@stage-labs/metro 0.1.0-beta.286 → 0.1.0-beta.288

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.286",
+  "version": "0.1.0-beta.288",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.286",
+  "version": "0.1.0-beta.288",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/marketplace/plugin/STAGE.md

@@ -82,6 +82,17 @@ The separate `metadata.status` and `metadata.priority` fields are optional. Stat
     ]}}
   }}}
   ```
+- Live frames: add `"source": {"url": "https://…"}` to the frame to name the node that serves its widget, an https URL that answers with ChatKit widget JSON (Stage's node protocol: https://github.com/bonustrack/stage/blob/main/NODES.md). Stage then sends the frame's actions to that node, not to you. The node's reply replaces the frame in place, on that person's device only, and no message comes to you. Only an action with ChatKit's `"handler": "client"` still comes to you as a frame action, like every action of a frame without `source`. `frame.open` and `frame.back` stay in Stage. Here `24h` goes to the node, and `Ask` comes to you as `Frame action: ask (tapped "Ask")`:
+  ```json
+  {"line": "…", "frame": {"source": {"url": "https://eth.example.com/"}, "widget": {"type": "Card", "children": [
+    {"type": "Title", "value": "ETH 2,410 USD"},
+    {"type": "Row", "children": [
+      {"type": "Button", "label": "24h", "onClickAction": {"type": "range", "payload": {"days": 1}}},
+      {"type": "Button", "label": "Ask", "color": "secondary", "onClickAction": {"type": "ask", "handler": "client"}}
+    ]}
+  ]}}}
+  ```
+  Stage calls the node only on a tap or on Refresh in the frame's three-dot menu, and only once the person has accepted the chat. Until then, and again after the app restarts, it shows the widget as you sent it. Do not add a Refresh button to a node: every live frame and Dashboard widget has Refresh in its menu. Add to dashboard on the frame adds a live widget loaded from that URL, and its `"handler": "client"` actions still come to this chat.
 
 **Wallet cards.** The payment and signature cards Stage's own Request payment and Request signature send. Sending one moves nothing and signs nothing: the person taps Pay or Sign and confirms in Stage. Send one only when you were asked to.
 - Send: `send {"line": "…", "wallet": {"type": "<type>", "content": {…}}}`. With `text` or a `frame` as well, the card goes last, and the `message_id` you get back is the card's.

package/runtime/marketplace/plugin/bin/policy.mjs

@@ -51,7 +51,7 @@ function targets(snap, name, input) {
 
 function decide(policy, name, group) {
   if (!isRecord(policy)) return 'allow';
-  const byTool = isRecord(policy.tools) ? policy.tools[name] : undefined;
+  const byTool = isRecord(policy.tools) && Object.hasOwn(policy.tools, name) ? policy.tools[name] : undefined;
   const access = byTool ?? policy[group] ?? 'allow';
   return access in RANK ? access : 'allow';
 }
@@ -62,7 +62,8 @@ function connectorCall(snap, toolName) {
   for (const [server, entry] of Object.entries(isRecord(snap.connectors) ? snap.connectors : {})) {
     if (!isRecord(entry)) continue;
     const name = text(entry.name);
-    const prefixes = [`mcp__plugin_metro_${server}__`, `mcp__${server}__`, `mcp__${normalized(`metro.box ${name}`)}__`];
+    const prefixes = [`mcp__plugin_metro_${server}__`, `mcp__${server}__`];
+    if (!/^org-[A-Za-z0-9][A-Za-z0-9_-]{10}$/.test(text(entry.id))) prefixes.push(`mcp__${normalized(`metro.box ${name}`)}__`);
     const prefix = prefixes.find((p) => toolName.startsWith(p) && toolName.length > p.length);
     if (prefix === undefined) continue;
     const called = toolName.slice(prefix.length);

package/runtime/node_modules/@metro-labs/daemon/src/approvals/pending.ts

@@ -138,6 +138,12 @@ export function cancelPrompt(requestId: string, owner: object): void {
   });
 }
 
+export function revokeToolPrompts(matches: (tool: string) => boolean): void {
+  grants = grants.filter((entry) => !matches(entry.tool));
+  for (const entry of held.values())
+    if (matches(entry.tool)) cancelPrompt(entry.requestId, entry.owner);
+}
+
 export function revokeCallPrompts(route: CallRoute): void {
   grants = grants.filter((entry) => entry.call === undefined || !sameCall(entry.call.route, route));
   for (const entry of held.values())

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -21,7 +21,9 @@ import {
   trainEventToMetroEvent,
 } from '../routes/http.js';
 import { agentsDir, fileSource } from '../agents/files.js';
-import { syncPluginServers } from '../connectors/plugin-sync.js';
+import { publishLocalConnectors } from '../connectors/publication.js';
+import { readAgentKey } from '../connectors/agent-key.js';
+import { stopOrgConnectorSync, watchOrgConnectorSync } from '../connectors/org-sync-watch.js';
 import { loadConnectorPolicies, readLocalConnectors } from '../connectors/store.js';
 import { ensureMetroPlugin } from '../claude/plugin-install.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
@@ -158,9 +160,10 @@ installBearerSessions(agentsDir(), localOwner);
   );
   metroMcp.startInbound();
   startPromptExpiry();
-  syncPluginServers(readLocalConnectors());
+  publishLocalConnectors(readLocalConnectors());
   startUploadReaper();
   startAttachReaper();
+  watchOrgConnectorSync({ owner: localOwner, key: readAgentKey });
   startCloudWatchPublisher();
   watchFallbackUsage();
   announceLocalEndpoint();
@@ -192,7 +195,7 @@ async function startClaude(): Promise<void> {
   ensureMetroPlugin()
     .then((outcome) => {
       log.info({ outcome }, 'plugin: metro plugin for Claude Code');
-      if (outcome !== 'skipped') syncPluginServers(readLocalConnectors());
+      if (outcome !== 'skipped') publishLocalConnectors(readLocalConnectors());
     })
     .catch((err: unknown) => {
       log.warn({ err: errMsg(err) }, 'plugin: could not ensure the Claude Code plugin');
@@ -212,6 +215,7 @@ async function shutdown(): Promise<void> {
   if (shuttingDown) return;
   shuttingDown = true;
   log.info('dispatcher shutting down');
+  stopOrgConnectorSync();
   const leaving = leaveCallsForShutdown();
   unwatchSession();
   tunnel?.stop();

package/runtime/node_modules/@metro-labs/daemon/src/claude/setup.ts

@@ -159,8 +159,10 @@ const PRIOR_STAGE: ReadonlySet<string> = new Set([
   '08a30f5cd5cf8013ab70c1fa9e1109018c0337552296a8efe5c0cf543b284991',
   'f87e9494ea6151d140b742c1b88b4f435ae653559be641fddc2160cd24dd4e1b',
   'cb4307b016855c1a09d48bc8b3924a3080bd78b205963df3d6f20401d0486df9',
+  'd25a8575b1c27ee725ff3a3ec6e1ba42aebd08ba545012c4807c072627c5dd4a',
   'f2be51c5290d2e61b47f10c379fa45d051a59a6b3f06d99174c2a170074bc8f5',
   '4c727aa110c9023371cfb364f3304ad9db22cdf2501208ef1e42e6ccc245b00f',
+  'f3901d8a4537441b1d7fe8e4073322a97b779472df6b4a8e0f2091ab5ab0ae09',
 ]);
 const PRIOR_MEMORY: ReadonlySet<string> = new Set(['08795399635c8cdec2b50cb4e336f89ae880f3997ae52560ef647a9cdc8f1b08']);
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/agent-key.ts

@@ -0,0 +1,148 @@
+import { createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, type KeyObject } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { parseId } from '@metro-labs/core/ids';
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+import { ensureSecureDir } from '@metro-labs/core/secure-fs';
+import { agentKeyId, rawPublicKey } from '@metro-labs/http/agent-signature';
+import { ApiError } from '@metro-labs/http/api-error';
+import { isOrganizationId } from '@metro-labs/http/workos-token';
+import { agentsDir } from '../agents/files.js';
+
+const FILE = 'agent-key.json';
+
+export interface Enrollment {
+  server: string;
+  organization: string;
+  at: string;
+}
+
+export interface AgentKey {
+  keyId: string;
+  signingKey: string;
+  sealingKey: string;
+  signing: KeyObject;
+  sealing: KeyObject;
+  enrollment: Enrollment | null;
+}
+
+const pathOf = (dir: string): string => join(dir, FILE);
+
+function privateKeyOf(raw: unknown, type: 'ed25519' | 'x25519'): KeyObject | null {
+  if (typeof raw !== 'string' || raw === '') return null;
+  try {
+    const key = createPrivateKey({ key: Buffer.from(raw, 'base64'), format: 'der', type: 'pkcs8' });
+    return key.asymmetricKeyType === type ? key : null;
+  } catch {
+    return null;
+  }
+}
+
+function enrollmentOf(raw: unknown): Enrollment | null {
+  if (!isRecord(raw) || typeof raw.organization !== 'string' || typeof raw.at !== 'string') return null;
+  const server = parseId(raw.server);
+  return server !== null && isOrganizationId(raw.organization) ? { server, organization: raw.organization, at: raw.at } : null;
+}
+
+function agentKeyOf(signing: KeyObject, sealing: KeyObject, enrollment: Enrollment | null): AgentKey {
+  const signingKey = rawPublicKey(createPublicKey(signing));
+  return { keyId: agentKeyId(signingKey), signingKey, sealingKey: rawPublicKey(createPublicKey(sealing)), signing, sealing, enrollment };
+}
+
+const unreadable = (): null => {
+  log.warn('agent-key.json: Metro cannot read this agent key, so the agent must be enrolled again');
+  return null;
+};
+
+function storedOf(path: string): Record<string, unknown> | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return unreadable();
+  }
+  return isRecord(parsed) ? parsed : unreadable();
+}
+
+function keyOf(stored: Record<string, unknown> | null): AgentKey | null {
+  if (stored === null) return null;
+  const signing = privateKeyOf(stored.signing, 'ed25519');
+  const sealing = privateKeyOf(stored.sealing, 'x25519');
+  if (stored.version !== 1 || signing === null || sealing === null) return unreadable();
+  return agentKeyOf(signing, sealing, enrollmentOf(stored.enrollment));
+}
+
+export function readAgentKey(dir = agentsDir()): AgentKey | null {
+  const path = existsSync(pathOf(dir)) ? pathOf(dir) : join(dir, 'box-key.json');
+  return existsSync(path) ? keyOf(storedOf(path)) : null;
+}
+
+const pendingPath = (dir: string): string => join(dir, 'agent-key.pending.json');
+
+function pendingFields(stored: Record<string, unknown> | null): { owner: string; ticketHash: string; expectedServer: string | null } {
+  if (typeof stored?.ticketHash !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(stored.ticketHash) || typeof stored.owner !== 'string' || !isOrganizationId(stored.owner)) {
+    throw new ApiError('Metro cannot read the pending enrollment key. Restore its file or permissions before enrolling again.', 503);
+  }
+  const expectedServer = stored.expectedServer === undefined ? null : parseId(stored.expectedServer);
+  if (stored.expectedServer !== undefined && expectedServer === null) throw new ApiError('Metro cannot read the pending enrollment identity. Restore its file before enrolling again.', 503);
+  return { owner: stored.owner, ticketHash: stored.ticketHash, expectedServer };
+}
+
+export function readPendingAgentKey(owner: string, dir: string): (AgentKey & { ticketHash: string; expectedServer: string | null }) | null {
+  if (!existsSync(pendingPath(dir))) return null;
+  const stored = storedOf(pendingPath(dir));
+  const fields = pendingFields(stored);
+  const key = keyOf(stored);
+  if (key === null) throw new ApiError('Metro cannot read the pending enrollment key. Restore its file or permissions before enrolling again.', 503);
+  return fields.owner === owner ? { ...key, ticketHash: fields.ticketHash, expectedServer: fields.expectedServer } : null;
+}
+
+function flush(path: string): void {
+  const file = openSync(path, 'r');
+  try {
+    fsyncSync(file);
+  } finally {
+    closeSync(file);
+  }
+}
+
+function writeKey(path: string, stored: Record<string, unknown>): void {
+  const dir = dirname(path);
+  ensureSecureDir(dir);
+  const temp = `${path}.${randomBytes(12).toString('hex')}.tmp`;
+  const file = openSync(temp, 'wx', 0o600);
+  try {
+    try {
+      writeFileSync(file, `${JSON.stringify(stored, null, 2)}\n`);
+      fsyncSync(file);
+    } finally {
+      closeSync(file);
+    }
+    renameSync(temp, path);
+    flush(dir);
+  } finally {
+    rmSync(temp, { force: true });
+  }
+}
+
+export function clearPendingAgentKey(dir: string): void {
+  rmSync(pendingPath(dir), { force: true });
+  flush(dir);
+}
+
+export function newAgentKey(): AgentKey {
+  return agentKeyOf(generateKeyPairSync('ed25519').privateKey, generateKeyPairSync('x25519').privateKey, null);
+}
+
+const exported = (key: KeyObject): string => key.export({ format: 'der', type: 'pkcs8' }).toString('base64');
+
+const privateKeys = (key: AgentKey): Record<string, unknown> => ({ version: 1, signing: exported(key.signing), sealing: exported(key.sealing) });
+
+export function savePendingAgentKey(key: AgentKey, owner: string, ticketHash: string, dir: string, expectedServer?: string): void {
+  writeKey(pendingPath(dir), { ...privateKeys(key), owner, ticketHash, ...(expectedServer === undefined ? {} : { expectedServer }) });
+}
+
+export function saveAgentKey(key: AgentKey, enrollment: Enrollment, dir = agentsDir()): void {
+  writeKey(pathOf(dir), { ...privateKeys(key), enrollment });
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/api.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import { log } from '@metro-labs/core/log';
 import { healthOf } from './health.js';
 import type { RemoteTool } from './tools.js';
+import type { ConnectorMigrationPreview } from './migration-preview.js';
 import { normalizePolicy, type ToolPolicy } from '../policy/policy.js';
 import {
   apiFailure,
@@ -9,6 +10,7 @@ import {
   bodyField,
   cors,
   readJsonBody,
+  requireAdmin,
   sendJson,
   stringOf,
 } from '@metro-labs/http/api-http';
@@ -20,7 +22,7 @@ import {
   startOAuth,
   type OAuthRouteDeps,
 } from './oauth-routes.js';
-import { ConnectorUnauthorized } from './verify.js';
+import { ConnectorUnauthorized } from '@metro-labs/http/connector-url';
 import type {
   Connector,
   ConnectorCheck,
@@ -31,6 +33,7 @@ import type {
 const PREFIX = '/api/connectors';
 
 export interface ConnectorApiDeps extends OAuthRouteDeps {
+  migrationPreview?: () => ConnectorMigrationPreview;
   listConnectors: () => Promise<Connector[]>;
   createConnector: (input: ConnectorInput) => Promise<Connector>;
   verifyConnector: (id: string) => Promise<ConnectorCheck>;
@@ -43,6 +46,7 @@ export interface ConnectorApiDeps extends OAuthRouteDeps {
 
 type Routable =
   | { kind: 'collection' }
+  | { kind: 'migration-preview' }
   | { kind: 'callback' }
   | { kind: 'connector'; id: string }
   | { kind: 'verify'; id: string }
@@ -74,6 +78,7 @@ function target(path: string): Target {
   const head = segments[0];
   if (head === undefined) return { kind: 'collection' };
   if (head === 'callback' && segments.length === 1) return { kind: 'callback' };
+  if (head === 'migration-preview' && segments.length === 1) return { kind: 'migration-preview' };
   const id = parseId(head);
   return id === null ? { kind: 'unknown' } : subTarget(id, segments.slice(1));
 }
@@ -217,7 +222,7 @@ async function handlePolicy(
   sendJson(req, res, 200, connectorPayload(row));
 }
 
-type ById = Exclude<Routable['kind'], 'collection' | 'callback'>;
+type ById = Exclude<Routable['kind'], 'collection' | 'callback' | 'migration-preview'>;
 
 const BY_ID: Record<ById, (req: IncomingMessage, res: ServerResponse, deps: ConnectorApiDeps, id: string) => Promise<void>> = {
   verify: handleVerify,
@@ -239,6 +244,11 @@ async function route(
 ): Promise<void> {
   try {
     if (tgt.kind === 'callback') return;
+    if (tgt.kind === 'migration-preview') {
+      if (deps.migrationPreview === undefined) sendJson(req, res, 503, { error: 'Migration preview is unavailable.' });
+      else sendJson(req, res, 200, deps.migrationPreview());
+      return;
+    }
     if (tgt.kind !== 'collection') await BY_ID[tgt.kind](req, res, deps, tgt.id);
     else if (req.method === 'GET') await handleList(req, res, deps);
     else await handleCreate(req, res, deps);
@@ -249,6 +259,7 @@ async function route(
 
 const ALLOWED: Record<Routable['kind'], string[]> = {
   collection: ['GET', 'POST'],
+  'migration-preview': ['GET'],
   callback: ['GET'],
   connector: ['GET', 'DELETE'],
   verify: ['POST'],
@@ -274,6 +285,7 @@ async function dispatch(
     sendJson(req, res, 401, { error: 'unauthorized' });
     return;
   }
+  if (tgt.kind === 'migration-preview') requireAdmin(session);
   await route(req, res, deps, tgt);
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/config.ts

@@ -1,24 +1,14 @@
-import { ApiError } from '@metro-labs/http/api-error';
 import { stringOf } from '@metro-labs/http/api-http';
 import type {
   ConnectorAuth,
   VerifiedRecord,
   VerifiedServer,
-} from './verify.js';
-import type { OAuthClient } from './oauth-client.js';
+} from '@metro-labs/http/connector-mcp';
+import type { OAuthClient } from '@metro-labs/http/connector-oauth';
 import { isRecord } from '@metro-labs/core/is-record';
 import type { ToolGroup } from '@metro-labs/core/stations/types';
 import { parsePolicy, type ToolPolicy } from '../policy/policy.js';
 
-const CONNECTOR_NAME_MAX = 64;
-const HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;
-const HEADER_VALUE_RE = /^[\x20-\x7e]{1,4096}$/;
-const CLIENT_ID_RE = /^[\x21-\x7e]{1,256}$/;
-const CLIENT_SECRET_RE = /^[\x21-\x7e]{1,1024}$/;
-const DEFAULT_HEADER = 'Authorization';
-
-export class ConnectorError extends ApiError {}
-
 export type ConnectorSignIn = 'connected' | 'disconnected' | null;
 
 export interface ConnectorConfig {
@@ -31,66 +21,6 @@ export interface ConnectorConfig {
   toolGroups?: Record<string, ToolGroup>;
 }
 
-function hasControlChar(value: string): boolean {
-  for (const ch of value) {
-    const code = ch.codePointAt(0) ?? 0;
-    if (code < 0x20 || code === 0x7f) return true;
-  }
-  return false;
-}
-
-export function connectorName(raw: unknown): string {
-  const name = typeof raw === 'string' ? raw.trim() : '';
-  if (name === '') throw new ConnectorError('a connector needs a name', 400);
-  if (name.length > CONNECTOR_NAME_MAX)
-    throw new ConnectorError(
-      `a connector name must be ${String(CONNECTOR_NAME_MAX)} characters or fewer`,
-      400,
-    );
-  if (hasControlChar(name))
-    throw new ConnectorError(
-      'a connector name must not contain control characters',
-      400,
-    );
-  return name;
-}
-
-export function connectorAuth(
-  rawHeader: unknown,
-  rawValue: unknown,
-): ConnectorAuth {
-  const header = stringOf(rawHeader).trim();
-  const value = stringOf(rawValue).trim();
-  if (header === '' && value === '') return { kind: 'none' };
-  if (value === '')
-    throw new ConnectorError(
-      'that header has no value — give both a header name and its value, or neither',
-      400,
-    );
-  const name = header === '' ? DEFAULT_HEADER : header;
-  if (!HEADER_NAME_RE.test(name))
-    throw new ConnectorError('that is not a valid HTTP header name', 400);
-  if (!HEADER_VALUE_RE.test(value))
-    throw new ConnectorError('that header value is not sendable', 400);
-  return { kind: 'header', name, value };
-}
-
-export function connectorClient(
-  rawId: unknown,
-  rawSecret: unknown,
-): OAuthClient | null {
-  const clientId = stringOf(rawId).trim();
-  const clientSecret = stringOf(rawSecret).trim();
-  if (clientId === '' && clientSecret === '') return null;
-  if (clientId === '')
-    throw new ConnectorError('a client secret needs the client ID it belongs to', 400);
-  if (!CLIENT_ID_RE.test(clientId))
-    throw new ConnectorError('that is not a client ID Metro can send', 400);
-  if (clientSecret !== '' && !CLIENT_SECRET_RE.test(clientSecret))
-    throw new ConnectorError('that client secret is not sendable', 400);
-  return { clientId, ...(clientSecret === '' ? {} : { clientSecret }) };
-}
-
 function readClient(raw: unknown): OAuthClient | null {
   if (!isRecord(raw)) return null;
   const clientId = stringOf(raw.clientId);

package/runtime/node_modules/@metro-labs/daemon/src/connectors/enroll-api.ts

@@ -0,0 +1,101 @@
+import { createHash } from 'node:crypto';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { resolve } from 'node:path';
+import { parseId } from '@metro-labs/core/ids';
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { readJsonBody, sessionRoute, type ApiSession } from '@metro-labs/http/api-http';
+import { agentsDir } from '../agents/files.js';
+import { clearPendingAgentKey, newAgentKey, readPendingAgentKey, saveAgentKey, savePendingAgentKey, type AgentKey } from './agent-key.js';
+import { agentCall, METRO_API, MetroApiRefusal, type MetroApi } from './metro-api.js';
+
+const PATH = '/api/enrollment';
+const TICKET_RE = /^[A-Za-z0-9_-]{43}$/;
+const enrolling = new Set<string>();
+
+export interface EnrollApiDeps {
+  owner: () => string | null;
+  dir?: () => string;
+  api?: MetroApi;
+  invalidate?: () => void;
+}
+
+export interface Enrolled {
+  server: string;
+  organization: string;
+  keyId: string;
+}
+
+const differently = (): ApiError => new ApiError('api.metro.box enrolled this agent differently than Metro asked. Try enrolling again.', 503);
+
+function enrolledOf(value: Record<string, unknown>, key: AgentKey, owner: string): Enrolled {
+  const server = parseId(value.server);
+  if (server === null || value.organization !== owner || value.keyId !== key.keyId) throw differently();
+  return { server, organization: owner, keyId: key.keyId };
+}
+
+function sameOwner(deps: EnrollApiDeps, owner: string): void {
+  if (deps.owner() !== owner) throw new ApiError('This agent changed organizations during enrollment. Enroll it again from its current organization.', 409);
+}
+
+async function recover(api: MetroApi, key: AgentKey, owner: string): Promise<Enrolled | null> {
+  try {
+    return enrolledOf(await agentCall(api, key, '/api/agents/session'), key, owner);
+  } catch (err) {
+    if (err instanceof MetroApiRefusal && err.upstreamStatus === 401 && err.code === 'agent_key_missing') return null;
+    throw err;
+  }
+}
+
+function saveRecovered(pending: ReturnType<typeof readPendingAgentKey>, enrolled: Enrolled | null, ticketHash: string, api: MetroApi, dir: string): Enrolled | null {
+  if (pending === null || enrolled === null) return null;
+  if (pending.expectedServer !== null && pending.expectedServer !== enrolled.server) throw differently();
+  saveAgentKey(pending, { server: enrolled.server, organization: enrolled.organization, at: new Date(api.now()).toISOString() }, dir);
+  if (pending.ticketHash !== ticketHash) return null;
+  clearPendingAgentKey(dir);
+  return enrolled;
+}
+
+async function exchange(ticket: string, owner: string, dir: string, deps: EnrollApiDeps): Promise<Enrolled> {
+  const api = deps.api ?? METRO_API;
+  const pending = readPendingAgentKey(owner, dir);
+  const ticketHash = createHash('sha256').update(ticket).digest('base64url');
+  const recovered = pending === null ? null : await recover(api, pending, owner);
+  sameOwner(deps, owner);
+  const finished = saveRecovered(pending, recovered, ticketHash, api, dir);
+  if (finished !== null) return finished;
+  const key = pending?.ticketHash === ticketHash ? pending : newAgentKey();
+  if (key !== pending) savePendingAgentKey(key, owner, ticketHash, dir);
+  const enrolled = enrolledOf(await agentCall(api, key, '/api/agents/enroll', { ticket, organization: owner, signingKey: key.signingKey, sealingKey: key.sealingKey }), key, owner);
+  sameOwner(deps, owner);
+  savePendingAgentKey(key, owner, ticketHash, dir, enrolled.server);
+  const confirmed = enrolledOf(await agentCall(api, key, '/api/agents/session'), key, owner);
+  sameOwner(deps, owner);
+  if (confirmed.server !== enrolled.server) throw differently();
+  saveAgentKey(key, { server: enrolled.server, organization: owner, at: new Date(api.now()).toISOString() }, dir);
+  clearPendingAgentKey(dir);
+  log.info({ server: enrolled.server, organization: owner, keyId: key.keyId }, 'enrollment: this agent is enrolled with its organization on api.metro.box');
+  return enrolled;
+}
+
+async function enroll(req: IncomingMessage, session: ApiSession, deps: EnrollApiDeps): Promise<Enrolled> {
+  const body = await readJsonBody(req);
+  const ticket = isRecord(body) && typeof body.ticket === 'string' ? body.ticket : '';
+  if (!TICKET_RE.test(ticket)) throw new ApiError('enrolling needs the ticket api.metro.box gave for this agent', 400);
+  const owner = deps.owner();
+  if (owner === null || owner !== session.subject) throw new ApiError('this machine has no organization yet', 409);
+  const dir = resolve(deps.dir?.() ?? agentsDir());
+  if (enrolling.has(dir)) throw new ApiError('This agent is already enrolling. Wait for it to finish before trying again.', 409);
+  enrolling.add(dir);
+  try {
+    deps.invalidate?.();
+    return await exchange(ticket, owner, dir, deps);
+  } finally {
+    enrolling.delete(dir);
+  }
+}
+
+export function handleEnrollRequest(req: IncomingMessage, res: ServerResponse, deps: EnrollApiDeps): boolean {
+  return sessionRoute(req, res, { methods: { [PATH]: ['POST'] }, admin: true, label: 'enrollment' }, (session) => enroll(req, session, deps));
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/gates.ts

@@ -1,9 +1,11 @@
 import type { ToolGroup } from '@metro-labs/core/stations/types';
-import { policyFor, setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
+import { decide, policyFor, setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
 import { serverKeysOf } from './plugin-sync.js';
-import { NEEDS_APPROVAL, settlePrompts, takeGrant } from '../approvals/pending.js';
+import { NEEDS_APPROVAL, revokeToolPrompts, settlePrompts, takeGrant } from '../approvals/pending.js';
+import { isOrgRelayId } from './relay-id.js';
+import type { BlockedReason } from './relay-policy.js';
 
-interface GateRow {
+export interface GateRow {
   id: string;
   name: string;
   config: { policy?: ToolPolicy; toolGroups?: Record<string, ToolGroup> };
@@ -21,8 +23,20 @@ let gates: ConnectorGate[] = [];
 
 const normalized = (name: string): string => name.replace(/[^a-zA-Z0-9_-]/g, '_');
 
+function approvalChanged(gate: ConnectorGate, tool: string, next: GateRow | undefined, keys: Map<string, string>): boolean {
+  if (next === undefined || gate.server !== keys.get(gate.id) || JSON.stringify([gate.name, gate.policy]) !== JSON.stringify([next.name, next.config.policy ?? {}])) return true;
+  const before = decide(gate.policy, { name: tool, group: toolGroupOf(gate, tool) });
+  const after = decide(next.config.policy, { name: tool, group: next.config.toolGroups?.[tool] === 'read' ? 'read' : 'write' });
+  return before !== after;
+}
+
 export function registerConnectors(rows: readonly GateRow[]): void {
   const keys = serverKeysOf([...rows]);
+  revokeToolPrompts((tool) => {
+    const found = connectorToolOf(tool);
+    if (found === undefined || !isOrgRelayId(found.gate.id)) return false;
+    return approvalChanged(found.gate, found.tool, rows.find((row) => row.id === found.gate.id), keys);
+  });
   gates = rows.map((row) => ({
     id: row.id,
     name: row.name,
@@ -55,8 +69,30 @@ export function blockedReason(connectorId: string, tool: string, args: Record<st
   return NEEDS_APPROVAL(gate.name, tool);
 }
 
+export function requestConnectorBlocker(): () => BlockedReason {
+  const permits = new Map<string, number>();
+  return () => {
+    const seen = new Map<string, number>();
+    return (id, tool, args) => {
+      const gate = gates.find((entry) => entry.id === id);
+      if (gate === undefined) return 'This organization connector is not available.';
+      const group = toolGroupOf(gate, tool);
+      const access = policyFor({ kind: 'connector', id }, { name: tool, group });
+      if (access !== 'ask') return blockedReason(id, tool, args);
+      const key = JSON.stringify([id, gate.server, gate.policy, group, tool, args]);
+      const occurrence = seen.get(key) ?? 0;
+      seen.set(key, occurrence + 1);
+      if (occurrence < (permits.get(key) ?? 0)) return null;
+      const reason = blockedReason(id, tool, args);
+      if (reason === null) permits.set(key, (permits.get(key) ?? 0) + 1);
+      return reason;
+    };
+  };
+}
+
 function prefixesOf(gate: ConnectorGate): string[] {
-  return [`mcp__plugin_metro_${gate.server}__`, `mcp__${gate.server}__`, `mcp__${normalized(`metro.box ${gate.name}`)}__`];
+  const prefixes = [`mcp__plugin_metro_${gate.server}__`, `mcp__${gate.server}__`];
+  return isOrgRelayId(gate.id) ? prefixes : [...prefixes, `mcp__${normalized(`metro.box ${gate.name}`)}__`];
 }
 
 export function connectorToolOf(toolName: string): { gate: ConnectorGate; tool: string } | undefined {