@zackbart/connecta 0.8.0 → 0.8.1

package/src/routes/mcp.ts

@@ -7,14 +7,11 @@ import {
   type AdmissionLease,
 } from "../executor-admission.js";
 import { registerMetaTools } from "../meta-tools.js";
-import { ScopedRegistry, type Registry, type RegistryView } from "../registry.js";
+import type { RegistryView } from "../registry.js";
 import { CONNECTA_INSTRUCTIONS } from "../skills.js";
-import { TOOLKIT_NAME_RE, type Toolkit } from "../toolkits.js";
-import type { Logger, ToolkitBinding } from "../types.js";
+import type { Logger } from "../types.js";
 import {
-  MAX_ECHOED_TOOLKIT_NAME,
   authorize,
-  loggableValue,
   type RouteContext,
   type RuntimeExecutionContext,
   type ServerOptions,
@@ -142,167 +139,45 @@ function releaseAdmissionWithResponse(
   });
 }
 
-/** What one MCP connection may see: the full registry, or one toolkit's view. */
-interface McpScope {
-  registry: RegistryView;
-  /** Set only under `?toolkit=`; recorded on activity events. */
-  toolkitId?: string;
-}
-
-/** The one refusal a bound identity ever sees. Constant on purpose — see below. */
-const TOOLKIT_FORBIDDEN_BODY = JSON.stringify({
-  jsonrpc: "2.0",
-  id: null,
-  error: {
-    code: -32600,
-    message:
-      "Not permitted to use the requested toolkit. This credential is bound " +
-      "to a specific toolkit — check the ?toolkit= value in this deployment's " +
-      "MCP endpoint URL with the operator.",
-  },
-});
-
-/**
- * 403 for every binding refusal, with a body that does not depend on WHY.
- *
- * A bound identity asking for a toolkit it may not open, for a toolkit that does
- * not exist, or for no toolkit at all gets byte-identical responses, so a team
- * credential cannot be used to enumerate the org's other teams — the boundary
- * would leak the very structure it exists to hide. The operator log below is
- * where the three cases are told apart.
- */
-function toolkitForbidden(): Response {
-  return new Response(TOOLKIT_FORBIDDEN_BODY, {
-    status: 403,
-    headers: {
-      "Content-Type": "application/json",
-      "Cache-Control": "no-store",
-    },
-  });
-}
-
-/** How a rejected connection is named in the operator log. */
-function identityLabel(actor: ActivityActor): string {
-  return actor.id ? `${actor.kind} ${loggableValue(actor.id)}` : actor.kind;
-}
-
 /**
- * Resolve `?toolkit=<name>` into the registry view this connection may see,
- * enforcing the caller's toolkit binding (documentation/toolkits.md) on the way.
- *
- * For an UNBOUND identity (no binding configured — the pre-#37 shape):
- *
- * - absent → the full registry, byte-identical to a deployment with no toolkits
- * - known → a `ScopedRegistry` over that toolkit (the one visibility boundary)
- * - anything else, including `?toolkit=` with an empty value → an explicit
- *   404. Never a silent fallback to the full registry.
+ * 404 for any `?toolkit=` value, kept after the feature's retirement (#178).
  *
- * For a BOUND identity, membership is checked FIRST and refusal is a flat 403:
- * a toolkit outside the binding, an unknown name, and (without `unscoped`) an
- * omitted `?toolkit=` are all refused before any `ScopedRegistry` is built, and
- * all three produce the same response.
- *
- * Neither error enumerates the configured toolkits: the name selects a scope, so
- * a wrong guess gets a flat refusal, not a directory.
- *
- * Because of that — and because SDK clients treat a 404/403 on the transport
- * endpoint as a transport failure and discard the body — every rejection is also
- * logged operator-side (issue #47), which is the channel that actually reaches a
- * human. The log line may name the configured or bound toolkits; the response
- * still may not.
+ * Toolkits are gone, but the URLs that named them are not: clients were handed
+ * MCP endpoint URLs with `?toolkit=` baked in, and nothing about upgrading the
+ * server rotates them. Silently serving those clients the full registry would
+ * turn a former scoping boundary into fail-open — so a request still sending
+ * the param gets the same explicit 404 an unknown toolkit got before, plus an
+ * operator-side log line, which (as ever — issue #47) is the channel that
+ * actually reaches a human.
  */
-function resolveToolkitScope(
-  url: URL,
-  registry: Registry,
-  toolkits: ReadonlyMap<string, Toolkit> | undefined,
-  logger: Logger,
-  identity: { actor: ActivityActor; binding?: ToolkitBinding },
-):
-  | { ok: true; scope: McpScope }
-  | { ok: false; response: Response } {
-  const requested = url.searchParams.get("toolkit");
-  const binding = identity.binding;
-  const scopeFor = (toolkit: Toolkit) => ({
-    ok: true as const,
-    scope: {
-      registry: new ScopedRegistry(registry, toolkit),
-      toolkitId: toolkit.name,
-    },
-  });
-
-  if (binding) {
-    const who = identityLabel(identity.actor);
-    const bound = `Bound toolkits: ${binding.toolkits.join(", ") || "(none)"}${
-      binding.unscoped ? ", plus unscoped access" : ""
-    }.`;
-    if (requested === null) {
-      if (binding.unscoped) return { ok: true, scope: { registry } };
-      logger.warn(
-        `[connecta] refused an unscoped /mcp connection from ${who} with 403: ` +
-          "its toolkit binding does not allow the full registry. " +
-          bound +
-          " The client sees a transport-level failure and never the reason, so " +
-          "give it an MCP endpoint URL with a ?toolkit= value it is bound to.",
-      );
-      return { ok: false, response: toolkitForbidden() };
-    }
-    const permitted = binding.toolkits.includes(requested);
-    const toolkit = permitted ? toolkits?.get(requested) : undefined;
-    if (toolkit) return scopeFor(toolkit);
-    logger.warn(
-      `[connecta] refused an /mcp connection from ${who} with 403: it asked ` +
-        `for toolkit ${loggableValue(requested)}, which ` +
-        (permitted
-          ? "its binding allows but this deployment does not configure"
-          : "its toolkit binding does not include") +
-        ". " +
-        bound +
-        " The client sees a transport-level failure and never the reason, so " +
-        "check the ?toolkit= value in its MCP endpoint URL.",
-    );
-    return { ok: false, response: toolkitForbidden() };
-  }
-
-  if (requested === null) return { ok: true, scope: { registry } };
-  const toolkit = toolkits?.get(requested);
-  if (toolkit) return scopeFor(toolkit);
-  const configured = toolkits && toolkits.size > 0 ? [...toolkits.keys()] : [];
+function toolkitRetired(logger: Logger): Response {
   logger.warn(
-    "[connecta] rejected an /mcp connection asking for unknown toolkit " +
-      `${loggableValue(requested)} with 404. ` +
-      (configured.length > 0
-        ? `Configured toolkits: ${configured.join(", ")}.`
-        : "This deployment configures no toolkits, so no ?toolkit= value is accepted.") +
-      " The client sees a transport-level failure and never the reason, so " +
-      "check the ?toolkit= value in its MCP endpoint URL.",
+    "[connecta] rejected an /mcp connection carrying ?toolkit= with 404: " +
+      "toolkits were retired in issue #178 (see ethos.md) — one deployment " +
+      "serves one audience. The client sees a transport-level failure and " +
+      "never the reason, so remove the ?toolkit= value from its MCP endpoint " +
+      "URL, or point it at the deployment for its audience.",
   );
-  const label =
-    requested.length <= MAX_ECHOED_TOOLKIT_NAME &&
-    TOOLKIT_NAME_RE.test(requested)
-      ? `"${requested}"`
-      : "requested";
-  return {
-    ok: false,
-    response: new Response(
-      JSON.stringify({
-        jsonrpc: "2.0",
-        id: null,
-        error: {
-          code: -32600,
-          message:
-            `Unknown toolkit ${label}. Check the ?toolkit= value in this ` +
-            "deployment's MCP endpoint URL with the operator.",
-        },
-      }),
-      {
-        status: 404,
-        headers: {
-          "Content-Type": "application/json",
-          "Cache-Control": "no-store",
-        },
+  return new Response(
+    JSON.stringify({
+      jsonrpc: "2.0",
+      id: null,
+      error: {
+        code: -32600,
+        message:
+          "This deployment does not accept ?toolkit=. Toolkits were retired " +
+          "in issue #178 — remove the ?toolkit= value from the MCP endpoint " +
+          "URL, or ask the operator for the deployment serving this audience.",
       },
-    ),
-  };
+    }),
+    {
+      status: 404,
+      headers: {
+        "Content-Type": "application/json",
+        "Cache-Control": "no-store",
+      },
+    },
+  );
 }
 
 async function serveMcp(
@@ -310,7 +185,7 @@ async function serveMcp(
   opts: ServerOptions,
   baseUrl: string,
   actor: ActivityActor,
-  scope: McpScope,
+  registry: RegistryView,
   runtimeContext?: RuntimeExecutionContext,
 ): Promise<Response> {
   // Fresh McpServer + transport per request (SDK ≥1.26 requirement), stateless.
@@ -326,16 +201,12 @@ async function serveMcp(
         ...(opts.activityDeploymentId
           ? { deploymentId: opts.activityDeploymentId }
           : {}),
-        ...(scope.toolkitId ? { toolkitId: scope.toolkitId } : {}),
         ...(runtimeContext?.waitUntil
           ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
           : {}),
         logger: opts.logger,
       }
     : undefined;
-  // `scope.registry` is the connection's VIEW — the full registry, or one
-  // toolkit's ScopedRegistry. Nothing below may reach for `opts.registry`.
-  const registry = scope.registry;
   registerMetaTools(server, registry, {
     baseUrl,
     ...(activity ? { activity } : {}),
@@ -399,10 +270,8 @@ export function createMcpRoute(
     const {
       path,
       request,
-      url,
       baseUrl,
       runtimeContext,
-      sweepCredentials,
     } = context;
     if (path !== "/mcp") return null;
     let admission: AdmissionLease;
@@ -433,9 +302,7 @@ export function createMcpRoute(
       throw error;
     }
     try {
-      // Authenticate BEFORE resolving ?toolkit=: an unauthenticated caller
-      // must not be able to probe which toolkit names exist.
-      const authz = await authorize(request, baseUrl, opts.auth, opts.logger);
+      const authz = await authorize(request, baseUrl, opts.auth);
       if (!authz.ok) {
         return releaseAdmissionWithResponse(
           withMcpCors(authz.response),
@@ -443,26 +310,13 @@ export function createMcpRoute(
           request.signal,
         );
       }
-      const selected = resolveToolkitScope(
-        url,
-        opts.registry,
-        opts.toolkits,
-        opts.logger,
-        {
-          actor: authz.actor,
-          ...(authz.toolkitBinding
-            ? { binding: authz.toolkitBinding }
-            : {}),
-        },
-      );
-      if (!selected.ok) {
+      if (new URL(request.url).searchParams.has("toolkit")) {
         return releaseAdmissionWithResponse(
-          withMcpCors(selected.response),
+          withMcpCors(toolkitRetired(opts.logger)),
           admission,
           request.signal,
         );
       }
-      sweepCredentials();
       return releaseAdmissionWithResponse(
         withMcpCors(
           await serveMcp(
@@ -470,7 +324,7 @@ export function createMcpRoute(
             opts,
             baseUrl,
             authz.actor,
-            selected.scope,
+            opts.registry,
             runtimeContext,
           ),
         ),

package/src/routes/oauth.ts

@@ -30,7 +30,6 @@ async function handleOAuthManagementRequest(
     request,
     baseUrl,
     opts.auth,
-    opts.logger,
     "OAuth management",
   );
   if (!admin.ok) return admin.response;
@@ -61,11 +60,10 @@ async function handleOAuthManagementRequest(
       operationError = error;
     }
 
-    // The old grant and its catalog verdict are invalid after either operation,
+    // The old grant and its cached catalog are invalid after either operation,
     // including a partially failed physical cleanup whose epoch fence succeeded.
     try {
       await opts.registry.invalidateStored(connectorId);
-      await opts.registry.clearCredentialHealth(connectorId);
     } catch (error) {
       operationError ??= error;
     }
@@ -313,10 +311,6 @@ export async function routeOAuthCallback(
   try {
     await connector.finishAuth(code, connectorContext);
     await opts.registry.invalidateStored(id);
-    // Recovery, without a restart: the grant this connector was reported dead
-    // for has just been replaced, so drop the verdict rather than let a stale
-    // `auth_required` survive until the next scheduled check.
-    await opts.registry.clearCredentialHealth(id);
     return html(
       `Connected "${id}". You can close this window.`,
       200,

package/src/routes/shared.ts

@@ -4,13 +4,11 @@ import type { CredentialVault } from "../credentials.js";
 import type { DeferredWork } from "../connector-scope.js";
 import type { AdmissionController } from "../executor-admission.js";
 import type { Registry } from "../registry.js";
-import { resolveIdentityBinding, type Toolkit } from "../toolkits.js";
 import type {
   ConnectaBranding,
   Executor,
   InboundAuth,
   Logger,
-  ToolkitBinding,
 } from "../types.js";
 import { operatorPageForPath } from "../ui.js";
 
@@ -40,11 +38,6 @@ export interface ServerOptions {
   credentialVault?: CredentialVault;
   /** Optional browser UI and OAuth result-page labels. */
   branding?: ConnectaBranding;
-  /**
-   * Validated named scopes, selected per connection with `?toolkit=<name>` on
-   * `/mcp`. Omit (or leave empty) and every connection sees the full registry.
-   */
-  toolkits?: ReadonlyMap<string, Toolkit>;
 }
 
 export interface RuntimeExecutionContext {
@@ -59,7 +52,6 @@ export interface RouteContext {
   opts: ServerOptions;
   defer: DeferredWork | undefined;
   runtimeContext: RuntimeExecutionContext | undefined;
-  sweepCredentials(): void;
 }
 
 export function msg(err: unknown): string {
@@ -80,13 +72,13 @@ export function privateJson(
 const MAX_LOGGED_VALUE_LENGTH = 64;
 
 /**
- * Bounded, escaped form of a caller-influenced value (a rejected toolkit name,
- * identity id, or OAuth callback connector id) for the operator log. Goes
+ * Bounded, escaped form of a caller-influenced value (an identity id or OAuth
+ * callback connector id) for the operator log. Goes
  * through JSON.stringify so a caller-controlled newline or control character
  * cannot forge a log line, plus a hand-rolled escape for U+2028/U+2029, which
  * JSON.stringify leaves raw even though a log reader treats them as line
- * terminators. Truncated to a small shared cap (also the toolkit response's echo
- * limit), so an oversized value cannot flood the log either.
+ * terminators. Truncated to a small shared cap so an oversized value cannot
+ * flood the log either.
  */
 export function loggableValue(requested: string): string {
   const bounded = requested.slice(0, MAX_LOGGED_VALUE_LENGTH);
@@ -97,9 +89,6 @@ export function loggableValue(requested: string): string {
   return escaped + (bounded.length < requested.length ? " (truncated)" : "");
 }
 
-/** Length beyond which a rejected toolkit name is not echoed back. */
-export const MAX_ECHOED_TOOLKIT_NAME = MAX_LOGGED_VALUE_LENGTH;
-
 const ACTIVITY_ACTOR_NAMESPACE_RE = /^[\x21-\x7e]{1,256}$/;
 
 export function activityActorNamespace(
@@ -111,29 +100,16 @@ export function activityActorNamespace(
     : undefined;
 }
 
-/**
- * Refusal for an identity whose toolkit binding cannot be trusted — a malformed
- * declaration, or a malformed per-identity binding out of `authorize`. The
- * caller is authenticated, so this is a 403, and it is deliberately opaque: the
- * cause is an operator bug, and the operator reads it in the log, not the client.
- */
-function unusableBinding(): Response {
-  return privateJson({ error: "forbidden" }, { status: 403 });
-}
-
 export async function authorize(
   request: Request,
   baseUrl: string,
   auth: InboundAuth[],
-  logger: Logger,
 ): Promise<
   | {
       ok: true;
       actor: ActivityActor;
       /** True only when the admitting provider can also authorize UI mutation. */
       uiAdminEligible?: boolean;
-      /** The admitting identity's toolkit binding (documentation/toolkits.md). */
-      toolkitBinding?: ToolkitBinding;
     }
   | { ok: false; response: Response }
 > {
@@ -145,24 +121,6 @@ export async function authorize(
     const result = await provider.authorize(request, baseUrl);
     if (result.ok) {
       const subjectId = result.subjectId ?? result.userId;
-      // Re-validate both halves and cap the per-identity one by the provider's
-      // declaration (see resolveIdentityBinding). A binding that does not
-      // type-check at runtime refuses the request rather than evaporating:
-      // dropping it would hand the caller the full registry, which is the one
-      // outcome a binding exists to prevent.
-      const binding = resolveIdentityBinding(
-        provider.toolkitBinding,
-        result.toolkitBinding,
-      );
-      if (!binding.ok) {
-        logger.warn(
-          `[connecta] refused a request admitted by inbound auth provider ` +
-            `"${provider.kind}" with 403: ${binding.reason}. Until it is fixed ` +
-            "this provider cannot admit anyone, because connecta cannot tell " +
-            "which toolkits the identity may use.",
-        );
-        return { ok: false, response: unusableBinding() };
-      }
       const actorNamespace = activityActorNamespace(provider);
       return {
         ok: true,
@@ -176,7 +134,6 @@ export async function authorize(
         ...(result.userId && provider.uiAuth?.kind === "clerk"
           ? { uiAdminEligible: true }
           : {}),
-        ...(binding.binding ? { toolkitBinding: binding.binding } : {}),
       };
     }
     lastResponse = result.response;
@@ -195,49 +152,20 @@ export async function authorize(
   };
 }
 
-/**
- * True when this identity is confined to one or more toolkits — bound, without
- * `unscoped`. Such a credential belongs to a team's agent, not to the operator
- * running the deployment, so the deployment-wide operator surfaces (`/ui/data`,
- * `/ui/activity`, the credential API) refuse it: their payloads describe every
- * connector in the org, which is exactly what the binding exists to withhold.
- */
-export function isToolkitRestricted(
-  binding: ToolkitBinding | undefined,
-): boolean {
-  return Boolean(binding && !binding.unscoped);
-}
-
-/** The refusal the deployment-wide operator surfaces give a bound identity. */
-export function restrictedOperatorSurface(): Response {
-  return privateJson(
-    {
-      error:
-        "this credential is bound to a toolkit and may not read " +
-        "deployment-wide operator data",
-    },
-    { status: 403 },
-  );
-}
-
 export async function authorizeUiAdmin(
   request: Request,
   baseUrl: string,
   auth: InboundAuth[],
-  logger: Logger,
   purpose = "credential management",
 ): Promise<{ ok: true; userId: string } | { ok: false; response: Response }> {
   // Operator mutation is intentionally narrower than /mcp and /ui/data: only
   // an interactive Clerk provider may admit it. A static bearer token is useful
   // for headless tool calls but must not become a deployment-admin key.
   //
-  // EVERY Clerk provider gets a turn, the way the /mcp gate does, because the
-  // documented per-team pattern is several `clerkAuth(...)`s that differ only in
-  // `gate` and `toolkits` (documentation/toolkits.md). Stopping at the first would make
-  // admission depend on config order: the team-bound provider listed first
-  // would refuse the operator outright, and a refusal here — a failed gate, a
-  // missing user, a toolkit-bound identity — is exactly the case where a later
-  // provider is the one meant to admit. The last refusal is returned if none do.
+  // Every Clerk provider gets a turn, the way the /mcp gate does. Stopping at
+  // the first would make admission depend on config order: a failed gate or
+  // missing user may simply mean a later provider is the one meant to admit.
+  // The last refusal is returned if none do.
   const providers = auth.filter(
     (candidate) => candidate.uiAuth?.kind === "clerk",
   );
@@ -264,24 +192,6 @@ export async function authorizeUiAdmin(
       );
       continue;
     }
-    const binding = resolveIdentityBinding(
-      provider.toolkitBinding,
-      result.toolkitBinding,
-    );
-    if (!binding.ok) {
-      logger.warn(
-        `[connecta] refused an operator-mutation request admitted by inbound auth ` +
-          `provider "${provider.kind}" with 403: ${binding.reason}.`,
-      );
-      lastResponse = unusableBinding();
-      continue;
-    }
-    // A toolkit-bound identity is a team's credential, not a vault admin key:
-    // credentials are deployment-wide, so writing one reaches every toolkit.
-    if (isToolkitRestricted(binding.binding)) {
-      lastResponse = restrictedOperatorSurface();
-      continue;
-    }
     return { ok: true, userId: result.userId };
   }
   return {

package/src/routes/ui.ts

@@ -8,9 +8,7 @@ import {
 } from "../ui.js";
 import {
   authorize,
-  isToolkitRestricted,
   privateJson,
-  restrictedOperatorSurface,
   type RouteContext,
 } from "./shared.js";
 
@@ -54,8 +52,7 @@ function uiScriptNonce(): string {
 export async function routeUi(
   context: RouteContext,
 ): Promise<Response | null> {
-  const { request, url, path, baseUrl, opts, defer, sweepCredentials } =
-    context;
+  const { request, url, path, baseUrl, opts, defer } = context;
   if (request.method === "GET" && path === "/favicon.svg") {
     return new Response(opts.branding?.favicon?.svg ?? CONNECTA_FAVICON_SVG, {
       headers: {
@@ -119,14 +116,8 @@ export async function routeUi(
   }
   if (path !== "/ui/data") return null;
 
-  const authz = await authorize(request, baseUrl, opts.auth, opts.logger);
+  const authz = await authorize(request, baseUrl, opts.auth);
   if (!authz.ok) return authz.response;
-  if (isToolkitRestricted(authz.toolkitBinding)) {
-    return restrictedOperatorSurface();
-  }
-  // After the restriction check, not before: an identity that may not
-  // read this surface should not get to trigger background work from it.
-  sweepCredentials();
   const eligibleClerkOperator = authz.uiAdminEligible === true;
   const credentialManagement = credentialManagementCapability({
     eligibleClerkOperator,
@@ -144,7 +135,6 @@ export async function routeUi(
     eligibleClerkOperator ? opts.credentialVault : undefined,
     Boolean(opts.activity?.list),
     credentialManagement,
-    opts.toolkits,
     defer,
     eligibleClerkOperator,
     opts.discoveryConcurrency,

package/src/server.ts

@@ -29,7 +29,7 @@ export function createFetchHandler(
   request: Request,
   runtimeContext?: RuntimeExecutionContext,
 ) => Promise<Response> {
-  const { registry, auth, publicUrl } = opts;
+  const { auth, publicUrl, registry } = opts;
   const routeMcp = createMcpRoute(opts);
 
   return async function fetch(
@@ -43,35 +43,6 @@ export function createFetchHandler(
       ? runtimeContext.waitUntil.bind(runtimeContext)
       : undefined;
 
-    /**
-     * Piggyback a DUE credential liveness sweep on traffic that has already been
-     * authenticated (issue #24). Started beside the request and never awaited by
-     * it: it must not add latency or change a result, so it is handed to
-     * `ctx.waitUntil` where the runtime has one (Workers, and the Node adapter's
-     * shim) to settle after the response. The registry answers `undefined`
-     * unless a sweep is actually due, so the ordinary request pays nothing.
-     */
-    const sweepCredentials = (): void => {
-      // Belt and braces: a rejected sweep is already absorbed below, and this
-      // catches the synchronous half — arming the gate, or a connector list that
-      // throws while deciding whether anything is due. Nothing about a
-      // background health check may turn a served request into a 500.
-      try {
-        const sweep = registry.sweepCredentialHealthIfDue(baseUrl, defer);
-        if (!sweep) return;
-        const settled = sweep.then(
-          () => {},
-          (err) => {
-            opts.logger.warn("[connecta] credential health sweep failed", err);
-          },
-        );
-        if (defer) defer(settled);
-        else void settled;
-      } catch (err) {
-        opts.logger.warn("[connecta] credential health sweep failed", err);
-      }
-    };
-
     // Container and orchestrator probes reach /health over plain HTTP on
     // loopback, where no proxy has set X-Forwarded-Proto. Redirecting them to
     // the public origin would make an internal liveness check depend on
@@ -113,7 +84,6 @@ export function createFetchHandler(
       opts,
       defer,
       runtimeContext,
-      sweepCredentials,
     };
 
     const route = async (): Promise<Response> => {