@stage-labs/metro 0.1.0-beta.172 → 0.1.0-beta.173

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.172",
+  "version": "0.1.0-beta.173",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.172",
+  "version": "0.1.0-beta.173",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/core/package.json

@@ -14,6 +14,7 @@
     "./train-error": "./src/train-error.ts",
     "./trains/protocol": "./src/protocol.ts",
     "./ids": "./src/ids.ts",
+    "./tickets": "./src/tickets.ts",
     "./address": "./src/address.ts",
     "./station-names": "./src/station-names.ts",
     "./str": "./src/str.ts",
@@ -25,7 +26,9 @@
     "./stations/attachments": "./src/stations/attachments.ts",
     "./stations/messaging-normalize": "./src/stations/messaging-normalize.ts",
     "./stations/profile": "./src/stations/profile.ts",
-    "./stations/sender-profile": "./src/stations/sender-profile.ts"
+    "./stations/sender-profile": "./src/stations/sender-profile.ts",
+    "./stations/train-events": "./src/stations/train-events.ts",
+    "./stations/train-boot": "./src/stations/train-boot.ts"
   },
   "scripts": {
     "build": "tsc",

package/runtime/node_modules/@metro-labs/core/src/events.ts

@@ -1,4 +1,3 @@
-import { randomBytes } from 'node:crypto';
 import { Line } from './lines.js';
 
 export { userSelf, daemonSelf } from './identity.js';
@@ -74,8 +73,7 @@ export function formatDisplay(e: MetroEvent): string {
   return `${headerFor('📩', [e.station, e.fromName ?? e.from, e.lineName])}\n> ${body}`;
 }
 
-export const mintId = (): string =>
-  `msg_${randomBytes(6).toString('base64url')}`;
+export { mintId } from './ids.js';
 
 export type BusListener = (event: MetroEvent, busSeq: number) => void;
 

package/runtime/node_modules/@metro-labs/core/src/ids.ts

@@ -5,6 +5,9 @@ const REROLLS = 16;
 
 export const ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{10}$/;
 
+export const mintId = (): string =>
+  `msg_${randomBytes(6).toString('base64url')}`;
+
 export function newId(): string {
   for (let attempt = 0; attempt < REROLLS; attempt += 1) {
     const id = randomBytes(ID_BYTES).toString('base64url');

package/runtime/node_modules/@metro-labs/core/src/secure-fs.ts

@@ -38,6 +38,23 @@ export function writeSecure(path: string, data: string): void {
   chmodIfExists(path, 0o600);
 }
 
+function modeOf(path: string): number | null {
+  try {
+    return statSync(path).mode & 0o777;
+  } catch {
+    return null;
+  }
+}
+
+export function writeAtomic(path: string, data: string, mode?: number): void {
+  const chosen = mode ?? modeOf(path) ?? 0o644;
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.metro-${String(process.pid)}.tmp`;
+  writeFileSync(tmp, data, { mode: chosen });
+  chmodSync(tmp, chosen);
+  renameSync(tmp, path);
+}
+
 export function readJson<T>(
   path: string,
   fallback: T,

package/runtime/node_modules/@metro-labs/core/src/station-names.ts

@@ -10,4 +10,3 @@ export const STATIONS = [
 
 export type StationName = (typeof STATIONS)[number];
 
-export type ConnectorTransport = 'http' | 'sse';

package/runtime/node_modules/@metro-labs/core/src/stations/station-runtime.ts

@@ -12,8 +12,7 @@ export const respond = (
     JSON.stringify({ op: 'response', id, ...body }) + '\n',
   );
 
-export const mintId = (): string =>
-  `msg_${Math.random().toString(36).slice(2, 10)}`;
+export { mintId } from '../ids.js';
 
 type Args = Record<string, unknown>;
 
@@ -29,13 +28,12 @@ export type StationHandler = (id: string, args: Args) => void | Promise<void>;
 export interface StationConfig {
   handlers: Record<string, StationHandler>;
   normalize: (action: string, args: Args) => Normalized;
-  preDispatch?: (id: string, action: string) => boolean;
 }
 
 const lineTag = (args: Args): string =>
   typeof args.line === 'string' ? args.line : '?';
 
-export function makeStation({ handlers, normalize, preDispatch }: StationConfig) {
+export function makeStation({ handlers, normalize }: StationConfig) {
   const known = Object.keys(handlers).join(', ');
   return async function handleCall(msg: CallMsg): Promise<void> {
     const { id } = msg;
@@ -44,7 +42,6 @@ export function makeStation({ handlers, normalize, preDispatch }: StationConfig)
     try {
       ({ action, args } = normalize(msg.action, msg.args));
       emit({ op: 'log', text: `call ${action} recv (line=${lineTag(args)})` });
-      if (preDispatch?.(id, action)) return;
       const handler = handlers[action];
       if (!handler) {
         respond(id, { error: `unknown action '${action}' (have: ${known})` });

package/runtime/node_modules/@metro-labs/core/src/stations/train-boot.ts

@@ -0,0 +1,42 @@
+import { errMsg } from '../log.js';
+import { readCalls } from '../protocol.js';
+import { TrainError } from '../train-error.js';
+import type { CallMsg } from './station-runtime.js';
+
+export function announceAccounts(station: string, ids: Iterable<string>): void {
+  const list = [...ids];
+  if (list.length === 0) {
+    process.stderr.write(`${station}: no accounts booted, exiting\n`);
+    process.exit(2);
+  }
+  process.stderr.write(`${station} train ready — ${String(list.length)} account(s): ${list.join(', ')}\n`);
+}
+
+export interface ClientTrain<A extends { id: string }, C> {
+  station: string;
+  accounts: Map<string, A>;
+  loadAccounts: () => A[];
+  createClient: (account: A) => C;
+  startInbound: (client: C) => Promise<void>;
+  makeHandleCall: (clientFor: (accountId: string) => C) => (msg: CallMsg) => Promise<void>;
+}
+
+export function runClientTrain<A extends { id: string }, C>(train: ClientTrain<A, C>): void {
+  const clients = new Map<string, C>();
+  const clientFor = (accountId: string): C => {
+    const known = clients.get(accountId);
+    if (known !== undefined) return known;
+    const account = train.accounts.get(accountId);
+    if (!account) throw new TrainError('not_implemented', `unknown account '${accountId}'`);
+    const client = train.createClient(account);
+    clients.set(accountId, client);
+    return client;
+  };
+  readCalls(train.station, train.makeHandleCall(clientFor));
+  for (const cfg of train.loadAccounts()) train.accounts.set(cfg.id, cfg);
+  for (const id of train.accounts.keys())
+    train.startInbound(clientFor(id)).catch((err: unknown) => {
+      process.stderr.write(`${train.station}[${id}] inbound failed: ${errMsg(err)}\n`);
+    });
+  announceAccounts(train.station, train.accounts.keys());
+}

package/runtime/node_modules/@metro-labs/core/src/stations/train-events.ts

@@ -0,0 +1,89 @@
+import { mintId } from '../ids.js';
+import { emit } from './station-runtime.js';
+
+type Fields = Record<string, unknown>;
+type Out = (e: unknown) => void;
+
+export const selfUri = (station: string, account?: string): string =>
+  process.env.METRO_SELF_URI ??
+  (account === undefined ? `metro://${station}/self` : `metro://${station}/${account}/self`);
+
+export function emitInbound(account: string, e: Fields, out: Out = emit): void {
+  out({
+    kind: 'inbound',
+    ...e,
+    account,
+    payload: { ...(e.payload as Fields | undefined), account },
+  });
+}
+
+export interface AttachmentAt {
+  station: string;
+  account: string;
+  line: string;
+  forId: string;
+  index: number;
+  from?: string;
+}
+
+export interface SavedFile {
+  path: string;
+  mime?: string;
+  name?: string;
+}
+
+function attachmentEvent(at: AttachmentAt, text: string, payload: Fields): Fields {
+  return {
+    kind: 'inbound',
+    id: mintId(),
+    ts: new Date().toISOString(),
+    station: at.station,
+    line: at.line,
+    from: at.from ?? selfUri(at.station, at.account),
+    text,
+    account: at.account,
+    payload: { account: at.account, attachmentFor: at.forId, index: at.index, ...payload },
+  };
+}
+
+export const attachmentSavedEvent = (at: AttachmentAt & { saved: SavedFile; extra?: Fields }): Fields =>
+  attachmentEvent(at, `📎 saved: ${at.saved.path}`, {
+    contentType: 'attachmentSaved',
+    ...at.extra,
+    attachmentPath: at.saved.path,
+    localPath: at.saved.path,
+    mime: at.saved.mime,
+    name: at.saved.name,
+  });
+
+export const attachmentFailedEvent = (at: AttachmentAt & { reason: string; extra?: Fields }): Fields =>
+  attachmentEvent(at, `📎 not fetched: ${at.reason}`, {
+    contentType: 'attachmentFailed',
+    ...at.extra,
+    reason: at.reason,
+  });
+
+const reasonOf = (err: unknown): string => (err instanceof Error ? err.message : String(err));
+
+export function reportAttachment(
+  save: Promise<SavedFile>,
+  at: AttachmentAt,
+  extra: { saved?: Fields; failed?: Fields } = {},
+  out: Out = emit,
+): void {
+  const tag = `${at.station}[${at.account}]`;
+  save
+    .then(
+      (saved) => {
+        out(attachmentSavedEvent({ ...at, saved, extra: extra.saved }));
+      },
+      (err: unknown) => {
+        const reason = reasonOf(err);
+        process.stderr.write(`${tag} attachment save failed: ${reason}\n`);
+        out(attachmentFailedEvent({ ...at, reason, extra: extra.failed }));
+      },
+    )
+    .catch((err: unknown) => {
+      process.stderr.write(`${tag} attachment event not emitted: ${reasonOf(err)}\n`);
+    });
+}

package/runtime/node_modules/@metro-labs/core/src/tickets.ts

@@ -0,0 +1,37 @@
+import { randomBytes } from 'node:crypto';
+
+export interface TicketStore<T> {
+  mint: (value: T, now?: number) => { ticket: string; expiresAt: number };
+  take: (ticket: string, now?: number) => T | undefined;
+  size: (now?: number) => number;
+}
+
+export function ticketStore<T>(ttlMs: number, max: number): TicketStore<T> {
+  const open = new Map<string, { value: T; expiresAt: number }>();
+  const prune = (now: number): void => {
+    for (const [ticket, entry] of open) if (entry.expiresAt <= now) open.delete(ticket);
+  };
+  return {
+    mint(value, now = Date.now()) {
+      prune(now);
+      while (open.size >= max) {
+        const oldest = open.keys().next();
+        if (oldest.done === true) break;
+        open.delete(oldest.value);
+      }
+      const ticket = randomBytes(32).toString('base64url');
+      const expiresAt = now + ttlMs;
+      open.set(ticket, { value, expiresAt });
+      return { ticket, expiresAt };
+    },
+    take(ticket, now = Date.now()) {
+      const entry = open.get(ticket);
+      open.delete(ticket);
+      return entry !== undefined && entry.expiresAt > now ? entry.value : undefined;
+    },
+    size(now = Date.now()) {
+      prune(now);
+      return open.size;
+    },
+  };
+}

package/runtime/node_modules/@metro-labs/daemon/src/agents/accounts-api.ts

@@ -8,7 +8,6 @@ import {
   bodyField,
   readJsonBody,
   sendJson,
-  type ApiSession,
 } from '@metro-labs/http/api-http';
 import { type AccountRef } from './account-attach.js';
 import { type AccountRoute } from './account-routes.js';
@@ -51,13 +50,11 @@ export interface AccountApiDeps {
   attachSessions: AttachSessionApi;
   prepareAccount: (input: AttachInput) => Promise<PreparedAccount>;
   attachAccount: (
-    subject: string,
     agentId: string,
     station: StationName,
     config: Record<string, unknown>,
   ) => Promise<AccountRef>;
   detachAccount: (
-    subject: string,
     agentId: string,
     station: StationName,
     accountId: string,
@@ -65,7 +62,6 @@ export interface AccountApiDeps {
   syncStations: (station: StationName) => Promise<void>;
   reloadAgents: () => Promise<void>;
   setAllowlist: (
-    subject: string,
     agentId: string,
     station: StationName,
     accountId: string,
@@ -83,7 +79,6 @@ export interface AccountApiDeps {
     args: Record<string, unknown>,
   ) => Promise<unknown>;
   setAccountEnabled: (
-    subject: string,
     agentId: string,
     station: StationName,
     accountId: string,
@@ -160,14 +155,12 @@ interface AttachPayload {
 
 async function storeAccount(
   deps: AccountApiDeps,
-  session: ApiSession,
   agentId: string,
   station: StationName,
   prepared: PreparedAccount,
 ): Promise<AccountRef> {
   try {
     return await deps.attachAccount(
-      session.subject,
       agentId,
       station,
       prepared.config,
@@ -178,9 +171,6 @@ async function storeAccount(
   }
 }
 
-function ownerOf(session: ApiSession, agentId: string): AttachOwner {
-  return { subject: session.subject, agentId };
-}
 
 function asInput(body: unknown): Record<string, unknown> {
   const out: Record<string, unknown> = {};
@@ -193,14 +183,13 @@ async function handleStart(
   req: IncomingMessage,
   res: ServerResponse,
   deps: AccountApiDeps,
-  session: ApiSession,
   agentId: string,
 ): Promise<void> {
   const body = await readJsonBody(req);
   const station = bodyField(body, 'station');
   if (isInteractiveStation(station)) {
     const view = await deps.attachSessions.start(
-      ownerOf(session, agentId),
+      { agentId },
       station,
       asInput(body),
     );
@@ -210,7 +199,7 @@ async function handleStart(
   if (!isAttachStation(station))
     throw new ApiError(`station must be one of ${ATTACHABLE.join(', ')}`, 400);
   const prepared = await deps.prepareAccount(attachInputOf(station, body));
-  const ref = await storeAccount(deps, session, agentId, station, prepared);
+  const ref = await storeAccount(deps, agentId, station, prepared);
   log.info(
     { agentId: ref.agentId, station, account: ref.accountId },
     'account-api: attached a station account',
@@ -237,12 +226,10 @@ async function handleDetach(
   req: IncomingMessage,
   res: ServerResponse,
   deps: AccountApiDeps,
-  session: ApiSession,
   agentId: string,
   target: { station: StationName; accountId: string },
 ): Promise<void> {
   const ref = await deps.detachAccount(
-    session.subject,
     agentId,
     target.station,
     target.accountId,
@@ -274,12 +261,11 @@ async function handleAllowlist(
   req: IncomingMessage,
   res: ServerResponse,
   deps: AccountApiDeps,
-  session: ApiSession,
   agentId: string,
   target: { station: StationName; accountId: string },
 ): Promise<void> {
   const wanted = normalizeAllowlist(bodyField(await readJsonBody(req), 'allowlist'));
-  const allowlist = await deps.setAllowlist(session.subject, agentId, target.station, target.accountId, wanted);
+  const allowlist = await deps.setAllowlist(agentId, target.station, target.accountId, wanted);
   log.info({ agentId, station: target.station, account: target.accountId, senders: allowlist.length }, 'account-api: allowlist set');
   sendJson(req, res, 200, {
     agentId,
@@ -294,13 +280,12 @@ async function handleEnabled(
   req: IncomingMessage,
   res: ServerResponse,
   deps: AccountApiDeps,
-  session: ApiSession,
   agentId: string,
   target: { station: StationName; accountId: string },
 ): Promise<void> {
   const wanted = bodyField(await readJsonBody(req), 'enabled');
   if (typeof wanted !== 'boolean') throw new ApiError('enabled must be true or false', 400);
-  const enabled = await deps.setAccountEnabled(session.subject, agentId, target.station, target.accountId, wanted);
+  const enabled = await deps.setAccountEnabled(agentId, target.station, target.accountId, wanted);
   log.info({ agentId, station: target.station, account: target.accountId, enabled }, 'account-api: account enabled flag set');
   sendJson(req, res, 200, {
     agentId,
@@ -345,43 +330,41 @@ async function dispatchRoute(
   req: IncomingMessage,
   res: ServerResponse,
   deps: AccountApiDeps,
-  session: ApiSession,
   agentId: string,
   route: AccountRoute,
 ): Promise<void> {
   if (route.kind === 'start')
-    return handleStart(req, res, deps, session, agentId);
+    return handleStart(req, res, deps, agentId);
   if (route.kind === 'session')
     return handleSession(
       req,
       res,
       deps,
-      ownerOf(session, agentId),
+      { agentId },
       route.attachId,
     );
   if (route.kind === 'step')
-    return handleStep(req, res, deps, ownerOf(session, agentId), route.attachId);
-  if (route.kind === 'allowlist') return handleAllowlist(req, res, deps, session, agentId, route);
-  if (route.kind === 'enabled') return handleEnabled(req, res, deps, session, agentId, route);
+    return handleStep(req, res, deps, { agentId }, route.attachId);
+  if (route.kind === 'allowlist') return handleAllowlist(req, res, deps, agentId, route);
+  if (route.kind === 'enabled') return handleEnabled(req, res, deps, agentId, route);
   if (route.kind === 'resolve') return handleResolve(req, res, deps, route);
   if (route.kind === 'name') return handleName(req, res, deps, route);
   if (route.kind === 'senders') {
     sendJson(req, res, 200, { senders: deps.recentSenders(route.station, route.accountId) });
     return;
   }
-  return handleDetach(req, res, deps, session, agentId, route);
+  return handleDetach(req, res, deps, agentId, route);
 }
 
 export async function handleAccountRoute(
   req: IncomingMessage,
   res: ServerResponse,
   deps: AccountApiDeps,
-  session: ApiSession,
   agentId: string,
   route: AccountRoute,
 ): Promise<void> {
   try {
-    await dispatchRoute(req, res, deps, session, agentId, route);
+    await dispatchRoute(req, res, deps, agentId, route);
   } catch (err) {
     apiFailure(req, res, err);
   }

package/runtime/node_modules/@metro-labs/daemon/src/agents/admin.ts

@@ -7,8 +7,6 @@ export class AgentAdminError extends ApiError {}
 export interface AgentSummary {
   id: string;
   name: string | null;
-  owned: boolean;
-  key: string | null;
 }
 
 export interface CreatedAgent {
@@ -17,13 +15,6 @@ export interface CreatedAgent {
   key: string;
 }
 
-export interface OwnedAgent {
-  id: string;
-  name: string | null;
-}
-
-export type DeletedAgent = OwnedAgent;
-
 export function normalizeAgentName(raw: unknown): string {
   const name = typeof raw === 'string' ? raw.trim() : '';
   if (!AGENT_NAME_RE.test(name))

package/runtime/node_modules/@metro-labs/daemon/src/agents/api.ts

@@ -1,13 +1,10 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { parseId } from '@metro-labs/core/ids';
-import { log } from '@metro-labs/core/log';
 import {
   apiFailure,
-  apiSession, requireAdmin,
-  projectParam,
+  apiSession,
   cors,
   sendJson,
-  type ApiSession,
 } from '@metro-labs/http/api-http';
 import { ATTACHABLE, handleAccountRoute, type AccountApiDeps } from './accounts-api.js';
 import {
@@ -15,38 +12,28 @@ import {
   accountRouteAllows,
   type AccountRoute,
 } from './account-routes.js';
-import {
-  type AgentSummary,
-  type DeletedAgent,
-} from './admin.js';
+import type { AgentSummary } from './admin.js';
 
 const PREFIX = '/api/agents';
 
 export interface AgentApiDeps extends AccountApiDeps {
-  listAgents: (subject: string, project: string) => Promise<AgentSummary[]>;
-  deleteAgent: (
-    subject: string,
-    id: string,
-  ) => Promise<DeletedAgent>;
+  listAgents: () => Promise<AgentSummary[]>;
   gatherAccounts: (allowed: Set<string>) => Promise<{
     accounts: Record<string, unknown[]>;
     unavailable: string[];
   }>;
   capabilities: () => Record<string, string[]>;
   attachable?: string[];
-  liveness: () => Map<string, { connected: boolean; lastSeenAt: number }>;
   connectorIds: (agentIds: string[]) => Promise<Map<string, string[]>>;
 }
 
 type Routable =
   | { kind: 'collection' }
-  | { kind: 'agent'; id: string }
   | { kind: 'accounts'; id: string; route: AccountRoute };
 
 type Target = Routable | { kind: 'unknown' } | null;
 
 function subTarget(id: string, rest: string[]): Target {
-  if (rest.length === 0) return { kind: 'agent', id };
   if (rest[0] !== 'accounts') return { kind: 'unknown' };
   const route = accountRoute(rest.slice(1));
   return route === null ? { kind: 'unknown' } : { kind: 'accounts', id, route };
@@ -62,30 +49,8 @@ export function target(path: string): Target {
   return id === null ? { kind: 'unknown' } : subTarget(id, segments.slice(1));
 }
 
-function livenessPayload(
-  agent: AgentSummary,
-  live: Map<string, { connected: boolean; lastSeenAt: number }>,
-): Record<string, unknown> {
-  const found = agent.owned ? live.get(agent.id) : undefined;
-  if (found === undefined) return { connected: false, last_seen: null };
-  return {
-    connected: found.connected,
-    last_seen: new Date(found.lastSeenAt).toISOString(),
-  };
-}
-
-function agentPayload(
-  agent: AgentSummary,
-  live: Map<string, { connected: boolean; lastSeenAt: number }>,
-  connectors: Map<string, string[]>,
-): Record<string, unknown> {
-  return {
-    id: agent.id,
-    name: agent.name,
-    owned: agent.owned,
-    connector_ids: connectors.get(agent.id) ?? [],
-    ...livenessPayload(agent, live),
-  };
+function agentPayload(agent: AgentSummary, connectors: Map<string, string[]>): Record<string, unknown> {
+  return { id: agent.id, name: agent.name, connector_ids: connectors.get(agent.id) ?? [] };
 }
 
 function wantsAccounts(req: IncomingMessage): boolean {
@@ -97,18 +62,11 @@ async function handleList(
   req: IncomingMessage,
   res: ServerResponse,
   deps: AgentApiDeps,
-  session: ApiSession,
 ): Promise<void> {
-  const project = projectParam(req);
-  if (project === null) {
-    sendJson(req, res, 400, { error: 'a project is required' });
-    return;
-  }
-  const list = await deps.listAgents(session.subject, project);
-  const live = deps.liveness();
+  const list = await deps.listAgents();
   const connectors = await deps.connectorIds(list.map((a) => a.id));
   const base = {
-    agents: list.map((a) => agentPayload(a, live, connectors)),
+    agents: list.map((a) => agentPayload(a, connectors)),
     capabilities: deps.capabilities(),
     attachable: deps.attachable ?? ATTACHABLE,
   };
@@ -122,48 +80,11 @@ async function handleList(
   sendJson(req, res, 200, { ...base, accounts, unavailable });
 }
 
-async function handleDelete(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: AgentApiDeps,
-  session: ApiSession,
-  id: string,
-): Promise<void> {
-  const gone = await deps.deleteAgent(session.subject, id);
-  log.info(
-    { agent: gone.name, id: gone.id, owner: session.subject },
-    'agent-api: deleted agent',
-  );
-  sendJson(req, res, 200, { id: gone.id, name: gone.name, deleted: true });
-}
-
-type AgentTarget = Exclude<Routable, { kind: 'accounts' }>;
-
-async function routeAgent(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: AgentApiDeps,
-  session: ApiSession,
-  tgt: AgentTarget,
-): Promise<void> {
-  try {
-    if (tgt.kind === 'agent') {
-      requireAdmin(session);
-      await handleDelete(req, res, deps, session, tgt.id);
-    } else await handleList(req, res, deps, session);
-  } catch (err) {
-    apiFailure(req, res, err);
-  }
-}
-
-const ALLOWED: Record<AgentTarget['kind'], string[]> = {
-  collection: ['GET'],
-  agent: ['DELETE'],
-};
+const ALLOWED_LIST = ['GET'];
 
 function methodAllowed(tgt: Routable, method: string | undefined): boolean {
   if (tgt.kind === 'accounts') return accountRouteAllows(tgt.route, method);
-  return ALLOWED[tgt.kind].includes(method ?? '');
+  return ALLOWED_LIST.includes(method ?? '');
 }
 
 async function dispatch(
@@ -177,9 +98,8 @@ async function dispatch(
     sendJson(req, res, 401, { error: 'unauthorized' });
     return;
   }
-  if (tgt.kind === 'accounts')
-    await handleAccountRoute(req, res, deps, session, tgt.id, tgt.route);
-  else await routeAgent(req, res, deps, session, tgt);
+  if (tgt.kind === 'accounts') await handleAccountRoute(req, res, deps, tgt.id, tgt.route);
+  else await handleList(req, res, deps);
 }
 
 export function handleAgentApiRequest(