = admission.success
+                ? admission.success.remainingMs()
+                : maxDurationMs === undefined
+                    ? undefined
+                    : maxDurationMs - (Date.now() - startedAt);
             if (remainingMs !== undefined && remainingMs <= 0) {
-                admission.success.release();
-                return cors(new Response("MCP request lifetime exceeded.", { status: 504 }));
+                admission.success?.release();
+                return cors(mcpRefusal(sentSecrets, 504, -33003, "MCP request lifetime exceeded."));
             }
             if (remainingMs !== undefined) {
                 deadlineTimer = setTimeout(() => {
@@ -447,8 +600,8 @@ export function createMcpRoute(opts) {
                 }, remainingMs);
             }
             const localRequest = new Request(request, { signal: localAbort.signal });
-            if (admission.success.waitMs > 0) {
-                opts.logger.debug("[connecta] MCP request admitted after queue wait", {
+            if (admission.success && admission.success.waitMs > 0) {
+                opts.config.logger.debug("[connecta] MCP request admitted after queue wait", {
                     waitMs: admission.success.waitMs,
                     active: opts.requestAdmission.activeCount,
                     queued: opts.requestAdmission.queuedCount,
@@ -459,33 +612,57 @@ export function createMcpRoute(opts) {
             // shares it, to save only the lookups an abandoned authorization
             // finishes on its own.
             const handled = Effect.gen(function* () {
-                const authz = yield* Effect.promise(() => authorize(localRequest, baseUrl, opts.auth, runtimeContext, opts.identity));
-                if (!authz.ok)
-                    return cors(authz.response);
+                const authz = yield* Effect.promise(() => authorize(localRequest, baseUrl, opts.config.auth, runtimeContext, opts.config.identity));
+                if (!authz.ok) {
+                    const response = authz.response;
+                    // Preserve the auth adapter's challenge and status. The MCP host must
+                    // repair its connection to connecta before any connector can be called.
+                    if (response.status !== 401 && response.status !== 403)
+                        return cors(response);
+                    const headers = new Headers(response.headers);
+                    headers.set("Connecta-Error-Code", "host_auth_required");
+                    headers.set("Connecta-Recovery", "host_connection");
+                    // Custom adapters may own a streaming or non-JSON response. Preserve
+                    // that body and its request lifetime, and carry recovery in headers.
+                    if (!response.headers.get("Content-Type")?.includes("application/json")) {
+                        return cors(new Response(response.body, { status: response.status, headers }));
+                    }
+                    headers.set("Content-Type", "application/json");
+                    headers.delete("Content-Length");
+                    void response.body?.cancel().catch(() => { });
+                    return cors(new Response(JSON.stringify(redactAgentOutput(sentSecrets, {
+                        error: {
+                            code: "host_auth_required",
+                            message: "The host is not authorized to connect to this endpoint. Sign in or update the host's connecta access token and endpoint grants.",
+                            retryable: false,
+                            recovery: "host_connection",
+                        },
+                    })), { status: response.status, headers }));
+                }
                 // A pool endpoint narrows the identity's own view and nothing else. An
                 // undeclared name, a grant that refuses, and a grant that throws are
                 // one identical 404 so a credential never enumerates the other pools;
                 // the operator log is where the reason lives.
                 let access = authz;
+                let trust = opts.config.trust;
                 if (poolName !== undefined) {
                     const pool = opts.pools?.get(poolName);
-                    const reason = !pool ? "undeclared" : yield* Effect.promise(async () => {
-                        try {
-                            return (await pool.grant(authz.identity)) === true ? "granted" : "refused";
-                        }
-                        catch {
-                            return "grant threw";
-                        }
-                    });
-                    if (!pool || reason !== "granted") {
-                        opts.logger.warn(`[connecta] refused /mcp/${poolName} with 404: pool ${reason}` +
-                            (authz.actor.id ? ` for ${loggableValue(authz.actor.id)}` : ""));
-                        // The server's own 404, so a browser sees the page every unserved
-                        // path shows and an MCP client (which never asks for text/html)
-                        // still reads a plain "Not Found".
-                        return cors(notFoundResponse(request, opts));
+                    const denialReason = !pool
+                        ? "pool_not_declared"
+                        : yield* Effect.promise(async () => {
+                            try {
+                                return (await pool.grant(authz.identity)) === true ? undefined : "pool_grant_denied";
+                            }
+                            catch {
+                                return "pool_grant_threw";
+                            }
+                        });
+                    if (!pool || denialReason !== undefined) {
+                        logFailure(opts.config.logger, "MCP pool request denied", failureRecord({ reason: denialReason ?? "pool_not_declared" }));
+                        return cors(mcpRefusal(sentSecrets, 404, -33004, "MCP endpoint not found."));
                     }
                     access = intersectAccess(authz, pool.access);
+                    trust = pool.trust;
                 }
                 let scopedRegistry;
                 try {
@@ -496,22 +673,80 @@ export function createMcpRoute(opts) {
                         ...(access.guardedToolAccess ? { guardedToolAccess: access.guardedToolAccess } : {}),
                         ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
                         ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
+                        endpoint: new URL(request.url).pathname,
+                        origin: request.headers.get("Origin"),
+                        currentResultAccess: async (address, classification, signal, access) => {
+                            signal?.throwIfAborted();
+                            const current = await authorize(localRequest, baseUrl, opts.config.auth, runtimeContext, opts.config.identity);
+                            if (!current.ok) {
+                                await current.response.body?.cancel().catch(() => { });
+                                return false;
+                            }
+                            if (current.subjectKey !== authz.subjectKey || current.principalKey !== authz.principalKey)
+                                return false;
+                            validateAuthPermissions(current, opts.registry);
+                            let currentAccess = current;
+                            let currentTrust = opts.config.trust;
+                            if (poolName !== undefined) {
+                                const pool = opts.pools.get(poolName);
+                                if (!pool || (await pool.grant(current.identity)) !== true)
+                                    return false;
+                                currentAccess = intersectAccess(current, pool.access);
+                                currentTrust = pool.trust;
+                            }
+                            const view = opts.registry.scoped({
+                                ...currentAccess,
+                                ...(current.subjectKey ? { subjectKey: current.subjectKey } : {}),
+                                ...(current.principalKey ? { principalKey: current.principalKey } : {}),
+                            });
+                            if (classification === "write" && currentTrust !== "trusted")
+                                return false;
+                            if (address === undefined)
+                                return true;
+                            // Skill and resource content requires a whole grant; catalog metadata requires visibility.
+                            if (!address.includes("."))
+                                return Boolean(access === "catalog" ? view.getConnector(address) : view.getResourceConnector(address));
+                            const resolved = view.resolveAddress(address);
+                            if (!resolved)
+                                return false;
+                            const requestScope = {};
+                            try {
+                                const tool = (await view.getTools(resolved.connector.id, baseUrl, requestScope, signal ? { signal } : {})).find((tool) => tool.name === resolved.toolName);
+                                signal?.throwIfAborted();
+                                return Boolean(tool &&
+                                    (access === "catalog" ||
+                                        (classification === "read" && tool.classification === "read") ||
+                                        currentTrust === "trusted"));
+                            }
+                            finally {
+                                await closeConnectorScope(resolved.connector, view.contextFor(resolved.connector.id, baseUrl, requestScope), runtimeContext?.waitUntil?.bind(runtimeContext));
+                            }
+                        },
                         caller: {
                             identity: authz.identity,
+                            // `authorize` admits an open deployment's every request as the
+                            // anonymous actor; only a provider's `ok` is an authentication.
+                            authenticated: opts.config.auth.length > 0,
                             ...(poolName !== undefined ? { pool: poolName } : {}),
                         },
                     });
                 }
-                catch (error) {
-                    return cors(new Response(JSON.stringify({ error: msg(error) }), {
-                        status: 403,
-                        headers: { "Content-Type": "application/json" },
-                    }));
+                catch {
+                    return cors(mcpRefusal(sentSecrets, 403, -33005, "MCP access is forbidden."));
                 }
                 if (new URL(request.url).searchParams.has("toolkit")) {
-                    return cors(toolkitRetired(opts.logger));
+                    return cors(toolkitRetired(opts.config.logger, sentSecrets));
                 }
-                return cors(yield* serveMcp(localRequest, localAbort.signal, opts, baseUrl, authz.actor, scopedRegistry, id => { const connector = scopedRegistry.getConnector(id); return Boolean(connector && mayManageConnector(authz, connector)); }, runtimeContext));
+                return cors(yield* serveMcp(localRequest, localAbort.signal, requestScope, opts, baseUrl, authz.actor, scopedRegistry, (id) => {
+                    const connector = scopedRegistry.getConnector(id);
+                    return Boolean(connector && mayManageConnector(authz, connector));
+                }, authz.principalKey, runtimeContext, trust, poolName, authz.identity.principal
+                    ? {
+                        kind: authz.actor.kind,
+                        id: authz.identity.principal.id,
+                        namespace: authz.identity.principal.namespace,
+                    }
+                    : undefined));
             });
             if (remainingMs === undefined)
                 return yield* handled;
@@ -520,7 +755,7 @@ export function createMcpRoute(opts) {
                 localAbort.abort(new Error("MCP request lifetime exceeded."));
             return Option.isSome(bounded)
                 ? bounded.value
-                : cors(new Response("MCP request lifetime exceeded.", { status: 504 }));
+                : cors(mcpRefusal(sentSecrets, 504, -33003, "MCP request lifetime exceeded."));
         }), localAbort.signal);
     }
     return { handle: routeMcp, rejectOrigin };