mcp-google-multi 6.0.0-beta.2 → 6.0.0-beta.3

package/dist/http-transport.js

@@ -5,10 +5,35 @@ import { NodeStreamableHTTPServerTransport } from "@modelcontextprotocol/node";
 // loopback-owner authenticator so the local-HTTP model works before the AS lands.
 import { createServer } from 'node:http';
 import { withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
+import { logSafe } from './trim.js';
+// A host wrapping the log callbacks it hands core needs this, and trim has no package export.
+export { logSafe } from './trim.js';
 // A hung handler that keeps the connection open would otherwise hold the global
 // serialize() lock forever. Generous by default so slow-but-valid calls (large
 // Drive exports, fan-out) still finish; the point is only to guarantee release.
 const DISPATCH_TIMEOUT_DEFAULT = 120_000;
+/** MCP 2025-06-18 dropped JSON-RPC batching, and the SDK screens every frame
+ * of a batch synchronously in one tick: without a cap one body multiplies the
+ * per-call work by however many frames fit in it. */
+const MAX_BATCH_FRAMES = 16;
+// A resolveServer refusal's body reaches the wire verbatim (H3 PR1): validated
+// so a host cannot accidentally leak an operator path/env var through a wrongly
+// shaped slug or an overlong message. No new slug literal enters core itself —
+// the slug is always the host's own value.
+const REFUSAL_SLUG_RE = /^[a-z][a-z0-9_]{0,39}$/;
+const MAX_REFUSAL_MESSAGE_CHARS = 300;
+// C0/C1 controls, format chars (includes bidi overrides like U+202E and
+// zero-width joiners) and the line/paragraph separators; ordinary non-ASCII
+// letters stay allowed.
+const NON_PRINTABLE_RE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+function isValidRefusal(r) {
+    return (typeof r.error === 'string' &&
+        REFUSAL_SLUG_RE.test(r.error) &&
+        typeof r.message === 'string' &&
+        r.message.length > 0 &&
+        r.message.length <= MAX_REFUSAL_MESSAGE_CHARS &&
+        !NON_PRINTABLE_RE.test(r.message));
+}
 export function parseOwnerEmails(env = process.env) {
     return (env.MCP_OWNER_EMAILS ?? '')
         .split(',')
@@ -33,28 +58,100 @@ export function hostAllowed(host, allowed) {
     const bare = host.replace(/:\d+$/, '');
     return allowed.includes(host) || allowed.includes(bare);
 }
-/** JSON-RPC method name(s) for an observability log line — no params, no PII. */
+const METHOD_NAME = /^[A-Za-z0-9_./$-]{1,64}$/;
+const BATCH_METHODS_SHOWN = 4;
+/** JSON-RPC method name(s) for an observability log line: no params, no PII.
+ * The method is the caller's: anything not shaped like a method name, which
+ * includes a value whose String() throws, is logged as `<invalid>`. */
 export function jsonRpcMethod(body) {
-    const one = (b) => b && typeof b === 'object' && 'method' in b ? String(b.method) : undefined;
-    if (Array.isArray(body))
-        return body.map(one).filter(Boolean).join(',') || 'batch';
-    return one(body) ?? 'unknown';
+    const one = (b) => {
+        if (!b || typeof b !== 'object' || !('method' in b))
+            return undefined;
+        const m = b.method;
+        return typeof m === 'string' && METHOD_NAME.test(m) ? m : '<invalid>';
+    };
+    if (!Array.isArray(body))
+        return one(body) ?? 'unknown';
+    const names = body.map(one).filter((n) => n !== undefined);
+    if (names.length === 0)
+        return 'batch';
+    const rest = names.length - BATCH_METHODS_SHOWN;
+    return rest > 0 ? `${names.slice(0, BATCH_METHODS_SHOWN).join(',')},+${rest}` : names.join(',');
+}
+/** setTimeout fires at once for a delay above this, so a longer grace would
+ * cut every connection immediately. */
+const MAX_GRACE_MS = 2 ** 31 - 1;
+// A lingering close: a socket destroyed while its client is still sending (a
+// body pipelined after the close) is reset by the kernel, which drops whatever
+// of the last response is still unsent. So the socket only ends its side and
+// waits for the client's FIN, or for the grace to end.
+function endAfterFlush(socket) {
+    if (socket.destroyed || socket.writableEnded)
+        return;
+    // Node arms a keep-alive timer when a response finishes and destroys the
+    // socket when it fires, which would cut a slow reader's unread tail just as
+    // an early destroy does. Only the client's FIN or the grace ends it now.
+    socket.setTimeout(0);
+    socket.end();
+}
+// A request that arrives while closing is never answered, so Node keeps it
+// until the socket closes, and a flood pipelined behind a held response would
+// pile up without limit. Reading stops for good instead, which lets TCP flow
+// control stop the client. Node resumes a socket after every parsed request
+// and on drain, so resume becomes a no-op. Such a socket never sees the
+// client's FIN either: the grace ends it.
+function stopReading(socket) {
+    socket.pause();
+    socket.resume = () => socket;
+}
+// For a log line: the pathname only (a query can carry a code or a state),
+// and never a throw, since the caller is the catch-all.
+function pathOf(req) {
+    try {
+        return new URL(req.url ?? '/', 'http://localhost').pathname;
+    }
+    catch {
+        return '?';
+    }
 }
 export class HttpTransportHost {
     opts;
     httpServer;
-    // Serialize the connect→dispatch critical section: the shared McpServer
+    // Serialize the connect→dispatch critical section PER SERVER: a McpServer
     // captures its transport per request (protocol.js), but the gap between
     // connect() and the dispatch capturing it would still race under true
-    // concurrency. Single-owner HTTP traffic is effectively serial, so a mutex
-    // keeps correctness at negligible cost (and never rebuilds the registry).
-    lock = Promise.resolve();
+    // concurrency, so all traffic to ONE server runs under one mutex. The free
+    // core has one lane (the boot server); with resolveServer each resolved
+    // server gets its own, however subjects map onto servers.
+    locks = new Map();
+    // Requests holding a lane slot, per server; used only with maxQueuedPerLane.
+    depth = new Map();
+    // What a graceful close waits on: open sockets, per socket the requests it
+    // has accepted whose response has not settled and the last of them, and
+    // every handle() that has not settled.
+    sockets = new Set();
+    pending = new Map();
+    // Sockets that have accepted a request: nothing pending means the last
+    // response finished writing, but its tail can still sit in kernel buffers.
+    served = new WeakSet();
+    handling = new Set();
+    closing = false;
+    graceful;
     constructor(opts) {
         this.opts = opts;
     }
-    serialize(fn) {
-        const run = this.lock.then(fn, fn);
-        this.lock = run.then(() => undefined, () => undefined);
+    serializeFor(key, fn) {
+        const prev = this.locks.get(key) ?? Promise.resolve();
+        const run = prev.then(fn, fn);
+        const tail = run.then(() => undefined, () => undefined);
+        this.locks.set(key, tail);
+        // An idle lane drops out, so the map holds only in-flight subjects rather
+        // than every subject ever seen. A request that chained on this tail has
+        // already replaced it, so the identity check never frees a live lane.
+        void tail.then(() => {
+            if (this.locks.get(key) === tail)
+                this.locks.delete(key);
+        });
         return run;
     }
     log(line) {
@@ -63,7 +160,65 @@ export class HttpTransportHost {
     async start() {
         const { config } = this.opts;
         const server = createServer((req, res) => {
-            this.handle(req, res).catch((e) => this.fail(res, 500, 'internal_error', e.message));
+            const socket = req.socket;
+            // Once closing, a connection ends after the last request it accepted
+            // before the close, so one arriving now is never handled (RFC 9112 9.6).
+            // Its body is left unread: nothing reads the socket again.
+            if (this.closing) {
+                stopReading(socket);
+                return;
+            }
+            this.served.add(socket);
+            const entry = this.pending.get(socket);
+            if (entry) {
+                entry.count++;
+                entry.last = res;
+            }
+            else
+                this.pending.set(socket, { count: 1, last: res });
+            let settled = false;
+            const settle = () => {
+                if (settled)
+                    return;
+                settled = true;
+                const e = this.pending.get(socket);
+                if (!e || --e.count > 0)
+                    return;
+                this.pending.delete(socket);
+                if (this.closing)
+                    endAfterFlush(socket);
+            };
+            res.once('finish', settle);
+            res.once('close', settle);
+            // Never rejects: close() waits on it, and a catch-all that itself threw
+            // must neither reject close() nor surface as an unhandled rejection.
+            // The thrown message can name server paths (a lock timeout does), so it
+            // goes only to the host's log.
+            const done = this.handle(req, res)
+                .catch((e) => {
+                try {
+                    this.fail(res, 500, 'internal_error', 'internal error');
+                }
+                finally {
+                    // A throwing log must not reach the destroy below: the answer is sent.
+                    try {
+                        this.log(`500 internal_error path=${pathOf(req)}: ${e instanceof Error ? logSafe(e.message, 200) : 'non-Error throw'}`);
+                    }
+                    catch {
+                        // nowhere left to report it
+                    }
+                }
+            })
+                .catch(() => void res.destroy());
+            this.handling.add(done);
+            void done.finally(() => this.handling.delete(done));
+        });
+        server.on('connection', (socket) => {
+            this.sockets.add(socket);
+            socket.once('close', () => {
+                this.sockets.delete(socket);
+                this.pending.delete(socket);
+            });
         });
         // Slow-loris mitigation behind the tunnel.
         server.headersTimeout = 15_000;
@@ -79,15 +234,77 @@ export class HttpTransportHost {
         });
         this.log(`listening on ${config.host}:${config.port} (public ${config.publicUrl}, transport ${config.transport})`);
     }
-    async close() {
+    /** Without graceMs, every connection is cut at once, even during a graceful
+     * close. With it, the host stops accepting, lets in-flight requests finish
+     * and their responses finish writing, then resolves once each client has
+     * closed its side; whatever is still open after graceMs is cut. A repeat
+     * call with graceMs during a graceful close joins it, keeping the first
+     * grace. graceMs must be a number from 0 to 2^31-1 ms (about 24.8 days, the
+     * longest delay a timer holds); anything else, Infinity included, rejects
+     * with a TypeError and leaves the host as it was. */
+    async close(opts = {}) {
+        const { graceMs } = opts;
+        if (graceMs !== undefined && !(typeof graceMs === 'number' && graceMs >= 0 && graceMs <= MAX_GRACE_MS)) {
+            throw new TypeError(`graceMs must be a number from 0 to ${MAX_GRACE_MS}`);
+        }
         const s = this.httpServer;
         if (!s)
             return;
-        await new Promise((resolve) => {
-            s.close(() => resolve());
-            s.closeAllConnections?.();
+        if (graceMs === undefined) {
+            await new Promise((resolve) => {
+                s.close(() => resolve());
+                s.closeAllConnections?.();
+            });
+            this.httpServer = undefined;
+            return;
+        }
+        // Starting over would arm a second grace, and a shorter one would cut
+        // what the first still lets finish.
+        this.graceful ??= this.closeGracefully(s, graceMs).finally(() => (this.graceful = undefined));
+        return this.graceful;
+    }
+    async closeGracefully(s, graceMs) {
+        this.closing = true;
+        // Node's close() also destroys every connection it deems idle, and that
+        // includes one whose response has ended but is still flushing: a large
+        // body would be cut short. Idle sockets are closed below instead.
+        const nodeIdleCloser = s.closeIdleConnections;
+        s.closeIdleConnections = () => undefined;
+        const closed = new Promise((resolve) => s.close(() => resolve()));
+        s.closeIdleConnections = nodeIdleCloser;
+        // Every request accepted before now is answered, and a connection ends
+        // after the last of them: that one says so if it has not started, and the
+        // settle hook in start() ends the socket once it finishes. Node itself
+        // destroys a socket once a Connection: close response is flushed, which
+        // resets it just as endAfterFlush explains, so that end lingers too. A
+        // socket with nothing pending may still be delivering the tail of its
+        // last response, so only one that never accepted a request is destroyed.
+        for (const socket of this.sockets) {
+            const entry = this.pending.get(socket);
+            if (!entry && !this.served.has(socket)) {
+                socket.destroy();
+                continue;
+            }
+            socket.destroySoon = () => endAfterFlush(socket);
+            if (!entry)
+                endAfterFlush(socket);
+            else if (!entry.last.headersSent)
+                entry.last.setHeader('Connection', 'close');
+        }
+        let timer;
+        const expired = new Promise((resolve) => {
+            timer = setTimeout(resolve, graceMs);
         });
-        this.httpServer = undefined;
+        try {
+            await Promise.race([closed.then(() => Promise.all(this.handling)), expired]);
+        }
+        finally {
+            clearTimeout(timer);
+            s.closeAllConnections();
+            await closed;
+            this.httpServer = undefined;
+            this.closing = false;
+        }
     }
     /** The bound port (useful when listening on port 0 in tests). */
     address() {
@@ -122,12 +339,12 @@ export class HttpTransportHost {
     frontGuard(req, res) {
         const { allowedHosts, allowedOrigins } = this.opts.config;
         if (!hostAllowed(req.headers.host, allowedHosts)) {
-            this.log(`403 host_rejected host=${req.headers.host ?? ''}`);
+            this.log(`403 host_rejected host=${logSafe(req.headers.host ?? '', 64)}`);
             this.fail(res, 403, 'host_rejected', 'Host not allowed (DNS-rebinding guard).');
             return false;
         }
         if (!originAllowed(req.headers.origin, allowedOrigins)) {
-            this.log(`403 origin_rejected origin=${req.headers.origin ?? ''}`);
+            this.log(`403 origin_rejected origin=${logSafe(req.headers.origin ?? '', 64)}`);
             this.fail(res, 403, 'origin_rejected', 'Origin not allowed.');
             return false;
         }
@@ -140,6 +357,14 @@ export class HttpTransportHost {
         }
         if (!this.frontGuard(req, res))
             return;
+        // Registered before anything awaits: a client that leaves while its request
+        // waits on the lane must not have it dispatched once its turn comes. A
+        // response queued behind another on its connection never emits 'close', so
+        // the socket is checked too.
+        let gone = false;
+        res.once('close', () => (gone = true));
+        const socket = req.socket;
+        const clientGone = () => gone || socket.destroyed;
         const auth = await this.opts.authenticate(req);
         if (!auth.ok) {
             for (const [k, v] of Object.entries(auth.headers ?? {}))
@@ -149,6 +374,78 @@ export class HttpTransportHost {
             this.log(`${auth.status} auth_failed path=/mcp`);
             return;
         }
+        const sub = auth.sub ?? 'owner';
+        // Tenant resolution (the seam EE fills): map the verified subject to ITS
+        // server. Absent resolver = the one boot server for every subject.
+        let target = {
+            server: this.opts.server,
+            argShapeFor: this.opts.argShapeFor,
+            strictArgs: this.opts.strictArgs,
+            validationEnvelope: this.opts.validationEnvelope,
+        };
+        if (this.opts.resolveServer) {
+            let resolved;
+            try {
+                resolved = await this.opts.resolveServer({ sub });
+            }
+            catch {
+                resolved = null;
+            }
+            if (resolved && 'refused' in resolved) {
+                const { refused } = resolved;
+                if (isValidRefusal(refused)) {
+                    res.writeHead(403, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: refused.error, message: refused.message }));
+                    this.log(`403 ${refused.error} path=/mcp`);
+                    return;
+                }
+                // An invalid shape falls through to today's exact answer rather than
+                // forwarding something unvalidated; a refusal never reaches dispatch
+                // either way.
+                resolved = null;
+            }
+            target = resolved;
+            if (!target) {
+                res.writeHead(403, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'tenant_not_found', message: 'no tenant is provisioned for this subject' }));
+                this.log('403 tenant_not_found path=/mcp');
+                return;
+            }
+        }
+        // Checked before the body read, so a refused request never buffers its body.
+        const cap = this.opts.maxQueuedPerLane;
+        if (cap === undefined)
+            return this.admitted(req, res, target, sub, clientGone);
+        const lane = target.server;
+        const held = this.depth.get(lane) ?? 0;
+        if (held >= cap) {
+            res.setHeader('Retry-After', '1');
+            this.fail(res, 429, 'lane_busy', 'too many requests are already queued for this server');
+            this.log('429 lane_busy path=/mcp');
+            return;
+        }
+        this.depth.set(lane, held + 1);
+        try {
+            await this.admitted(req, res, target, sub, clientGone);
+        }
+        finally {
+            const left = (this.depth.get(lane) ?? 1) - 1;
+            if (left > 0)
+                this.depth.set(lane, left);
+            else
+                this.depth.delete(lane);
+        }
+    }
+    async admitted(req, res, target, sub, clientGone) {
+        // Thread the verified subject to tool handlers: the Node transport forwards
+        // req.auth verbatim as ctx.http.authInfo. Token/clientId stay empty — the
+        // bearer value must not re-enter the dispatch path via handler context.
+        req.auth = {
+            token: '',
+            clientId: '',
+            scopes: ['mcp:use'],
+            extra: { sub },
+        };
         let body;
         try {
             body = await this.readJson(req);
@@ -156,6 +453,10 @@ export class HttpTransportHost {
         catch (e) {
             return this.fail(res, 400, 'invalid_body', e.message);
         }
+        const maxFrames = this.opts.maxBatchFrames ?? MAX_BATCH_FRAMES;
+        if (Array.isArray(body) && body.length > maxFrames) {
+            return this.fail(res, 400, 'batch_too_large', `a JSON-RPC batch may hold at most ${maxFrames} messages`);
+        }
         // Host/Origin are enforced by the front guard above (uniformly for /mcp and
         // the mounted AS routes), so the SDK's own DNS-rebind guard is disabled: its
         // exact-Host match is stricter than the front guard and would 403 valid
@@ -175,7 +476,15 @@ export class HttpTransportHost {
         // releases. (A shared initialized-state persists across stateless requests;
         // benign for the single-owner design.)
         const deadlineMs = this.opts.dispatchTimeoutMs ?? DISPATCH_TIMEOUT_DEFAULT;
-        await this.serialize(async () => {
+        // The lock lane is the SERVER identity, never the subject: two subjects
+        // reaching one server (the boot server, or a resolver mapping several
+        // subjects to one) would otherwise race it through the connect gap.
+        const { server: mcpServer, argShapeFor, strictArgs, validationEnvelope } = target;
+        await this.serializeFor(mcpServer, async () => {
+            if (clientGone()) {
+                this.log('499 client_gone path=/mcp');
+                return;
+            }
             const disconnected = new Promise((resolve) => res.once('close', () => resolve('closed')));
             let timer;
             const timedOut = new Promise((resolve) => {
@@ -184,10 +493,10 @@ export class HttpTransportHost {
             });
             // Same composition as the stdio leg: the envelope rewrite is innermost,
             // so the tap above it still classifies the original validation prose.
-            const enveloped = withValidationEnvelope(transport, this.opts.validationEnvelope ?? {});
+            const enveloped = withValidationEnvelope(transport, validationEnvelope ?? {});
             const tapped = this.opts.metricsTap ? this.opts.metricsTap(enveloped) : enveloped;
-            await this.opts.server.connect(this.opts.argShapeFor || this.opts.strictArgs
-                ? withArgNormalization(tapped, this.opts.argShapeFor ?? (() => undefined), this.opts.log, this.opts.onArgRename, this.opts.strictArgs)
+            await mcpServer.connect(argShapeFor || strictArgs
+                ? withArgNormalization(tapped, argShapeFor ?? (() => undefined), this.opts.log, this.opts.onArgRename, strictArgs)
                 : tapped);
             // Reflect the dispatch into a non-rejecting arm: if the deadline wins the
             // race, an orphaned handler settling later must not surface as an unhandled
@@ -241,6 +550,10 @@ export class HttpTransportHost {
     readJson(req) {
         const max = this.opts.maxBodyBytes ?? 4_000_000;
         return new Promise((resolve, reject) => {
+            // A client that left while the request was authenticated or resolved has
+            // already destroyed it, and no 'end' or 'error' would ever follow.
+            if (req.destroyed)
+                return reject(new Error('request aborted'));
             let size = 0;
             const chunks = [];
             req.on('data', (c) => {
@@ -269,6 +582,12 @@ export class HttpTransportHost {
     fail(res, status, error, message) {
         if (res.writableEnded)
             return;
+        // A response already started cannot become an error one; cutting it tells
+        // the client it is incomplete.
+        if (res.headersSent) {
+            res.destroy();
+            return;
+        }
         res.writeHead(status, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error, message }));
     }

package/dist/identity.d.ts

@@ -6,9 +6,11 @@ import { type Policy, type Transport } from './write-control.js';
  * The one forward-compat seam (frozen public API): the free core builds
  * exactly one context with subject "owner"; EE later instantiates N contexts
  * from N registries. Nothing here may assume a global current-account.
+ * `subject` is a string (not the literal 'owner') so a context can carry a
+ * tenant id; the free core still always builds 'owner'.
  */
 export interface IdentityContext {
-    subject: 'owner';
+    subject: string;
     accounts: AccountSet;
     policy: Policy;
     getClient: typeof getClient;
@@ -19,6 +21,7 @@ export interface IdentityContext {
         hasToken: typeof hasToken;
     };
 }
+export declare function isOwnerContext(ctx: object | undefined): boolean;
 export declare function buildIdentityContext(env?: NodeJS.ProcessEnv, opts?: {
     transport?: Transport;
 }): IdentityContext;

package/dist/identity.js

@@ -1,9 +1,21 @@
-import { getAccountSet } from './accounts.js';
-import { getClient } from './client.js';
-import { hasToken, readToken, updateToken, writeToken } from './token-store.js';
+import { getAccountSet, getTokenDir, refreshAccountSetIfStale } from './accounts.js';
+import { makeGetClient } from './client.js';
+import { createTokenStore } from './token-store.js';
 import { resolvePolicy } from './write-control.js';
+// Only buildIdentityContext mints the owner brand. The subject string alone
+// never unlocks the owner-only surfaces (account wizard, host-file tools, the
+// operator diagnose report): a hand-built context claiming 'owner' stays a
+// non-owner context.
+const ownerContexts = new WeakSet();
+export function isOwnerContext(ctx) {
+    return ctx !== undefined && ownerContexts.has(ctx);
+}
 export function buildIdentityContext(env = process.env, opts = {}) {
-    return {
+    // Real closures over the single-owner state (the SAME factories EE
+    // instantiates per tenant), bound here to the global registry + token dir —
+    // behavior-identical to the module-level functions for the free core.
+    const tokenStore = createTokenStore(getTokenDir());
+    const ctx = {
         subject: 'owner',
         // Live getter: the seam must always see the current registry, never a
         // snapshot pinned from before a wizard mutation or cross-process reload.
@@ -13,7 +25,14 @@ export function buildIdentityContext(env = process.env, opts = {}) {
         // The dispatch transport rides into the resolved policy as a reserved seam
         // (cc-write-control B14); it does not change any write-control verdict.
         policy: resolvePolicy(env, { transport: opts.transport }),
-        getClient,
-        tokenStore: { readToken, writeToken, updateToken, hasToken },
+        getClient: makeGetClient('owner', {
+            accounts: getAccountSet,
+            readToken: tokenStore.readToken,
+            updateToken: tokenStore.updateToken,
+            refreshIfStale: refreshAccountSetIfStale,
+        }),
+        tokenStore,
     };
+    ownerContexts.add(ctx);
+    return ctx;
 }