mcp-google-multi 6.0.0-beta.2 → 6.0.0-beta.4

package/dist/http-transport.js

@@ -1,14 +1,30 @@
 import { NodeStreamableHTTPServerTransport } from "@modelcontextprotocol/node";
-// node:http server, the route table, the front guard (Host / Origin / DNS-rebind),
-// and the stateless per-request /mcp dispatch. The OAuth AS endpoints and Bearer
-// verification are a seam filled by B13 (oauth-authorization-server); B12 ships a
-// loopback-owner authenticator so the local-HTTP model works before the AS lands.
 import { createServer } from 'node:http';
 import { withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
+import { logSafe } from './trim.js';
+// A host wrapping the log callbacks it hands core needs this, and trim has no package export.
+export { logSafe } from './trim.js';
 // A hung handler that keeps the connection open would otherwise hold the global
-// serialize() lock forever. Generous by default so slow-but-valid calls (large
-// Drive exports, fan-out) still finish; the point is only to guarantee release.
+// serialize() lock forever; generous by default so slow-but-valid calls still finish.
 const DISPATCH_TIMEOUT_DEFAULT = 120_000;
+// Without a cap, one body multiplies per-call work by however many
+// JSON-RPC frames the SDK's synchronous batch screening finds in it.
+const MAX_BATCH_FRAMES = 16;
+// A refusal's body reaches the wire verbatim, so it's validated: no new slug
+// literal enters core, and an overlong message can't leak an operator path/env var.
+const REFUSAL_SLUG_RE = /^[a-z][a-z0-9_]{0,39}$/;
+const MAX_REFUSAL_MESSAGE_CHARS = 300;
+// C0/C1 controls, format chars (bidi overrides, zero-width joiners) and
+// line/paragraph separators; ordinary non-ASCII letters stay allowed.
+const NON_PRINTABLE_RE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+function isValidRefusal(r) {
+    return (typeof r.error === 'string' &&
+        REFUSAL_SLUG_RE.test(r.error) &&
+        typeof r.message === 'string' &&
+        r.message.length > 0 &&
+        r.message.length <= MAX_REFUSAL_MESSAGE_CHARS &&
+        !NON_PRINTABLE_RE.test(r.message));
+}
 export function parseOwnerEmails(env = process.env) {
     return (env.MCP_OWNER_EMAILS ?? '')
         .split(',')
@@ -17,7 +33,7 @@ export function parseOwnerEmails(env = process.env) {
 }
 /** Front guard: an Origin, if present, must be allowlisted; a Host must be
  * allowlisted. Absent Origin passes (native/CLI/backend clients — the claude.ai
- * connector calls /mcp server-to-server with no Origin, BV-4). */
+ * connector calls /mcp server-to-server with no Origin). */
 export function originAllowed(origin, allowed) {
     if (!origin)
         return true;
@@ -33,28 +49,85 @@ export function hostAllowed(host, allowed) {
     const bare = host.replace(/:\d+$/, '');
     return allowed.includes(host) || allowed.includes(bare);
 }
-/** JSON-RPC method name(s) for an observability log line — no params, no PII. */
+const METHOD_NAME = /^[A-Za-z0-9_./$-]{1,64}$/;
+const BATCH_METHODS_SHOWN = 4;
+/** JSON-RPC method name(s) for an observability log line: no params, no PII.
+ * The method is the caller's: anything not shaped like a method name, which
+ * includes a value whose String() throws, is logged as `<invalid>`. */
 export function jsonRpcMethod(body) {
-    const one = (b) => b && typeof b === 'object' && 'method' in b ? String(b.method) : undefined;
-    if (Array.isArray(body))
-        return body.map(one).filter(Boolean).join(',') || 'batch';
-    return one(body) ?? 'unknown';
+    const one = (b) => {
+        if (!b || typeof b !== 'object' || !('method' in b))
+            return undefined;
+        const m = b.method;
+        return typeof m === 'string' && METHOD_NAME.test(m) ? m : '<invalid>';
+    };
+    if (!Array.isArray(body))
+        return one(body) ?? 'unknown';
+    const names = body.map(one).filter((n) => n !== undefined);
+    if (names.length === 0)
+        return 'batch';
+    const rest = names.length - BATCH_METHODS_SHOWN;
+    return rest > 0 ? `${names.slice(0, BATCH_METHODS_SHOWN).join(',')},+${rest}` : names.join(',');
+}
+/** setTimeout fires at once for a delay above this, so a longer grace would
+ * cut every connection immediately. */
+const MAX_GRACE_MS = 2 ** 31 - 1;
+// A lingering close (ends the socket, never destroys it); see docs/internals.md (Graceful close).
+function endAfterFlush(socket) {
+    if (socket.destroyed || socket.writableEnded)
+        return;
+    // Disarm the keep-alive timer Node arms on finish, or it destroys the
+    // socket ~6s later and cuts a slow reader's unread tail the same way an early destroy does.
+    socket.setTimeout(0);
+    socket.end();
+}
+// Stops reading for good so TCP flow control stops the client, instead of
+// piling up a flood pipelined behind a held response; see docs/internals.md (Graceful close).
+function stopReading(socket) {
+    socket.pause();
+    socket.resume = () => socket;
+}
+// For a log line: the pathname only (a query can carry a code or a state),
+// and never a throw, since the caller is the catch-all.
+function pathOf(req) {
+    try {
+        return new URL(req.url ?? '/', 'http://localhost').pathname;
+    }
+    catch {
+        return '?';
+    }
 }
 export class HttpTransportHost {
     opts;
     httpServer;
-    // Serialize the connect→dispatch critical section: the shared McpServer
-    // captures its transport per request (protocol.js), but the gap between
-    // connect() and the dispatch capturing it would still race under true
-    // concurrency. Single-owner HTTP traffic is effectively serial, so a mutex
-    // keeps correctness at negligible cost (and never rebuilds the registry).
-    lock = Promise.resolve();
+    // Per-server dispatch mutex; see docs/internals.md.
+    locks = new Map();
+    // Requests holding a lane slot, per server; used only with maxQueuedPerLane.
+    depth = new Map();
+    // What a graceful close waits on: open sockets and every handle() not yet
+    // settled; see docs/internals.md (Graceful close).
+    sockets = new Set();
+    pending = new Map();
+    // Sockets that have accepted a request: nothing pending means the last
+    // response finished writing, but its tail can still sit in kernel buffers.
+    served = new WeakSet();
+    handling = new Set();
+    closing = false;
+    graceful;
     constructor(opts) {
         this.opts = opts;
     }
-    serialize(fn) {
-        const run = this.lock.then(fn, fn);
-        this.lock = run.then(() => undefined, () => undefined);
+    serializeFor(key, fn) {
+        const prev = this.locks.get(key) ?? Promise.resolve();
+        const run = prev.then(fn, fn);
+        const tail = run.then(() => undefined, () => undefined);
+        this.locks.set(key, tail);
+        // An idle lane drops out of the map; the identity check below skips a
+        // later request that already replaced this tail, so it never frees a live lane.
+        void tail.then(() => {
+            if (this.locks.get(key) === tail)
+                this.locks.delete(key);
+        });
         return run;
     }
     log(line) {
@@ -63,7 +136,62 @@ export class HttpTransportHost {
     async start() {
         const { config } = this.opts;
         const server = createServer((req, res) => {
-            this.handle(req, res).catch((e) => this.fail(res, 500, 'internal_error', e.message));
+            const socket = req.socket;
+            // Once closing, a request arriving now is never handled (RFC 9112 §9.6)
+            // and its body is left unread.
+            if (this.closing) {
+                stopReading(socket);
+                return;
+            }
+            this.served.add(socket);
+            const entry = this.pending.get(socket);
+            if (entry) {
+                entry.count++;
+                entry.last = res;
+            }
+            else
+                this.pending.set(socket, { count: 1, last: res });
+            let settled = false;
+            const settle = () => {
+                if (settled)
+                    return;
+                settled = true;
+                const e = this.pending.get(socket);
+                if (!e || --e.count > 0)
+                    return;
+                this.pending.delete(socket);
+                if (this.closing)
+                    endAfterFlush(socket);
+            };
+            res.once('finish', settle);
+            res.once('close', settle);
+            // Never rejects (close() waits on it); the thrown message can name
+            // server paths, so it goes only to the host's log.
+            const done = this.handle(req, res)
+                .catch((e) => {
+                try {
+                    this.fail(res, 500, 'internal_error', 'internal error');
+                }
+                finally {
+                    // A throwing log must not reach the destroy below: the answer is sent.
+                    try {
+                        this.log(`500 internal_error path=${pathOf(req)}: ${e instanceof Error ? logSafe(e.message, 200) : 'non-Error throw'}`);
+                    }
+                    catch {
+                        // nowhere left to report it
+                    }
+                }
+            })
+                .catch(() => void res.destroy());
+            this.handling.add(done);
+            void done.finally(() => this.handling.delete(done));
+        });
+        server.on('connection', (socket) => {
+            this.sockets.add(socket);
+            socket.once('close', () => {
+                this.sockets.delete(socket);
+                this.pending.delete(socket);
+            });
         });
         // Slow-loris mitigation behind the tunnel.
         server.headersTimeout = 15_000;
@@ -79,15 +207,70 @@ export class HttpTransportHost {
         });
         this.log(`listening on ${config.host}:${config.port} (public ${config.publicUrl}, transport ${config.transport})`);
     }
-    async close() {
+    /** Without graceMs, every connection is cut at once, even during a graceful
+     * close. With it, the host stops accepting, lets in-flight requests finish
+     * and their responses finish writing, then resolves once each client has
+     * closed its side; whatever is still open after graceMs is cut. A repeat
+     * call with graceMs during a graceful close joins it, keeping the first
+     * grace. graceMs must be a number from 0 to 2^31-1 ms (about 24.8 days, the
+     * longest delay a timer holds); anything else, Infinity included, rejects
+     * with a TypeError and leaves the host as it was. */
+    async close(opts = {}) {
+        const { graceMs } = opts;
+        if (graceMs !== undefined && !(typeof graceMs === 'number' && graceMs >= 0 && graceMs <= MAX_GRACE_MS)) {
+            throw new TypeError(`graceMs must be a number from 0 to ${MAX_GRACE_MS}`);
+        }
         const s = this.httpServer;
         if (!s)
             return;
-        await new Promise((resolve) => {
-            s.close(() => resolve());
-            s.closeAllConnections?.();
+        if (graceMs === undefined) {
+            await new Promise((resolve) => {
+                s.close(() => resolve());
+                s.closeAllConnections?.();
+            });
+            this.httpServer = undefined;
+            return;
+        }
+        // Starting over would arm a second grace, and a shorter one would cut
+        // what the first still lets finish.
+        this.graceful ??= this.closeGracefully(s, graceMs).finally(() => (this.graceful = undefined));
+        return this.graceful;
+    }
+    async closeGracefully(s, graceMs) {
+        this.closing = true;
+        // Node's close() also destroys idle connections, which would cut short a
+        // large response still flushing; idle sockets are closed below instead.
+        const nodeIdleCloser = s.closeIdleConnections;
+        s.closeIdleConnections = () => undefined;
+        const closed = new Promise((resolve) => s.close(() => resolve()));
+        s.closeIdleConnections = nodeIdleCloser;
+        // Socket bookkeeping below; see docs/internals.md (Graceful close).
+        for (const socket of this.sockets) {
+            const entry = this.pending.get(socket);
+            if (!entry && !this.served.has(socket)) {
+                socket.destroy();
+                continue;
+            }
+            socket.destroySoon = () => endAfterFlush(socket);
+            if (!entry)
+                endAfterFlush(socket);
+            else if (!entry.last.headersSent)
+                entry.last.setHeader('Connection', 'close');
+        }
+        let timer;
+        const expired = new Promise((resolve) => {
+            timer = setTimeout(resolve, graceMs);
         });
-        this.httpServer = undefined;
+        try {
+            await Promise.race([closed.then(() => Promise.all(this.handling)), expired]);
+        }
+        finally {
+            clearTimeout(timer);
+            s.closeAllConnections();
+            await closed;
+            this.httpServer = undefined;
+            this.closing = false;
+        }
     }
     /** The bound port (useful when listening on port 0 in tests). */
     address() {
@@ -122,12 +305,12 @@ export class HttpTransportHost {
     frontGuard(req, res) {
         const { allowedHosts, allowedOrigins } = this.opts.config;
         if (!hostAllowed(req.headers.host, allowedHosts)) {
-            this.log(`403 host_rejected host=${req.headers.host ?? ''}`);
+            this.log(`403 host_rejected host=${logSafe(req.headers.host ?? '', 64)}`);
             this.fail(res, 403, 'host_rejected', 'Host not allowed (DNS-rebinding guard).');
             return false;
         }
         if (!originAllowed(req.headers.origin, allowedOrigins)) {
-            this.log(`403 origin_rejected origin=${req.headers.origin ?? ''}`);
+            this.log(`403 origin_rejected origin=${logSafe(req.headers.origin ?? '', 64)}`);
             this.fail(res, 403, 'origin_rejected', 'Origin not allowed.');
             return false;
         }
@@ -140,6 +323,11 @@ export class HttpTransportHost {
         }
         if (!this.frontGuard(req, res))
             return;
+        // Registered before anything awaits (client-gone skip); see docs/internals.md.
+        let gone = false;
+        res.once('close', () => (gone = true));
+        const socket = req.socket;
+        const clientGone = () => gone || socket.destroyed;
         const auth = await this.opts.authenticate(req);
         if (!auth.ok) {
             for (const [k, v] of Object.entries(auth.headers ?? {}))
@@ -149,6 +337,76 @@ export class HttpTransportHost {
             this.log(`${auth.status} auth_failed path=/mcp`);
             return;
         }
+        const sub = auth.sub ?? 'owner';
+        // Tenant resolution (a multi-tenant host fills this seam): map the
+        // verified subject to ITS server. Absent resolver = the one boot server for every subject.
+        let target = {
+            server: this.opts.server,
+            argShapeFor: this.opts.argShapeFor,
+            strictArgs: this.opts.strictArgs,
+            validationEnvelope: this.opts.validationEnvelope,
+        };
+        if (this.opts.resolveServer) {
+            let resolved;
+            try {
+                resolved = await this.opts.resolveServer({ sub });
+            }
+            catch {
+                resolved = null;
+            }
+            if (resolved && 'refused' in resolved) {
+                const { refused } = resolved;
+                if (isValidRefusal(refused)) {
+                    res.writeHead(403, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: refused.error, message: refused.message }));
+                    this.log(`403 ${refused.error} path=/mcp`);
+                    return;
+                }
+                // An invalid shape falls through to today's exact answer rather than
+                // forwarding something unvalidated.
+                resolved = null;
+            }
+            target = resolved;
+            if (!target) {
+                res.writeHead(403, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'tenant_not_found', message: 'no tenant is provisioned for this subject' }));
+                this.log('403 tenant_not_found path=/mcp');
+                return;
+            }
+        }
+        // Checked before the body read, so a refused request never buffers its body.
+        const cap = this.opts.maxQueuedPerLane;
+        if (cap === undefined)
+            return this.admitted(req, res, target, sub, clientGone);
+        const lane = target.server;
+        const held = this.depth.get(lane) ?? 0;
+        if (held >= cap) {
+            res.setHeader('Retry-After', '1');
+            this.fail(res, 429, 'lane_busy', 'too many requests are already queued for this server');
+            this.log('429 lane_busy path=/mcp');
+            return;
+        }
+        this.depth.set(lane, held + 1);
+        try {
+            await this.admitted(req, res, target, sub, clientGone);
+        }
+        finally {
+            const left = (this.depth.get(lane) ?? 1) - 1;
+            if (left > 0)
+                this.depth.set(lane, left);
+            else
+                this.depth.delete(lane);
+        }
+    }
+    async admitted(req, res, target, sub, clientGone) {
+        // Thread the verified subject to tool handlers via ctx.http.authInfo;
+        // token/clientId stay empty so the bearer value never re-enters the dispatch path.
+        req.auth = {
+            token: '',
+            clientId: '',
+            scopes: ['mcp:use'],
+            extra: { sub },
+        };
         let body;
         try {
             body = await this.readJson(req);
@@ -156,42 +414,40 @@ export class HttpTransportHost {
         catch (e) {
             return this.fail(res, 400, 'invalid_body', e.message);
         }
-        // Host/Origin are enforced by the front guard above (uniformly for /mcp and
-        // the mounted AS routes), so the SDK's own DNS-rebind guard is disabled: its
-        // exact-Host match is stricter than the front guard and would 403 valid
-        // Hosts (double enforcement, differing rules).
+        const maxFrames = this.opts.maxBatchFrames ?? MAX_BATCH_FRAMES;
+        if (Array.isArray(body) && body.length > maxFrames) {
+            return this.fail(res, 400, 'batch_too_large', `a JSON-RPC batch may hold at most ${maxFrames} messages`);
+        }
+        // The SDK's own DNS-rebind guard is disabled: Host/Origin are already
+        // enforced above, and its stricter exact-Host match would 403 valid Hosts.
         const transport = new NodeStreamableHTTPServerTransport({
             sessionIdGenerator: undefined,
             enableJsonResponse: true,
             enableDnsRebindingProtection: false,
         });
-        // The shared McpServer holds exactly one connected transport at a time, so
-        // connect + dispatch + DISCONNECT all run inside the mutex: the next request
-        // can never hit "Already connected". The serialized section is guaranteed to
-        // settle three ways — the handler finishes, the client disconnects (res
-        // 'close'), or a dispatch deadline fires — so neither a client that holds the
-        // connection open nor a hung upstream can wedge the lock. The transport is
-        // closed in a finally (which resets server._transport) before the lock
-        // releases. (A shared initialized-state persists across stateless requests;
-        // benign for the single-owner design.)
+        // connect + dispatch + disconnect run inside the per-server mutex, keyed
+        // on the server identity, never the subject; see docs/internals.md.
         const deadlineMs = this.opts.dispatchTimeoutMs ?? DISPATCH_TIMEOUT_DEFAULT;
-        await this.serialize(async () => {
+        const { server: mcpServer, argShapeFor, strictArgs, validationEnvelope } = target;
+        await this.serializeFor(mcpServer, async () => {
+            if (clientGone()) {
+                this.log('499 client_gone path=/mcp');
+                return;
+            }
             const disconnected = new Promise((resolve) => res.once('close', () => resolve('closed')));
             let timer;
             const timedOut = new Promise((resolve) => {
                 timer = setTimeout(() => resolve('timeout'), deadlineMs);
                 timer.unref?.();
             });
-            // Same composition as the stdio leg: the envelope rewrite is innermost,
-            // so the tap above it still classifies the original validation prose.
-            const enveloped = withValidationEnvelope(transport, this.opts.validationEnvelope ?? {});
+            // Envelope rewrite innermost, as on stdio; see docs/internals.md (Argument normalization).
+            const enveloped = withValidationEnvelope(transport, validationEnvelope ?? {});
             const tapped = this.opts.metricsTap ? this.opts.metricsTap(enveloped) : enveloped;
-            await this.opts.server.connect(this.opts.argShapeFor || this.opts.strictArgs
-                ? withArgNormalization(tapped, this.opts.argShapeFor ?? (() => undefined), this.opts.log, this.opts.onArgRename, this.opts.strictArgs)
+            await mcpServer.connect(argShapeFor || strictArgs
+                ? withArgNormalization(tapped, argShapeFor ?? (() => undefined), this.opts.log, this.opts.onArgRename, strictArgs)
                 : tapped);
-            // Reflect the dispatch into a non-rejecting arm: if the deadline wins the
-            // race, an orphaned handler settling later must not surface as an unhandled
-            // rejection — but a genuine dispatch error still propagates (rethrown below).
+            // Non-rejecting arm: an orphaned handler settling after the deadline wins
+            // must not surface as an unhandled rejection; a real error is rethrown below.
             let dispatchErr;
             const dispatchArm = transport
                 .handleRequest(req, res, body)
@@ -229,7 +485,7 @@ export class HttpTransportHost {
     health(res) {
         const { config, ownerConfigured, version } = this.opts;
         res.writeHead(200, { 'Content-Type': 'application/json' });
-        // No secrets, no owner emails (cc-transport-hosting /health rule).
+        // No secrets, no owner emails.
         res.end(JSON.stringify({
             status: 'ok',
             transport: config.transport,
@@ -241,6 +497,10 @@ export class HttpTransportHost {
     readJson(req) {
         const max = this.opts.maxBodyBytes ?? 4_000_000;
         return new Promise((resolve, reject) => {
+            // A client that left while the request was authenticated or resolved has
+            // already destroyed it, and no 'end' or 'error' would ever follow.
+            if (req.destroyed)
+                return reject(new Error('request aborted'));
             let size = 0;
             const chunks = [];
             req.on('data', (c) => {
@@ -269,6 +529,12 @@ export class HttpTransportHost {
     fail(res, status, error, message) {
         if (res.writableEnded)
             return;
+        // A response already started cannot become an error one; cutting it tells
+        // the client it is incomplete.
+        if (res.headersSent) {
+            res.destroy();
+            return;
+        }
         res.writeHead(status, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error, message }));
     }

package/dist/identity.d.ts

@@ -4,11 +4,13 @@ import { hasToken, readToken, updateToken, writeToken } from './token-store.js';
 import { type Policy, type Transport } from './write-control.js';
 /**
  * The one forward-compat seam (frozen public API): the free core builds
- * exactly one context with subject "owner"; EE later instantiates N contexts
- * from N registries. Nothing here may assume a global current-account.
+ * exactly one context with subject "owner"; a multi-tenant host instantiates
+ * N contexts from N registries. Nothing here may assume a global current-account.
+ * `subject` is a string (not the literal 'owner') so a context can carry a
+ * tenant id; the free core still always builds 'owner'.
  */
 export interface IdentityContext {
-    subject: 'owner';
+    subject: string;
     accounts: AccountSet;
     policy: Policy;
     getClient: typeof getClient;
@@ -19,6 +21,7 @@ export interface IdentityContext {
         hasToken: typeof hasToken;
     };
 }
+export declare function isOwnerContext(ctx: object | undefined): boolean;
 export declare function buildIdentityContext(env?: NodeJS.ProcessEnv, opts?: {
     transport?: Transport;
 }): IdentityContext;

package/dist/identity.js

@@ -1,19 +1,35 @@
-import { getAccountSet } from './accounts.js';
-import { getClient } from './client.js';
-import { hasToken, readToken, updateToken, writeToken } from './token-store.js';
+import { getAccountSet, getTokenDir, refreshAccountSetIfStale } from './accounts.js';
+import { makeGetClient } from './client.js';
+import { createTokenStore } from './token-store.js';
 import { resolvePolicy } from './write-control.js';
+// Only buildIdentityContext mints the owner brand: the subject string alone
+// never unlocks owner-only surfaces, so a hand-built context claiming 'owner' stays non-owner.
+const ownerContexts = new WeakSet();
+export function isOwnerContext(ctx) {
+    return ctx !== undefined && ownerContexts.has(ctx);
+}
 export function buildIdentityContext(env = process.env, opts = {}) {
-    return {
+    // The SAME factories a multi-tenant host instantiates per tenant, bound here
+    // to the global registry + token dir.
+    const tokenStore = createTokenStore(getTokenDir());
+    const ctx = {
         subject: 'owner',
         // Live getter: the seam must always see the current registry, never a
         // snapshot pinned from before a wizard mutation or cross-process reload.
         get accounts() {
             return getAccountSet();
         },
-        // The dispatch transport rides into the resolved policy as a reserved seam
-        // (cc-write-control B14); it does not change any write-control verdict.
+        // The dispatch transport rides into the resolved policy as a reserved seam;
+        // it does not change any write-control verdict.
         policy: resolvePolicy(env, { transport: opts.transport }),
-        getClient,
-        tokenStore: { readToken, writeToken, updateToken, hasToken },
+        getClient: makeGetClient('owner', {
+            accounts: getAccountSet,
+            readToken: tokenStore.readToken,
+            updateToken: tokenStore.updateToken,
+            refreshIfStale: refreshAccountSetIfStale,
+        }),
+        tokenStore,
     };
+    ownerContexts.add(ctx);
+    return ctx;
 }