madarx 2.15.1 → 2.16.0

package/lib/oauth/flow.js

@@ -0,0 +1,204 @@
+// lib/oauth/flow.js — OAuth2 authorization-code flow primitives.
+//
+// Local-first and provider-agnostic. Three responsibilities:
+//   1. CSRF state — a single-use, server-stored random state value (oauth_states
+//      table). createAuthState() issues one; consumeAuthState() validates +
+//      burns it exactly once. Replay or expiry is rejected.
+//   2. PKCE — S256 code_verifier/code_challenge generation (RFC 7636).
+//   3. Token I/O — exchangeCodeForTokens() and refreshAccessToken(), both taking
+//      an injectable fetchFn so tests use a mock and never hit a live provider.
+//
+// SECURITY: this module never persists access/refresh tokens — that is the
+// caller's job (the vault, via setSecret). The state ledger stores only the PKCE
+// verifier and non-secret scope metadata. Tokens never appear in audit/log here.
+
+import { createHash, randomBytes } from 'node:crypto';
+import { getDb, nowIso } from '../db.js';
+
+const DEFAULT_TTL_MS = 10 * 60 * 1000; // 10 minutes
+
+function base64url(buf) {
+  return Buffer.from(buf).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+/** Generate a PKCE verifier + S256 challenge pair. */
+export function generatePkce() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash('sha256').update(verifier).digest());
+  return { code_verifier: verifier, code_challenge: challenge, code_challenge_method: 'S256' };
+}
+
+/**
+ * Issue a single-use state value and persist it (with the PKCE verifier and
+ * scope metadata) so the callback can validate the round-trip.
+ *
+ * @returns {{ state, code_verifier?, code_challenge?, code_challenge_method? }}
+ */
+export function createAuthState({ service_key, provider, scope = null, redirect_uri = null, pkce = false, ttl_ms = DEFAULT_TTL_MS } = {}) {
+  if (!service_key) throw new Error('service_key is required');
+  const db = getDb();
+  const state = base64url(randomBytes(24));
+  const now = Date.now();
+  const created_at = nowIso();
+  const expires_at = new Date(now + (Number(ttl_ms) || DEFAULT_TTL_MS)).toISOString();
+
+  let pkceParts = null;
+  if (pkce) pkceParts = generatePkce();
+
+  db.prepare(`
+    INSERT INTO oauth_states (state, service_key, provider, scope_json, code_verifier, redirect_uri, created_at, expires_at, consumed_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)
+  `).run(
+    state,
+    String(service_key),
+    String(provider || 'custom'),
+    scope ? JSON.stringify(scope) : null,
+    pkceParts?.code_verifier || null,
+    redirect_uri || null,
+    created_at,
+    expires_at,
+  );
+
+  return {
+    state,
+    code_verifier: pkceParts?.code_verifier || null,
+    code_challenge: pkceParts?.code_challenge || null,
+    code_challenge_method: pkceParts?.code_challenge_method || null,
+  };
+}
+
+/**
+ * Validate + burn a state value. Returns the stored row (scope + verifier) on
+ * success, or throws. Single-use: a second call with the same state fails.
+ */
+export function consumeAuthState(state) {
+  if (!state) { const e = new Error('missing state'); e.code = 'state_invalid'; throw e; }
+  const db = getDb();
+  const row = db.prepare('SELECT * FROM oauth_states WHERE state = ?').get(String(state));
+  if (!row) { const e = new Error('unknown or already-consumed state'); e.code = 'state_invalid'; throw e; }
+  if (row.consumed_at) { const e = new Error('state already used'); e.code = 'state_replayed'; throw e; }
+  if (row.expires_at && Date.parse(row.expires_at) < Date.now()) {
+    const e = new Error('state expired'); e.code = 'state_expired'; throw e;
+  }
+  // Burn it. The WHERE clause guards against a concurrent double-consume.
+  const res = db.prepare('UPDATE oauth_states SET consumed_at = ? WHERE state = ? AND consumed_at IS NULL')
+    .run(nowIso(), String(state));
+  if (res.changes !== 1) { const e = new Error('state already used'); e.code = 'state_replayed'; throw e; }
+
+  let scope = null;
+  try { scope = row.scope_json ? JSON.parse(row.scope_json) : null; } catch { scope = null; }
+  return {
+    state: row.state,
+    service_key: row.service_key,
+    provider: row.provider,
+    scope,
+    code_verifier: row.code_verifier || null,
+    redirect_uri: row.redirect_uri || null,
+  };
+}
+
+/**
+ * Build the provider authorize URL the "Sign in with…" button redirects to.
+ *
+ * @param {object} provider  resolved provider (resolveProvider output)
+ * @param {object} opts      { client_id, redirect_uri, state, code_challenge }
+ */
+export function buildAuthorizeUrl(provider, opts = {}) {
+  if (!provider?.authorize_url) throw new Error('provider.authorize_url required');
+  if (!opts.client_id) throw new Error('client_id required');
+  if (!opts.redirect_uri) throw new Error('redirect_uri required');
+  const url = new URL(provider.authorize_url);
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('client_id', String(opts.client_id));
+  url.searchParams.set('redirect_uri', String(opts.redirect_uri));
+  if (provider.scopes?.length) url.searchParams.set('scope', provider.scopes.join(' '));
+  if (opts.state) url.searchParams.set('state', String(opts.state));
+  if (provider.pkce && opts.code_challenge) {
+    url.searchParams.set('code_challenge', String(opts.code_challenge));
+    url.searchParams.set('code_challenge_method', 'S256');
+  }
+  for (const [k, v] of Object.entries(provider.extra_auth_params || {})) {
+    if (v != null) url.searchParams.set(k, String(v));
+  }
+  return url.toString();
+}
+
+function parseTokenResponse(data) {
+  if (!data || typeof data !== 'object') return null;
+  const access_token = data.access_token || null;
+  if (!access_token) return null;
+  return {
+    access_token,
+    refresh_token: data.refresh_token || null,
+    token_type: data.token_type || 'Bearer',
+    expires_in: Number.isFinite(data.expires_in) ? data.expires_in : null,
+    scope: data.scope || null,
+  };
+}
+
+async function postForm(tokenUrl, params, fetchFn) {
+  const body = new URLSearchParams(params).toString();
+  const res = await fetchFn(tokenUrl, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+    body,
+  });
+  let data = null;
+  try { data = await res.json(); } catch { data = null; }
+  return { res, data };
+}
+
+/**
+ * Exchange an authorization code for tokens.
+ *
+ * @param {object} provider  resolved provider config (needs token_url)
+ * @param {object} opts      { code, client_id, client_secret, redirect_uri, code_verifier }
+ * @param {Function} fetchFn injectable fetch (tests pass a mock)
+ */
+export async function exchangeCodeForTokens(provider, opts = {}, fetchFn = fetch) {
+  if (!provider?.token_url) throw new Error('provider.token_url required');
+  if (!opts.code) throw new Error('code required');
+  const params = {
+    grant_type: 'authorization_code',
+    code: opts.code,
+    client_id: opts.client_id || '',
+    redirect_uri: opts.redirect_uri || '',
+  };
+  if (opts.client_secret) params.client_secret = opts.client_secret;
+  if (opts.code_verifier) params.code_verifier = opts.code_verifier;
+
+  const { res, data } = await postForm(provider.token_url, params, fetchFn);
+  if (!res.ok) {
+    return { ok: false, error: 'token_exchange_failed', http_status: res.status, detail: data?.error || null };
+  }
+  const tokens = parseTokenResponse(data);
+  if (!tokens) return { ok: false, error: 'no_access_token' };
+  return { ok: true, ...tokens };
+}
+
+/**
+ * Re-mint an access token from a refresh token. Used by http_api_call on a 401.
+ *
+ * @param {object} provider  resolved provider config (needs token_url)
+ * @param {object} opts      { refresh_token, client_id, client_secret }
+ * @param {Function} fetchFn injectable fetch
+ */
+export async function refreshAccessToken(provider, opts = {}, fetchFn = fetch) {
+  if (!provider?.token_url) throw new Error('provider.token_url required');
+  if (!opts.refresh_token) throw new Error('refresh_token required');
+  const params = {
+    grant_type: 'refresh_token',
+    refresh_token: opts.refresh_token,
+    client_id: opts.client_id || '',
+  };
+  if (opts.client_secret) params.client_secret = opts.client_secret;
+
+  const { res, data } = await postForm(provider.token_url, params, fetchFn);
+  if (!res.ok) {
+    return { ok: false, error: 'refresh_failed', http_status: res.status, detail: data?.error || null };
+  }
+  const tokens = parseTokenResponse(data);
+  if (!tokens) return { ok: false, error: 'no_access_token' };
+  // Providers often omit a new refresh_token on refresh — keep the old one.
+  return { ok: true, ...tokens, refresh_token: tokens.refresh_token || opts.refresh_token };
+}

package/lib/oauth/provider-registry.js

@@ -0,0 +1,102 @@
+// lib/oauth/provider-registry.js — declarative OAuth2 provider catalog.
+//
+// Each provider is INERT DATA: authorize/token endpoints, default scopes, and
+// whether PKCE is used. NO secrets live here — client id/secret are supplied by
+// the operator once (per connection) and referenced from the vault by name.
+//
+// This registry is the single source of truth for "how do I talk to provider X's
+// OAuth endpoints". A connection manifest's `oauth.provider` keys into it; the
+// manifest may also override authorize_url/token_url/scopes inline so Tool-Smith
+// connectors for not-yet-catalogued providers still work without editing code.
+//
+// Pure ESM — no DB, fs, or network imports.
+
+const PROVIDERS = {
+  google: {
+    label: 'Google',
+    authorize_url: 'https://accounts.google.com/o/oauth2/v2/auth',
+    token_url: 'https://oauth2.googleapis.com/token',
+    pkce: true,
+    // Default to read-only mail+calendar scopes; connections add what they need.
+    default_scopes: ['openid', 'email'],
+    // Google requires these to mint a refresh token.
+    extra_auth_params: { access_type: 'offline', prompt: 'consent' },
+  },
+  meta: {
+    label: 'Meta (Facebook/Instagram)',
+    authorize_url: 'https://www.facebook.com/v19.0/dialog/oauth',
+    token_url: 'https://graph.facebook.com/v19.0/oauth/access_token',
+    pkce: false,
+    default_scopes: ['public_profile'],
+    extra_auth_params: {},
+  },
+  linkedin: {
+    label: 'LinkedIn',
+    authorize_url: 'https://www.linkedin.com/oauth/v2/authorization',
+    token_url: 'https://www.linkedin.com/oauth/v2/accessToken',
+    pkce: false,
+    default_scopes: ['r_liteprofile'],
+    extra_auth_params: {},
+  },
+  tiktok: {
+    label: 'TikTok',
+    authorize_url: 'https://www.tiktok.com/v2/auth/authorize/',
+    token_url: 'https://open.tiktokapis.com/v2/oauth/token/',
+    pkce: true,
+    default_scopes: ['user.info.basic'],
+    extra_auth_params: {},
+  },
+  hubspot: {
+    label: 'HubSpot',
+    authorize_url: 'https://app.hubspot.com/oauth/authorize',
+    token_url: 'https://api.hubapi.com/oauth/v1/token',
+    pkce: false,
+    default_scopes: ['oauth'],
+    extra_auth_params: {},
+  },
+};
+
+/**
+ * Resolve a provider config, layering manifest-supplied overrides on top of the
+ * built-in catalog. Either source may be absent: a fully-inline connection
+ * manifest needs no catalog entry; a catalogued provider needs no inline URLs.
+ *
+ * @param {string} providerKey         e.g. 'google'
+ * @param {object} [overrides]         connection.oauth block (authorize_url, token_url, scopes, pkce, extra_auth_params)
+ * @returns {object|null}              normalized provider config, or null if unresolvable
+ */
+export function resolveProvider(providerKey, overrides = {}) {
+  const base = providerKey && PROVIDERS[providerKey] ? PROVIDERS[providerKey] : null;
+  const authorize_url = overrides.authorize_url || base?.authorize_url || null;
+  const token_url = overrides.token_url || base?.token_url || null;
+  if (!authorize_url || !token_url) return null;
+
+  const scopes = Array.isArray(overrides.scopes) && overrides.scopes.length
+    ? overrides.scopes.slice()
+    : (base?.default_scopes || []).slice();
+
+  const pkce = typeof overrides.pkce === 'boolean' ? overrides.pkce : Boolean(base?.pkce);
+
+  const extra_auth_params = {
+    ...(base?.extra_auth_params || {}),
+    ...(overrides.extra_auth_params && typeof overrides.extra_auth_params === 'object'
+      ? overrides.extra_auth_params
+      : {}),
+  };
+
+  return {
+    provider: providerKey || 'custom',
+    label: base?.label || providerKey || 'Custom provider',
+    authorize_url,
+    token_url,
+    scopes,
+    pkce,
+    extra_auth_params,
+  };
+}
+
+export function listProviders() {
+  return Object.entries(PROVIDERS).map(([key, p]) => ({ provider: key, label: p.label, pkce: p.pkce }));
+}
+
+export { PROVIDERS };

package/lib/runtime.js

@@ -12,7 +12,7 @@ import { listApprovalRequests } from './approvals.js';
 import { defaultModelForEngine, normalizeAgentEngine } from './agent-engines.js';
 import { DEFAULT_PROJECT_ID, appendProjectChangelog, getProject } from './projects.js';
 import { listActivity, listTasks, reportingSnapshot } from './delegation.js';
-import { getMainAgentTrustMode } from './tools/registry.js';
+import { getMainAgentTrustMode, listMarketplaceTools } from './tools/registry.js';
 import { defaultSkillsMarkdown } from './marketplace-seeds.js';
 import { getConfig } from './config.js';
 import { publishLiveEvent, publishStateChanged } from './live-events.js';
@@ -154,6 +154,79 @@ export function setAgentToolPermission(agentId, toolName, mode = 'approval_requi
   return rowToAgentToolPermission(db.prepare('SELECT * FROM agent_tool_permissions WHERE agent_id = ? AND tool_name = ?').get(agentId, toolName));
 }
 
+/**
+ * Set an agent's declared toolset from the simple agent page.
+ *
+ * Two sources of truth are kept in sync:
+ *  - `agents.tools` (JSON list) drives the runner prompt and the /agents card
+ *    icons — it is the agent's *declared* toolset.
+ *  - `agent_tool_permissions` is the *enforcement* layer the runtime actually
+ *    gates on. Newly added tools get a safe default mode (read-only → auto,
+ *    anything that can write/send → approval_required), matching the Caretaker
+ *    seeding convention. Existing non-disabled rows are left untouched so the
+ *    deep per-tool modes set in Configuration survive a simple-page edit.
+ *
+ * Unknown tool names are dropped (a stale form can't poison the toolset).
+ * Workspace files are intentionally NOT rewritten here — writeAgentFiles would
+ * regenerate skills.md from defaults and clobber an owner's edits.
+ */
+export function updateAgentToolset(agentId, toolNames = []) {
+  if (!agentId) return { ok: false, error: 'agent_id is required' };
+  const db = getDb();
+  const agentRow = db.prepare('SELECT id, tools FROM agents WHERE id = ?').get(agentId);
+  if (!agentRow) return { ok: false, error: 'agent not found' };
+
+  const known = new Map(listMarketplaceTools().map(tool => [tool.name, tool]));
+  const next = [...new Set(
+    (Array.isArray(toolNames) ? toolNames : [])
+      .map(name => String(name || '').trim())
+      .filter(name => name && known.has(name))
+  )];
+  const desired = new Set(next);
+
+  // Reconcile against the enforcement layer (permission rows), NOT just the
+  // declared `agents.tools` column — agents created via createAgent carry a
+  // tools list but no permission rows, so a pure column diff would leave newly
+  // "kept" tools non-functional.
+  const existing = listAgentToolPermissions(agentId);
+  const existingMode = new Map(existing.map(p => [p.tool_name, p.mode]));
+  const prevEnabled = new Set(existing.filter(p => p.mode !== 'disabled').map(p => p.tool_name));
+
+  // 1) Declared toolset (drives the runner prompt + the /agents card icons).
+  db.prepare('UPDATE agents SET tools = ? WHERE id = ?').run(JSON.stringify(next), agentId);
+
+  // 2) Enable every desired tool. Existing non-disabled rows are left untouched
+  //    so deep per-tool modes set in Configuration survive a simple-page edit;
+  //    new or previously-disabled tools get a safe default (read-only → auto,
+  //    anything that can write/send → approval_required).
+  for (const name of next) {
+    const cur = existingMode.get(name);
+    if (cur && cur !== 'disabled') continue;
+    const tool = known.get(name);
+    const mode = (tool?.risk_level === 'low' || tool?.approval_mode === 'auto')
+      ? 'auto'
+      : 'approval_required';
+    setAgentToolPermission(agentId, name, mode);
+  }
+  // 3) Disable previously-enabled tools the owner removed.
+  for (const p of existing) {
+    if (p.mode !== 'disabled' && !desired.has(p.tool_name)) {
+      setAgentToolPermission(agentId, p.tool_name, 'disabled');
+    }
+  }
+
+  const added = next.filter(name => !prevEnabled.has(name));
+  const removed = [...prevEnabled].filter(name => !desired.has(name));
+
+  appendAudit({
+    type: 'agent.tools.update',
+    summary: `Updated toolset for ${agentId}`,
+    status: 'complete',
+    meta: { agent_id: agentId, added, removed, count: next.length, surface: 'agent-detail-simple' },
+  });
+  return { ok: true, tools: next, added, removed };
+}
+
 export function ensureOpsAgent({ silent = false } = {}) {
   const tools = ['directory_list', 'file_read', 'file_search', 'terminal_run', 'web_search', 'web_fetch'];
   const created = createAgent({

package/lib/schema.js

@@ -1555,6 +1555,23 @@ CREATE TABLE IF NOT EXISTS tool_proposals (
 );
 CREATE INDEX IF NOT EXISTS idx_tool_proposals_status ON tool_proposals(status);
 
+-- OAuth2 authorization-code state ledger. Single-use CSRF state values for the
+-- connection OAuth flow. A row is created at /oauth/start and consumed exactly
+-- once at /oauth/callback (consumed_at set). Replay of a consumed/expired state
+-- is rejected. code_verifier holds the PKCE verifier (never the access token).
+CREATE TABLE IF NOT EXISTS oauth_states (
+  state          TEXT PRIMARY KEY,
+  service_key    TEXT NOT NULL,
+  provider       TEXT NOT NULL,
+  scope_json     TEXT,
+  code_verifier  TEXT,
+  redirect_uri   TEXT,
+  created_at     TEXT NOT NULL,
+  expires_at     TEXT NOT NULL,
+  consumed_at    TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_oauth_states_service ON oauth_states(service_key);
+
 
 `;
 

package/lib/tools/adapters/http-api-call.js

@@ -14,10 +14,12 @@
 // Risk + approval gating happen UPSTREAM in executeRegistryTool on the endpoint's
 // declared (clamped) risk tier before this adapter is ever called.
 
-import { getSecret } from '../../secrets.js';
+import { getSecret, setSecret } from '../../secrets.js';
 import { wrapFetch } from '../../egress.js';
 import { assertPublicHttpUrl } from './web.js';
 import { resolveConnectorEndpoint } from '../connectors/registry.js';
+import { resolveProvider } from '../../oauth/provider-registry.js';
+import { refreshAccessToken } from '../../oauth/flow.js';
 
 const MAX_RESPONSE_BYTES = 512000;
 const RESERVED_KEYS = new Set(['__connector_slug', '__endpoint', 'approval_id', 'body', 'query']);
@@ -59,11 +61,50 @@ function buildAuth(auth = {}) {
     const user = need(auth.username_ref);
     const pass = need(auth.password_ref);
     headers.Authorization = `Basic ${Buffer.from(`${user}:${pass}`).toString('base64')}`;
+  } else if (auth.type === 'oauth2') {
+    const secret = need(auth.access_token_ref);
+    headers[auth.header || 'Authorization'] = `${auth.prefix ?? 'Bearer '}${secret}`;
   }
   // type 'none' → no injection.
   return { headers, query };
 }
 
+/**
+ * Attempt a single OAuth2 access-token refresh for an oauth2 connector, re-storing
+ * the new token in the vault. Returns true on success. Best-effort: any missing
+ * refresh material or provider config means "no refresh" (returns false). The
+ * minted token is never logged or returned to the caller.
+ */
+async function tryRefreshOauthToken(auth, fetchFn) {
+  if (auth?.type !== 'oauth2' || !auth.refresh_token_ref) return false;
+  const refreshToken = getSecret(auth.refresh_token_ref);
+  if (!refreshToken) return false;
+  const provider = resolveProvider(auth.provider, { token_url: auth.token_url });
+  if (!provider?.token_url) return false;
+  const clientId = auth.client_id_ref ? getSecret(auth.client_id_ref) : null;
+  const clientSecret = auth.client_secret_ref ? getSecret(auth.client_secret_ref) : null;
+  let result;
+  try {
+    result = await refreshAccessToken(
+      provider,
+      { refresh_token: String(refreshToken), client_id: clientId || '', client_secret: clientSecret || '' },
+      fetchFn,
+    );
+  } catch {
+    return false;
+  }
+  if (!result?.ok || !result.access_token) return false;
+  try {
+    setSecret(auth.access_token_ref, result.access_token, { source: 'oauth_refresh' });
+    if (result.refresh_token && auth.refresh_token_ref) {
+      setSecret(auth.refresh_token_ref, result.refresh_token, { source: 'oauth_refresh' });
+    }
+  } catch {
+    return false;
+  }
+  return true;
+}
+
 export async function httpApiCall(input = {}, options = {}) {
   const connectorSlug = input.__connector_slug;
   const endpointName = input.__endpoint;
@@ -128,7 +169,7 @@ export async function httpApiCall(input = {}, options = {}) {
   // baseHeaders never carry the secret; authHeaderKeys are injected only when the
   // target host matches the original (auth must never ride a cross-host redirect).
   const baseHeaders = { Accept: 'application/json', ...(manifest.default_headers || {}) };
-  const authHeaderKeys = Object.keys(authParts.headers);
+  let authHeaderKeys = Object.keys(authParts.headers);
   const method = endpointDef.method;
   const hasBody = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method);
   let bodyStr = null;
@@ -170,35 +211,58 @@ export async function httpApiCall(input = {}, options = {}) {
   // allowlist before the next request; a redirect outside the allowlist is refused.
   const wrappedFetch = wrapFetch(toolName, options.agent_id ?? null);
   const REDIRECT_CODES = new Set([301, 302, 303, 307, 308]);
-  let currentUrl = url;
   let res;
-  for (let hop = 0; hop < 5; hop++) {
-    try {
-      res = await wrappedFetch(currentUrl, buildInit(currentUrl.hostname.toLowerCase()));
-    } catch (err) {
-      return { ok: false, status: 'error', error: 'request_failed', message: String(err?.message || err) };
-    }
-    if (!REDIRECT_CODES.has(res.status)) break;
-    const loc = res.headers.get('location');
-    if (!loc) break; // 3xx with no Location — return it as-is below.
-    let next;
-    try {
-      next = new URL(loc, currentUrl);
-    } catch {
-      return { ok: false, status: 'error', error: 'bad_redirect', message: `Invalid redirect target: ${loc}` };
-    }
-    try {
-      assertPublicHttpUrl(next.toString());
-    } catch (err) {
-      return { ok: false, status: 'error', error: 'blocked_redirect', message: `Redirect blocked: ${err.message}` };
-    }
-    if (!manifest.allowed_hosts.includes(next.hostname.toLowerCase())) {
-      return { ok: false, status: 'error', error: 'blocked_redirect', message: `Redirect to ${next.hostname} is not in the connector allowlist` };
+  // Outer loop allows a SINGLE OAuth2 refresh-on-401 retry. attempt 0 is the
+  // normal call; attempt 1 only runs after a successful token refresh.
+  for (let attempt = 0; attempt < 2; attempt++) {
+    let currentUrl = url;
+    let redirectError = null;
+    for (let hop = 0; hop < 5; hop++) {
+      try {
+        res = await wrappedFetch(currentUrl, buildInit(currentUrl.hostname.toLowerCase()));
+      } catch (err) {
+        return { ok: false, status: 'error', error: 'request_failed', message: String(err?.message || err) };
+      }
+      if (!REDIRECT_CODES.has(res.status)) break;
+      const loc = res.headers.get('location');
+      if (!loc) break; // 3xx with no Location — return it as-is below.
+      let next;
+      try {
+        next = new URL(loc, currentUrl);
+      } catch {
+        return { ok: false, status: 'error', error: 'bad_redirect', message: `Invalid redirect target: ${loc}` };
+      }
+      try {
+        assertPublicHttpUrl(next.toString());
+      } catch (err) {
+        return { ok: false, status: 'error', error: 'blocked_redirect', message: `Redirect blocked: ${err.message}` };
+      }
+      if (!manifest.allowed_hosts.includes(next.hostname.toLowerCase())) {
+        return { ok: false, status: 'error', error: 'blocked_redirect', message: `Redirect to ${next.hostname} is not in the connector allowlist` };
+      }
+      currentUrl = next;
+      if (hop === 4) {
+        redirectError = { ok: false, status: 'error', error: 'too_many_redirects', message: 'Exceeded redirect limit' };
+        break;
+      }
     }
-    currentUrl = next;
-    if (hop === 4) {
-      return { ok: false, status: 'error', error: 'too_many_redirects', message: 'Exceeded redirect limit' };
+    if (redirectError) return redirectError;
+
+    // OAuth2 transparent refresh: on a 401, attempt exactly one token refresh,
+    // re-store the new token, rebuild auth headers, and retry once.
+    if (attempt === 0 && res.status === 401 && (manifest.auth || {}).type === 'oauth2') {
+      const refreshed = await tryRefreshOauthToken(manifest.auth, wrappedFetch);
+      if (refreshed) {
+        try {
+          authParts = buildAuth(manifest.auth || {});
+          authHeaderKeys = Object.keys(authParts.headers);
+        } catch {
+          break; // can't rebuild auth — return the 401 as-is.
+        }
+        continue; // retry with the fresh token.
+      }
     }
+    break;
   }
 
   const respContentType = res.headers.get('content-type') || '';

package/lib/tools/connectors/connector-validator.js

@@ -37,7 +37,7 @@
 
 export const CONNECTOR_SLUG_REGEX = /^[a-z][a-z0-9-]{2,63}$/;
 export const MAX_CONNECTOR_BYTES = 64 * 1024;
-export const VALID_AUTH_TYPES = new Set(['bearer', 'api_key', 'basic', 'none']);
+export const VALID_AUTH_TYPES = new Set(['bearer', 'api_key', 'basic', 'oauth2', 'none']);
 
 // Ordered low→high. 'blocked' is never authorable and is intentionally absent.
 export const RISK_ORDER = ['low', 'medium', 'high', 'irreversible_external'];
@@ -53,6 +53,8 @@ const MAX_ENDPOINTS = 50;
 // comparison is applied at runtime).
 const RAW_SECRET_KEYS = new Set([
   'token', 'key', 'secret', 'password', 'value', 'api_key', 'bearer', 'credentials',
+  // oauth2 raw-token names — must be referenced via *_ref, never inline.
+  'access_token', 'refresh_token', 'client_id', 'client_secret',
 ]);
 
 // ─── Internal helpers ────────────────────────────────────────────────────────
@@ -171,6 +173,27 @@ function validateAuth(auth, errors) {
       pushErr(errors, 'auth.password_ref', `must match ${SECRET_REF_REGEX}`);
     }
   }
+
+  if (type === 'oauth2') {
+    // The access token is referenced from the vault, never inline. Refresh fields
+    // are optional (a connector can carry a long-lived token with no refresh).
+    if (!auth.access_token_ref || typeof auth.access_token_ref !== 'string') {
+      pushErr(errors, 'auth.access_token_ref', 'required for oauth2 auth (vault ref)');
+    } else if (!SECRET_REF_REGEX.test(auth.access_token_ref)) {
+      pushErr(errors, 'auth.access_token_ref', `must match ${SECRET_REF_REGEX}`);
+    }
+    for (const field of ['refresh_token_ref', 'client_id_ref', 'client_secret_ref']) {
+      if (auth[field] == null) continue;
+      if (typeof auth[field] !== 'string' || !SECRET_REF_REGEX.test(auth[field])) {
+        pushErr(errors, `auth.${field}`, `must match ${SECRET_REF_REGEX}`);
+      }
+    }
+    if (auth.token_url != null) {
+      let ok = false;
+      try { ok = new URL(auth.token_url).protocol === 'https:'; } catch { ok = false; }
+      if (!ok) pushErr(errors, 'auth.token_url', 'must be a valid https URL');
+    }
+  }
 }
 
 function validateDefaultHeaders(headers, errors) {
@@ -417,6 +440,9 @@ export function validateConnectorManifest(manifest, opts = {}) {
   const allowedAuthKeys = new Set([
     'type', 'header', 'prefix', 'query_param',
     'secret_ref', 'username_ref', 'password_ref',
+    // oauth2: token reference + refresh material (all *_ref, never raw)
+    'access_token_ref', 'refresh_token_ref', 'client_id_ref', 'client_secret_ref',
+    'token_url', 'provider',
   ]);
   for (const [k, v] of Object.entries(manifest.auth)) {
     if (allowedAuthKeys.has(k)) normalizedAuth[k] = v;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "madarx",
-  "version": "2.15.1",
+  "version": "2.16.0",
   "type": "module",
   "description": "Madarx OS — Next.js product with SQLite-backed runtime, scheduled cron daemon, and approval-gated local runners.",
   "license": "MIT",