@zackbart/connecta 0.31.0 → 0.33.0

package/dist/routes/credentials.js

@@ -2,45 +2,10 @@ import { failureRecord, logFailure } from "../operator-record.js";
 import { Effect } from "effect";
 import { claimConnectorScopeCleanup, closeConnectorScope } from "../connector-scope.js";
 import { credentialTestRule, describeCredentialTestMismatch, storedCredentialShape } from "../credential-rules.js";
-import { authorizedPerson, refuse, serveOperator, visibleRegistry } from "./operator.js";
-import { mayManageConnector, isSameOrigin, msg, privateJson } from "./shared.js";
+import { authorizedPerson, refuse, serveOperator, managementRegistry } from "./operator.js";
+import { boundedText, mayManageConnector, isSameOrigin, msg, privateJson } from "./shared.js";
 /** The longest body, in characters, a credential write accepts. */
 const MAX_BODY_CHARS = 20_000;
-/**
- * The most UTF-8 a body within MAX_BODY_CHARS can take. No UTF-16 unit costs
- * more than three bytes, and a malformed sequence decodes to one U+FFFD per
- * at most three bytes, so a body past this many bytes is past the character
- * limit too — and reading stops there, instead of buffering whatever a client
- * cares to send before measuring it.
- */
-const MAX_BODY_BYTES = MAX_BODY_CHARS * 3;
-/** The body as text, or undefined once it is longer than MAX_BODY_CHARS. */
-async function boundedText(request) {
-    if (!request.body)
-        return "";
-    const reader = request.body.getReader();
-    const chunks = [];
-    let size = 0;
-    for (;;) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        size += value.byteLength;
-        if (size > MAX_BODY_BYTES) {
-            reader.cancel().catch(() => { });
-            return undefined;
-        }
-        chunks.push(value);
-    }
-    const bytes = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    const text = new TextDecoder().decode(bytes);
-    return text.length > MAX_BODY_CHARS ? undefined : text;
-}
 /** Field-by-field checks, in words the Credentials page shows as written. */
 function credentialInput(body, config) {
     if (!config.fields?.length) {
@@ -73,7 +38,7 @@ function readCredentialInput(request, config) {
         if (!request.headers.get("content-type")?.toLowerCase().startsWith("application/json")) {
             return yield* refuse("Content-Type must be application/json", 415);
         }
-        const raw = yield* Effect.promise(() => boundedText(request));
+        const raw = yield* Effect.promise(() => boundedText(request, MAX_BODY_CHARS));
         if (raw === undefined)
             return yield* refuse("request body is too large", 413);
         let body;
@@ -99,12 +64,12 @@ function credentialRequest(context, connectorId, action) {
             return yield* refuse("same-origin request required", 403);
         }
         const authz = yield* authorizedPerson(context, "credential management");
-        const registry = yield* visibleRegistry(context, authz);
+        const registry = yield* managementRegistry(context, authz);
         const connector = registry.getConnector(connectorId);
         const credential = connector?.credential;
         if (!connector || !credential)
             return yield* refuse("unknown credential slot", 404);
-        if (!mayManageConnector(authz, connector)) {
+        if (!mayManageConnector(opts, authz, connector)) {
             return yield* refuse("credential management is not permitted", 403);
         }
         const personal = connector.authScope === "personal";
@@ -191,6 +156,17 @@ function credentialRequest(context, connectorId, action) {
             }).pipe(Effect.catch((error) => refuse(msg(error), 400)));
         }
         if (request.method === "DELETE") {
+            // Clearing nothing is refused, as testing nothing is, so the route
+            // agrees with the operator contract, which offers `clear` only once a
+            // value is stored in the caller's partition (#837). A value that cannot
+            // be read may still be cleared: removing it is how one recovers.
+            const stored = yield* Effect.tryPromise({
+                try: () => vault.metadata(connectorId, owner),
+                catch: (error) => error,
+            }).pipe(Effect.orElseSucceed(() => "unreadable"));
+            if (stored === null) {
+                return privateJson({ error: "no credential is stored to clear", problem: "credential_required" }, { status: 409 });
+            }
             yield* Effect.promise(() => vault.delete(connectorId, owner));
             yield* Effect.promise(() => registry.invalidateStored(connectorId));
             return new Response(null, {

package/dist/routes/mcp.js

@@ -8,13 +8,13 @@ import { Duration, Effect, Exit, Option, Result, Scope } from "effect";
 import { registerExecuteTool } from "../execute.js";
 import { ExecutorAdmissionError } from "../executor-admission.js";
 import { registerMetaTools } from "../meta-tools.js";
-import { intersectAccess } from "../connector-access.js";
 import { CONNECTA_INSTRUCTIONS } from "../skills.js";
 import { registerSkills } from "./skills.js";
 import { failureRecord, logFailure } from "../operator-record.js";
 import { redactAgentOutput, sentSecretsForRequest } from "../sent-secrets.js";
 import { detach } from "../runtime/run.js";
-import { authorize, mayManageConnector, validateAuthPermissions, } from "./shared.js";
+import { agentEndpointPool, isAgentPath } from "./agent-path.js";
+import { admitsMaintainer, agentPool, authorize, authorizeAgent, mayManageConnector, memberPool, } from "./shared.js";
 /**
  * The SDK's own bound on the body it reads. Since server 2.1.0 the SDK
  * answers anything over 4 MiB with its own 413, which would quietly shadow
@@ -26,10 +26,22 @@ import { authorize, mayManageConnector, validateAuthPermissions, } from "./share
 const SDK_BODY_BOUND = { maxRequestBodySize: Number.MAX_SAFE_INTEGER };
 // Identity, not a status/header a custom auth response could imitate.
 const deadlineResponses = new WeakSet();
-async function isModernListen(request, signal) {
+/**
+ * The most a `subscriptions/listen` classification reads. A listen is a small
+ * JSON-RPC request; this read happens before request admission, so it is
+ * bounded by this fixed cap rather than by the host's body limit (#857).
+ */
+export const MAX_LISTEN_CLASSIFICATION_BYTES = 64 * 1024;
+/**
+ * Whether an admitted, authenticated request is a modern `subscriptions/listen`.
+ * Reads at most `MAX_LISTEN_CLASSIFICATION_BYTES` of a clone, then stops and
+ * cancels the body: `"too_large"` past the cap, `"aborted"` when the request
+ * ended or its lifetime ran out while reading.
+ */
+async function classifyListen(request, signal) {
     const reader = request.clone().body?.getReader();
     if (!reader)
-        return false;
+        return "other";
     const onAbort = () => {
         void reader.cancel(signal.reason).catch(() => { });
         void request.body?.cancel(signal.reason).catch(() => { });
@@ -46,12 +58,15 @@ async function isModernListen(request, signal) {
             if (done)
                 break;
             bytes += value.byteLength;
-            if (bytes > SDK_BODY_BOUND.maxRequestBodySize)
-                return false;
+            if (bytes > MAX_LISTEN_CLASSIFICATION_BYTES) {
+                void reader.cancel().catch(() => { });
+                void request.body?.cancel().catch(() => { });
+                return "too_large";
+            }
             text += decoder.decode(value, { stream: true });
         }
         if (signal.aborted)
-            return false;
+            return "aborted";
         const protocolVersion = request.headers.get("MCP-Protocol-Version");
         const method = request.headers.get("Mcp-Method");
         const route = classifyInboundRequest({
@@ -60,11 +75,15 @@ async function isModernListen(request, signal) {
             ...(method !== null ? { mcpMethodHeader: method } : {}),
             body: JSON.parse(text + decoder.decode()),
         });
-        return (route.kind === "modern" && route.messageKind === "request" && route.message.method === "subscriptions/listen");
+        return route.kind === "modern" && route.messageKind === "request" && route.message.method === "subscriptions/listen"
+            ? "listen"
+            : "other";
     }
     catch {
+        if (signal.aborted)
+            return "aborted";
         // Leave unreadable, malformed, and legacy bodies to the normal SDK path.
-        return false;
+        return "other";
     }
     finally {
         signal.removeEventListener("abort", onAbort);
@@ -294,7 +313,7 @@ function toolkitRetired(logger, sentSecrets) {
         },
     });
 }
-function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, registry, canManageAuth, principalKey, runtimeContext, trust = "read-only", pool, principalActor) {
+function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, registry, canManageAuth, principalKey, runtimeContext, readOnly = false, pool, principalActor) {
     const sentSecrets = sentSecretsForRequest(requestScope);
     // Every McpServer the request builds is fresh and closes with its scope.
     // The modern handler tears its own down after the exchange; the legacy
@@ -361,7 +380,7 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             client,
             baseUrl,
             requestScope,
-            trust,
+            readOnly,
             canManageAuth,
             oauthConnectUrl: (id, force) => oauthConnectUrl(opts, baseUrl, id, principalKey, force),
             oauthConnectUnavailable: oauthConnectUnavailable(opts),
@@ -385,7 +404,7 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             requestSignal,
             ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
             ...executeLimits(opts.config),
-            trust,
+            readOnly,
         });
         servers.push(server);
         return server;
@@ -456,6 +475,21 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
         return new Response(text, { status: response.status, statusText: response.statusText, headers });
     })));
 }
+function mcpEndpoint(path) {
+    if (isAgentPath(path)) {
+        const pool = agentEndpointPool(path);
+        return pool === undefined ? { kind: "refused" } : { kind: "agent", pool };
+    }
+    if (path === "/mcp")
+        return { kind: "default" };
+    if (path.startsWith("/mcp/"))
+        return { kind: "pool", pool: path.slice("/mcp/".length) };
+    return null;
+}
+/** Whether `path` is an MCP or agent endpoint path, valid or not. */
+function isMcpPath(path) {
+    return mcpEndpoint(path) !== null;
+}
 export function createMcpRoute(opts) {
     const configuredOrigins = opts.config.allowedOrigins;
     const isExactOrigin = (value) => {
@@ -490,8 +524,7 @@ export function createMcpRoute(opts) {
         return hostname === "localhost" || hostname === "[::1]" || /^127\.\d+\.\d+\.\d+$/.test(hostname);
     };
     const rejectOrigin = (request) => {
-        const path = new URL(request.url).pathname;
-        if (path !== "/mcp" && !path.startsWith("/mcp/"))
+        if (!isMcpPath(new URL(request.url).pathname))
             return null;
         const origin = request.headers.get("Origin");
         if (origin === null || allowsOrigin(origin))
@@ -516,23 +549,37 @@ export function createMcpRoute(opts) {
         suppressedAdmissionWarnings = 0;
     };
     function routeMcp(context) {
-        const { path, request, baseUrl, runtimeContext } = context;
-        if (path !== "/mcp" && !path.startsWith("/mcp/"))
+        const { path, request, baseUrl } = context;
+        // Protected-resource metadata stays public, including when a grant is
+        // configured, so a fresh OAuth client can discover how to authenticate.
+        const endpoint = mcpEndpoint(path);
+        if (!endpoint)
             return Effect.succeed(null);
         // Admission, refusal bodies, SDK serialization and connector work share
         // one set. Connector contexts still receive an opaque scope, never the
         // inbound Request or its headers.
         const requestScope = {};
         const sentSecrets = sentSecretsForRequest(requestScope, sentSecretsForRequest(request));
-        const poolName = path === "/mcp" ? undefined : path.slice("/mcp/".length);
+        const poolName = endpoint.kind === "pool" || endpoint.kind === "agent" ? endpoint.pool : undefined;
+        const agentEndpoint = endpoint.kind === "agent";
+        // Access attaches `ctx.access` even to a path it bypasses; an agent
+        // endpoint never reads it, so nothing past this point receives it.
+        const runtimeContext = agentEndpoint && context.runtimeContext
+            ? { waitUntil: context.runtimeContext.waitUntil.bind(context.runtimeContext) }
+            : context.runtimeContext;
         const origin = request.headers.get("Origin");
         const allowed = origin === null || allowsOrigin(origin);
         const cors = (response) => withMcpCors(response, request, configuredOrigins === "*" ? "*" : allowed ? origin : null);
+        const notFound = () => cors(mcpRefusal(sentSecrets, 404, -33004, "MCP endpoint not found."));
         // DNS-rebinding refusals cost neither a permit nor an auth lookup. This
         // local header check also guards OPTIONS before any provider metadata.
         const refusal = rejectOrigin(request);
         if (refusal)
             return Effect.succeed(refusal);
+        // Every other spelling in the agent namespace is the pool 404, before any
+        // admission or auth: no decoding, case folding, or slash collapsing.
+        if (endpoint.kind === "refused")
+            return Effect.succeed(notFound());
         if (request.method === "OPTIONS") {
             return Effect.succeed(cors(new Response(null, { status: 204 })));
         }
@@ -553,38 +600,30 @@ export function createMcpRoute(opts) {
                 if (deadlineTimer !== undefined)
                     clearTimeout(deadlineTimer);
             }));
-            // Only a body-confirmed modern listen may skip admission. Trusting the
-            // method header alone would let a legacy tools/call bypass the pool.
+            // A request naming `subscriptions/listen` defers its permit: nothing of
+            // its body is read until auth and endpoint admission pass, and then at
+            // most MAX_LISTEN_CLASSIFICATION_BYTES (#857). Only a body-confirmed
+            // modern listen goes without a permit; trusting the header alone would
+            // let a legacy tools/call bypass the pool, so anything else takes one
+            // after classification. Every other request takes its permit here,
+            // before auth, and no body is read before auth on any path.
             const startedAt = Date.now();
             const maxDurationMs = opts.requestAdmission.maxDurationMs;
-            let listen = false;
-            if (request.method === "POST" && request.headers.get("Mcp-Method") === "subscriptions/listen") {
-                const classify = Effect.promise(() => isModernListen(request, localAbort.signal));
-                const prepared = maxDurationMs === undefined
-                    ? Option.some(yield* classify)
-                    : yield* classify.pipe(Effect.timeoutOption(Duration.millis(maxDurationMs)));
-                if (Option.isNone(prepared)) {
-                    localAbort.abort(new Error("MCP request lifetime exceeded."));
-                    return cors(mcpRefusal(sentSecrets, 504, -33003, "MCP request lifetime exceeded."));
-                }
-                listen = prepared.value;
-            }
-            const admission = listen
+            const listenHeader = request.method === "POST" && request.headers.get("Mcp-Method") === "subscriptions/listen";
+            const refuseAdmission = (error) => {
+                if (!(error instanceof ExecutorAdmissionError))
+                    return Effect.fail(error);
+                if (error.code === "executor_cancelled")
+                    return Effect.fail(request.signal.reason ?? error);
+                if (error.code === "executor_overloaded")
+                    warnAdmissionRejected(error);
+                return Effect.succeed(cors(requestAdmissionFailure(sentSecrets, error)));
+            };
+            const admission = listenHeader
                 ? Result.succeed(undefined)
                 : yield* Effect.result(admitted(opts.requestAdmission, request.signal));
-            if (Result.isFailure(admission)) {
-                const error = admission.failure;
-                if (!(error instanceof ExecutorAdmissionError)) {
-                    return yield* Effect.fail(error);
-                }
-                if (error.code === "executor_cancelled") {
-                    return yield* Effect.fail(request.signal.reason ?? error);
-                }
-                if (error.code === "executor_overloaded") {
-                    warnAdmissionRejected(error);
-                }
-                return cors(requestAdmissionFailure(sentSecrets, error));
-            }
+            if (Result.isFailure(admission))
+                return yield* refuseAdmission(admission.failure);
             const remainingMs = admission.success
                 ? admission.success.remainingMs()
                 : maxDurationMs === undefined
@@ -611,8 +650,34 @@ export function createMcpRoute(opts) {
             // Effect `authorize` would put Effect in the /activity bundle, which
             // shares it, to save only the lookups an abandoned authorization
             // finishes on its own.
+            // Agent endpoints consult only the `cta_` adapter; human endpoints refuse `cta_`.
+            const admit = () => agentEndpoint
+                ? authorizeAgent(localRequest, baseUrl, opts.config.auth)
+                : authorize(localRequest, baseUrl, opts.config.auth, runtimeContext);
+            // Plain /mcp admits maintainers and serves the whole catalog; a pool
+            // admits its members, people at /mcp/<pool> and agents at
+            // /agent/<pool>, and serves exactly its tools (INV-4).
+            const scopeFor = (admitted) => {
+                if (poolName === undefined) {
+                    return admitsMaintainer(opts, admitted)
+                        ? { access: { connectorIds: "all" }, readOnly: opts.config.readOnly }
+                        : undefined;
+                }
+                const pool = agentEndpoint
+                    ? agentPool(opts, poolName, admitted.identity)
+                    : memberPool(opts, poolName, admitted.identity);
+                // The owner travels with the scope, so both pool endpoints set the
+                // same caller facts (#837 P5: agents act as the pool owner).
+                return pool
+                    ? {
+                        access: pool.access,
+                        readOnly: pool.readOnly,
+                        ...(pool.owner !== undefined ? { poolOwner: pool.owner } : {}),
+                    }
+                    : undefined;
+            };
             const handled = Effect.gen(function* () {
-                const authz = yield* Effect.promise(() => authorize(localRequest, baseUrl, opts.config.auth, runtimeContext, opts.config.identity));
+                const authz = yield* Effect.promise(admit);
                 if (!authz.ok) {
                     const response = authz.response;
                     // Preserve the auth adapter's challenge and status. The MCP host must
@@ -639,67 +704,69 @@ export function createMcpRoute(opts) {
                         },
                     })), { status: response.status, headers }));
                 }
-                // A pool endpoint narrows the identity's own view and nothing else. An
-                // undeclared name, a grant that refuses, and a grant that throws are
-                // one identical 404 so a credential never enumerates the other pools;
+                // A non-maintainer, a non-member, and an undeclared pool are one
+                // identical 404 so a credential never enumerates the other pools;
                 // the operator log is where the reason lives.
-                let access = authz;
-                let trust = opts.config.trust;
-                if (poolName !== undefined) {
-                    const pool = opts.pools?.get(poolName);
-                    const denialReason = !pool
-                        ? "pool_not_declared"
-                        : yield* Effect.promise(async () => {
-                            try {
-                                return (await pool.grant(authz.identity)) === true ? undefined : "pool_grant_denied";
-                            }
-                            catch {
-                                return "pool_grant_threw";
-                            }
-                        });
-                    if (!pool || denialReason !== undefined) {
-                        logFailure(opts.config.logger, "MCP pool request denied", failureRecord({ reason: denialReason ?? "pool_not_declared" }));
-                        return cors(mcpRefusal(sentSecrets, 404, -33004, "MCP endpoint not found."));
+                const scope = scopeFor(authz);
+                if (!scope) {
+                    logFailure(opts.config.logger, poolName === undefined
+                        ? "MCP default endpoint request denied"
+                        : agentEndpoint
+                            ? "MCP agent endpoint request denied"
+                            : "MCP pool request denied", failureRecord({
+                        reason: poolName === undefined
+                            ? "not_maintainer"
+                            : opts.pools.has(poolName)
+                                ? "not_pool_member"
+                                : "pool_not_declared",
+                    }));
+                    return notFound();
+                }
+                const { access, readOnly, poolOwner } = scope;
+                if (listenHeader) {
+                    const verdict = yield* Effect.promise(() => classifyListen(localRequest, localAbort.signal));
+                    // The deadline timer aborts a stalled read; its body is already cancelled.
+                    if (verdict === "aborted") {
+                        return cors(mcpRefusal(sentSecrets, 504, -33003, "MCP request lifetime exceeded."));
+                    }
+                    if (verdict === "too_large") {
+                        return cors(mcpRefusal(sentSecrets, 413, -33006, "MCP request body too large."));
+                    }
+                    if (verdict === "other") {
+                        const late = yield* Effect.result(admitted(opts.requestAdmission, request.signal));
+                        if (Result.isFailure(late))
+                            return yield* refuseAdmission(late.failure);
                     }
-                    access = intersectAccess(authz, pool.access);
-                    trust = pool.trust;
                 }
                 let scopedRegistry;
                 try {
-                    validateAuthPermissions(authz, opts.registry);
                     scopedRegistry = opts.registry.scoped({
                         connectorIds: access.connectorIds,
                         ...(access.toolAccess ? { toolAccess: access.toolAccess } : {}),
-                        ...(access.guardedToolAccess ? { guardedToolAccess: access.guardedToolAccess } : {}),
                         ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
                         ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
                         endpoint: new URL(request.url).pathname,
                         origin: request.headers.get("Origin"),
                         currentResultAccess: async (address, classification, signal, access) => {
                             signal?.throwIfAborted();
-                            const current = await authorize(localRequest, baseUrl, opts.config.auth, runtimeContext, opts.config.identity);
+                            const current = await admit();
                             if (!current.ok) {
                                 await current.response.body?.cancel().catch(() => { });
                                 return false;
                             }
                             if (current.subjectKey !== authz.subjectKey || current.principalKey !== authz.principalKey)
                                 return false;
-                            validateAuthPermissions(current, opts.registry);
-                            let currentAccess = current;
-                            let currentTrust = opts.config.trust;
-                            if (poolName !== undefined) {
-                                const pool = opts.pools.get(poolName);
-                                if (!pool || (await pool.grant(current.identity)) !== true)
-                                    return false;
-                                currentAccess = intersectAccess(current, pool.access);
-                                currentTrust = pool.trust;
-                            }
+                            // Paging re-admits the caller at this endpoint, as a new request would.
+                            const currentScope = scopeFor(current);
+                            if (!currentScope)
+                                return false;
+                            const { access: currentAccess, readOnly: currentReadOnly } = currentScope;
                             const view = opts.registry.scoped({
                                 ...currentAccess,
                                 ...(current.subjectKey ? { subjectKey: current.subjectKey } : {}),
                                 ...(current.principalKey ? { principalKey: current.principalKey } : {}),
                             });
-                            if (classification === "write" && currentTrust !== "trusted")
+                            if (classification === "write" && currentReadOnly)
                                 return false;
                             if (address === undefined)
                                 return true;
@@ -716,7 +783,7 @@ export function createMcpRoute(opts) {
                                 return Boolean(tool &&
                                     (access === "catalog" ||
                                         (classification === "read" && tool.classification === "read") ||
-                                        currentTrust === "trusted"));
+                                        !currentReadOnly));
                             }
                             finally {
                                 await closeConnectorScope(resolved.connector, view.contextFor(resolved.connector.id, baseUrl, requestScope), runtimeContext?.waitUntil?.bind(runtimeContext));
@@ -727,7 +794,10 @@ export function createMcpRoute(opts) {
                             // `authorize` admits an open deployment's every request as the
                             // anonymous actor; only a provider's `ok` is an authentication.
                             authenticated: opts.config.auth.length > 0,
+                            // Both pool endpoints build the caller here from the same
+                            // admitted scope, so an agent at /agent/<pool> carries the owner.
                             ...(poolName !== undefined ? { pool: poolName } : {}),
+                            ...(poolOwner !== undefined ? { poolOwner } : {}),
                         },
                     });
                 }
@@ -739,8 +809,8 @@ export function createMcpRoute(opts) {
                 }
                 return cors(yield* serveMcp(localRequest, localAbort.signal, requestScope, opts, baseUrl, authz.actor, scopedRegistry, (id) => {
                     const connector = scopedRegistry.getConnector(id);
-                    return Boolean(connector && mayManageConnector(authz, connector));
-                }, authz.principalKey, runtimeContext, trust, poolName, authz.identity.principal
+                    return Boolean(connector && mayManageConnector(opts, authz, connector));
+                }, authz.principalKey, runtimeContext, readOnly, poolName, authz.identity.principal
                     ? {
                         kind: authz.actor.kind,
                         id: authz.identity.principal.id,

package/dist/routes/oauth-management.js

@@ -2,7 +2,7 @@ import { OAuthRevocationError } from "../auth/downstream-revocation.js";
 import { Effect, Result } from "effect";
 import { closeScope } from "../runtime/connector-scope.js";
 import { oauthConnectUrl, oauthConnectUnavailable } from "../oauth-handoff.js";
-import { authorizedPerson, refuse, serveOperator, visibleRegistry, Answer } from "./operator.js";
+import { authorizedPerson, refuse, serveOperator, managementRegistry, Answer } from "./operator.js";
 import { failureRecord, logFailure } from "../operator-record.js";
 import { mayManageConnector, isSameOrigin, privateJson } from "./shared.js";
 /** A UI action signs its requested mode; the verified /connect visit applies it. */
@@ -20,14 +20,17 @@ function oauthManagementRequest(context, connectorId) {
             return yield* refuse("same-origin request required", 403);
         }
         const authz = yield* authorizedPerson(context, "OAuth management");
-        const registry = yield* visibleRegistry(context, authz);
+        const registry = yield* managementRegistry(context, authz);
         const connector = registry.getConnector(connectorId);
         const disconnectAuth = connector?.disconnectAuth?.bind(connector);
-        const startAuth = connector?.startAuth?.bind(connector);
-        if (!connector || !disconnectAuth || !startAuth) {
+        // Each verb needs only its own hooks (#837): connecting needs the whole
+        // flow, through the callback's state check; disconnecting needs only
+        // disconnectAuth, so a grant provisioned out of band can still be dropped.
+        const connects = Boolean(connector?.startAuth && connector.finishAuth && connector.verifyState);
+        if (!connector || (!connects && !disconnectAuth)) {
             return yield* refuse("unknown OAuth connector", 404);
         }
-        if (!mayManageConnector(authz, connector)) {
+        if (!mayManageConnector(opts, authz, connector)) {
             return yield* refuse("credential management is not permitted", 403);
         }
         if (connector.authScope === "personal" && !authz.principalKey) {
@@ -41,6 +44,9 @@ function oauthManagementRequest(context, connectorId) {
         if (mode === null) {
             return yield* refuse('mode must be "continue" or "restart"', 400);
         }
+        if (disconnecting ? !disconnectAuth : !connects) {
+            return yield* refuse("unknown OAuth connector", 404);
+        }
         if (!disconnecting) {
             const unavailable = oauthConnectUnavailable(opts);
             if (unavailable)

package/dist/routes/oauth.js

@@ -7,7 +7,7 @@ import { failureRecord, logFailure } from "../operator-record.js";
 import { oauthFlowKeys } from "../storage/keys.js";
 import { escapeHtml, renderPage, resolveBranding, STATUS_ICONS } from "../branding.js";
 import { oauthCallbackOutcome, providerErrorReason } from "../oauth-callback-outcome.js";
-import { authorizeUiIdentity, withSessionCookies, mayManageConnector, validateAuthPermissions, loggableValue, } from "./shared.js";
+import { authorizeUiIdentity, withSessionCookies, mayManageConnector, loggableValue, } from "./shared.js";
 const TONE_MARKS = {
     ok: { className: " ok", icon: STATUS_ICONS.ok, label: "Connected" },
     declined: { className: "", icon: STATUS_ICONS.declined, label: "Not connected" },
@@ -167,7 +167,7 @@ async function finishOAuthCallback(context) {
     }
     try {
         const expectedPrincipalKey = callbackTarget?.principalKey;
-        const browserIdentity = await authorizeUiIdentity(context.request, baseUrl, opts.config.auth, "OAuth callback", context.runtimeContext, opts.config.identity);
+        const browserIdentity = await authorizeUiIdentity(context.request, baseUrl, opts.config.auth, "OAuth callback", context.runtimeContext);
         if (!browserIdentity.ok) {
             if (browserIdentity.response.status === 401 && authorizationCredential(context.request).kind !== "absent")
                 return browserIdentity.response;
@@ -179,13 +179,7 @@ async function finishOAuthCallback(context) {
         }
         if (!expectedPrincipalKey || browserIdentity.principalKey !== expectedPrincipalKey)
             return refused();
-        try {
-            validateAuthPermissions(browserIdentity, opts.registry);
-        }
-        catch {
-            return refused();
-        }
-        if (!mayManageConnector(browserIdentity, connector))
+        if (!mayManageConnector(opts, browserIdentity, connector))
             return refused();
         // CSRF / login-fixation guard: this route is intentionally public, so verify
         // the `state` matches the flow connecta started BEFORE exchanging the code.

package/dist/routes/operator.js

@@ -22,7 +22,8 @@
 // Imported by the /ui and /activity graphs only; never from the root entry.
 import { Effect } from "effect";
 import { runEdge } from "../runtime/run.js";
-import { authorize, authorizeUiIdentity, msg, privateJson, validateAuthPermissions, } from "./shared.js";
+import { isMaintainer } from "../membership.js";
+import { admitsMaintainer, authorize, authorizeUiIdentity, memberConnectors, privateJson, } from "./shared.js";
 /** A response the route has already decided on. */
 export class Answer {
     response;
@@ -40,35 +41,42 @@ function admitted(result) {
 }
 /** Any configured caller. The gate's refusal, challenge headers and all, is the answer. */
 export function authorized({ request, baseUrl, opts, runtimeContext }, partitionIdentity = true) {
-    return Effect.suspend(() => admitted(authorize(request, baseUrl, opts.config.auth, runtimeContext, opts.config.identity, partitionIdentity)));
+    return Effect.suspend(() => admitted(authorize(request, baseUrl, opts.config.auth, runtimeContext, partitionIdentity)));
 }
 /** A signed-in person, for a route that changes how a connector authenticates. */
 export function authorizedPerson({ request, baseUrl, opts, runtimeContext }, purpose) {
-    return Effect.suspend(() => admitted(authorizeUiIdentity(request, baseUrl, opts.config.auth, purpose, runtimeContext, opts.config.identity)));
+    return Effect.suspend(() => admitted(authorizeUiIdentity(request, baseUrl, opts.config.auth, purpose, runtimeContext)));
 }
-/** The partition and tool grants an identity carries into a registry view. */
-export function scopeFor(authz, connectorIds = authz.connectorIds) {
+/** The partition an identity carries into a registry view of the given connectors. */
+export function scopeFor(authz, connectorIds = "all") {
     return {
         connectorIds,
-        ...(authz.toolAccess ? { toolAccess: authz.toolAccess } : {}),
-        ...(authz.guardedToolAccess ? { guardedToolAccess: authz.guardedToolAccess } : {}),
         ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
         ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
     };
 }
 /**
- * The registry as this identity may see it. A configured permission naming a
- * connector that does not exist refuses the whole view, management rights
- * included, rather than quietly granting what remains.
+ * The whole registry, for a maintainer only (#837). Everyone else gets the
+ * private 404 plain `/mcp` gives them.
  */
 export function visibleRegistry({ opts }, authz) {
-    return Effect.try({
-        try: () => {
-            validateAuthPermissions(authz, opts.registry);
-            return opts.registry.scoped(scopeFor(authz));
-        },
-        catch: (error) => new Answer(privateJson({ error: msg(error) }, { status: 403 })),
-    });
+    // Operator catalogs describe the default endpoint's view, never a pool view.
+    if (!admitsMaintainer(opts, authz))
+        return refuse("not found", 404);
+    return Effect.succeed(opts.registry.scoped(scopeFor(authz)));
+}
+/**
+ * The connectors a connector-auth route may resolve (#837): every connector
+ * for a maintainer, the connectors of their pools for a pool member, and the
+ * private 404 for anyone else. mayManageConnector still decides each action.
+ */
+export function managementRegistry({ opts }, authz) {
+    if (isMaintainer(opts.maintainers, authz.identity))
+        return Effect.succeed(opts.registry.scoped(scopeFor(authz)));
+    const ids = memberConnectors(opts, authz.identity);
+    if (ids !== "all" && ids.size === 0)
+        return refuse("not found", 404);
+    return Effect.succeed(opts.registry.scoped(scopeFor(authz, ids === "all" ? "all" : [...ids])));
 }
 /**
  * Run one route program to its Response.