@stage-labs/metro 0.1.0-beta.286 → 0.1.0-beta.288

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-runtime.ts

@@ -0,0 +1,246 @@
+import { log } from '@metro-labs/core/log';
+import type { FetchLike } from '@metro-labs/core/stations/oauth';
+import type { ToolGroup } from '@metro-labs/core/stations/types';
+import type { DeliveredConnector } from '@metro-labs/http/connector-delivery';
+import type { ApiError } from '@metro-labs/http/api-error';
+import { requestConnectorBlocker, type GateRow } from './gates.js';
+import { publishOrgConnectors } from './publication.js';
+import { isOrgRelayId, orgRelayId } from './relay-id.js';
+import type { RelaySession } from './relay-session.js';
+import type { RelayTarget } from './relay-target.js';
+import type { OrgConnectorSync } from './org-sync.js';
+import { discoverOrgGroups, orgMissing, orgRuntimeError, orgSignin, orgUnavailable } from './org-runtime-discovery.js';
+
+interface RuntimeDeps {
+  enabled?: () => boolean;
+  publish?: (rows: readonly GateRow[]) => void;
+  fetch?: FetchLike;
+}
+
+interface Entry {
+  id: string;
+  epoch: number;
+  stamp: string;
+  controller: AbortController;
+  groups: Record<string, ToolGroup>;
+  scan: Promise<void> | null;
+  nextScan: number;
+  error: ApiError | null;
+}
+
+interface Session {
+  entry: Entry;
+  controller: AbortController;
+  revision: string | null;
+  error: ApiError | null;
+}
+
+const stampOf = (row: DeliveredConnector): string => JSON.stringify([
+  row.name, row.url, row.auth, row.policy.read ?? 'allow', row.policy.write ?? 'allow',
+  Object.entries(row.policy.tools ?? {}).sort(([a], [b]) => a.localeCompare(b)),
+]);
+
+const rowError = (row: DeliveredConnector | undefined): ApiError | null => {
+  if (row === undefined) return orgMissing();
+  if (row.state === 'signin') return orgSignin();
+  return row.state === 'ready' ? null : orgUnavailable();
+};
+
+const targetOf = (row: DeliveredConnector): RelayTarget => ({ kind: 'ok', url: row.url, headers: { ...row.headers } });
+
+export class OrgConnectorRuntime {
+  private readonly entries = new Map<string, Entry>();
+  private readonly sessions = new Set<Session>();
+  private readonly unsubscribe: () => void;
+  private readonly timer: ReturnType<typeof setInterval>;
+  private published = '';
+  private stopped = false;
+  private scans = 0;
+
+  constructor(private readonly sync: OrgConnectorSync, private readonly deps: RuntimeDeps = {}) {
+    this.unsubscribe = sync.onChange(() => { this.update(); });
+    this.timer = setInterval(() => {
+      try {
+        this.update();
+      } catch {
+        log.warn('organization connectors: runtime metadata could not be updated');
+      }
+    }, 1000);
+    this.timer.unref();
+    this.update();
+  }
+
+  private enabled(): boolean {
+    return !this.stopped && (this.deps.enabled?.() ?? process.env.METRO_CONNECTORS_LIVE_ENABLED === 'true');
+  }
+
+  private abort(session: Session, error: ApiError): void {
+    session.error ??= error;
+    session.controller.abort();
+    this.sessions.delete(session);
+  }
+
+  private publish(rows: DeliveredConnector[]): void {
+    const metadata: GateRow[] = rows.filter((row) => row.state === 'ready').map((row) => ({
+      id: orgRelayId(row.id), name: row.name,
+      config: { policy: structuredClone(row.policy), toolGroups: { ...this.entries.get(row.id)?.groups } },
+    }));
+    const text = JSON.stringify(metadata);
+    if (text === this.published) return;
+    try {
+      (this.deps.publish ?? publishOrgConnectors)(metadata);
+      this.published = text;
+    } catch {
+      this.published = '';
+      for (const session of this.sessions) this.abort(session, orgUnavailable());
+      throw orgUnavailable();
+    }
+  }
+
+  private invalidateEntries(rows: DeliveredConnector[], epoch: number, available: boolean): void {
+    for (const [id, entry] of this.entries) {
+      const row = rows.find((value) => value.id === id);
+      const valid = available && entry.epoch === epoch;
+      if (valid && row?.state === 'ready' && entry.stamp === stampOf(row)) continue;
+      const error = valid ? rowError(row) ?? orgUnavailable() : orgUnavailable();
+      entry.controller.abort();
+      this.entries.delete(id);
+      this.abortEntry(entry, error);
+    }
+  }
+
+  private abortEntry(entry: Entry, error: ApiError): void {
+    for (const session of this.sessions) if (session.entry === entry) this.abort(session, error);
+  }
+
+  private update(): DeliveredConnector[] | null {
+    const snapshot = this.enabled() ? this.sync.read() : null;
+    const rows = snapshot?.connectors ?? [];
+    const epoch = this.sync.epoch();
+    this.invalidateEntries(rows, epoch, snapshot !== null);
+    for (const row of rows) {
+      if (row.state !== 'ready' || this.entries.has(row.id)) continue;
+      this.entries.set(row.id, { id: row.id, epoch, stamp: stampOf(row), controller: new AbortController(), groups: {}, scan: null, nextScan: 0, error: null });
+    }
+    this.publish(rows);
+    return snapshot === null ? null : rows;
+  }
+
+  private currentEntry(entry: Entry): DeliveredConnector {
+    const rows = this.update();
+    if (rows === null || entry.epoch !== this.sync.epoch()) throw orgUnavailable();
+    const row = rows.find((value) => value.id === entry.id);
+    if (row === undefined) throw orgMissing();
+    const error = rowError(row);
+    if (error !== null) throw error;
+    if (entry.controller.signal.aborted || this.entries.get(entry.id) !== entry) throw orgUnavailable();
+    return row;
+  }
+
+  private currentSession(session: Session): DeliveredConnector {
+    if (session.error !== null) throw session.error;
+    try {
+      return this.currentEntry(session.entry);
+    } catch (error) {
+      throw session.error ?? orgRuntimeError(error);
+    }
+  }
+
+  private async fresh(entry: Entry, refresh?: { connectorId: string; revision: string }): Promise<DeliveredConnector> {
+    this.currentEntry(entry);
+    try {
+      await this.sync.syncFresh(refresh);
+    } catch (error) {
+      throw orgRuntimeError(error);
+    }
+    return this.currentEntry(entry);
+  }
+
+  private async scan(entry: Entry): Promise<void> {
+    const row = this.currentEntry(entry);
+    const signal = AbortSignal.any([entry.controller.signal, AbortSignal.timeout(45_000)]);
+    const groups = await discoverOrgGroups(row.url, {
+      fresh: (revision) => this.fresh(entry, revision === undefined ? undefined : { connectorId: entry.id, revision }),
+      current: () => this.currentEntry(entry), signal, fetch: this.deps.fetch ?? fetch,
+    });
+    this.currentEntry(entry);
+    if (JSON.stringify(groups) !== JSON.stringify(entry.groups)) {
+      for (const session of this.sessions) if (session.entry === entry && session.revision !== null) this.abort(session, orgUnavailable());
+    }
+    entry.groups = groups;
+    entry.error = null;
+    entry.nextScan = performance.now() + 60_000;
+    this.update();
+  }
+
+  private discover(entry: Entry): Promise<void> | null {
+    if (entry.scan !== null) return entry.scan;
+    if (performance.now() < entry.nextScan) {
+      if (entry.error !== null) throw entry.error;
+      return null;
+    }
+    if (this.scans >= 4) throw orgUnavailable();
+    this.scans += 1;
+    entry.scan = this.scan(entry).catch((error: unknown) => {
+      entry.error = orgRuntimeError(error);
+      entry.nextScan = performance.now() + 30_000;
+      log.debug({ status: entry.error.status }, 'organization connectors: tool discovery failed');
+      throw entry.error;
+    }).finally(() => {
+      this.scans -= 1;
+      entry.scan = null;
+    });
+    return entry.scan;
+  }
+
+  private async target(session: Session, force: boolean): Promise<RelayTarget> {
+    this.currentSession(session);
+    if (force && session.revision === null) throw orgUnavailable();
+    const refresh = force && session.revision !== null ? { connectorId: session.entry.id, revision: session.revision } : undefined;
+    await this.fresh(session.entry, refresh);
+    this.currentSession(session);
+    const discovery = this.discover(session.entry);
+    if (discovery !== null) {
+      await discovery;
+      this.currentSession(session);
+      await this.fresh(session.entry);
+    }
+    return targetOf(this.currentSession(session));
+  }
+
+  open(id: string): RelaySession {
+    if (!isOrgRelayId(id)) throw orgMissing();
+    const rows = this.update();
+    if (rows === null) throw orgUnavailable();
+    const rawId = id.slice(4);
+    const error = rowError(rows.find((row) => row.id === rawId));
+    if (error !== null) throw error;
+    const entry = this.entries.get(rawId);
+    if (entry === undefined) throw orgUnavailable();
+    const session: Session = { entry, controller: new AbortController(), revision: null, error: null };
+    this.sessions.add(session);
+    const blocker = requestConnectorBlocker();
+    return {
+      target: (force) => this.target(session, force),
+      current: () => {
+        const row = this.currentSession(session);
+        session.revision = row.revision;
+        return targetOf(row);
+      },
+      blocker: () => {
+        this.currentSession(session);
+        return blocker();
+      },
+      signal: session.controller.signal,
+      close: () => { this.abort(session, orgUnavailable()); },
+    };
+  }
+
+  stop(): void {
+    if (this.stopped) return;
+    this.stopped = true;
+    this.unsubscribe();
+    clearInterval(this.timer);
+    this.update();
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync-watch.ts

@@ -0,0 +1,50 @@
+import { log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { METRO_API, type MetroApi } from './metro-api.js';
+import { OrgConnectorSync, type OrgSyncDeps } from './org-sync.js';
+import { OrgConnectorRuntime } from './org-runtime.js';
+import { isOrgRelayId } from './relay-id.js';
+import type { RelaySession } from './relay-session.js';
+
+const POLL_MS = 60_000;
+let active: OrgConnectorSync | null = null;
+let runtime: OrgConnectorRuntime | null = null;
+let timer: ReturnType<typeof setInterval> | null = null;
+
+const liveEnabled = (): boolean => process.env.METRO_CONNECTORS_LIVE_ENABLED === 'true';
+
+export function orgConnectorRelaySession(id: string): RelaySession | null {
+  if (!isOrgRelayId(id)) return null;
+  if (!liveEnabled() || runtime === null) throw new ApiError('Organization connectors are not available on this agent.', 503);
+  return runtime.open(id);
+}
+
+export function invalidateOrgConnectorSync(): void {
+  active?.invalidate();
+}
+
+export function stopOrgConnectorSync(): void {
+  if (timer !== null) clearInterval(timer);
+  timer = null;
+  runtime?.stop();
+  runtime = null;
+  active?.invalidate();
+  active = null;
+}
+
+export function watchOrgConnectorSync(deps: Pick<OrgSyncDeps, 'owner' | 'key'> & { api?: MetroApi }): void {
+  stopOrgConnectorSync();
+  const enabled = (): boolean => process.env.METRO_CONNECTORS_SYNC_ENABLED === 'true';
+  if (!enabled()) return;
+  const sync = new OrgConnectorSync({ ...deps, enabled, api: deps.api ?? METRO_API });
+  active = sync;
+  if (liveEnabled()) runtime = new OrgConnectorRuntime(sync, { enabled: liveEnabled });
+  const tick = (): void => {
+    sync.sync().catch((err: unknown) => {
+      log.warn({ status: err instanceof ApiError ? err.status : 503 }, 'organization connectors: memory sync failed; cached credentials were cleared');
+    });
+  };
+  tick();
+  timer = setInterval(tick, POLL_MS);
+  timer.unref();
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync.ts

@@ -0,0 +1,161 @@
+import { randomBytes } from 'node:crypto';
+import { log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { AGENT_CLOCK_SKEW_MS } from '@metro-labs/http/agent-signature';
+import { CONNECTOR_DELIVERY_LEASE_MS, CONNECTOR_DELIVERY_MAX_BYTES, openConnectorDelivery, type DeliveryContext, type DeliverySnapshot } from '@metro-labs/http/connector-delivery';
+import type { AgentKey } from './agent-key.js';
+import { agentCall, type MetroApi } from './metro-api.js';
+
+interface Identity {
+  key: AgentKey;
+  context: Omit<DeliveryContext, 'requestId'>;
+  token: string;
+}
+
+export interface OrgSyncDeps {
+  enabled: () => boolean;
+  owner: () => string | null;
+  key: () => AgentKey | null;
+  api: MetroApi;
+  monotonic?: () => number;
+}
+
+interface RefreshRequest {
+  connectorId: string;
+  revision: string;
+}
+
+const invalid = (): ApiError => new ApiError('Metro received an invalid or expired organization connector snapshot.', 503);
+
+function lease(snapshot: DeliverySnapshot, started: number, elapsed: number, now: number): number {
+  const duration = snapshot.expiresAt - snapshot.issuedAt;
+  if (duration <= 0 || duration > CONNECTOR_DELIVERY_LEASE_MS || snapshot.issuedAt > now + AGENT_CLOCK_SKEW_MS || snapshot.issuedAt < started - AGENT_CLOCK_SKEW_MS) throw invalid();
+  const expiries = snapshot.connectors.flatMap((row) => row.state === 'ready' && row.expiresAt !== undefined ? [row.expiresAt] : []);
+  const remaining = Math.min(duration, ...expiries.map((at) => at - snapshot.issuedAt)) - elapsed;
+  if (remaining <= 0) throw invalid();
+  return remaining;
+}
+
+export class OrgConnectorSync {
+  private snapshot: DeliverySnapshot | null = null;
+  private token: string | null = null;
+  private deadline = 0;
+  private wallDeadline = 0;
+  private generation = 0;
+  private running: Promise<void> | null = null;
+  private expiry: ReturnType<typeof setTimeout> | null = null;
+  private readonly monotonic: () => number;
+  private readonly listeners = new Set<() => void>();
+
+  constructor(private readonly deps: OrgSyncDeps) {
+    this.monotonic = deps.monotonic ?? (() => performance.now());
+  }
+
+  onChange(listener: () => void): () => void {
+    this.listeners.add(listener);
+    return () => { this.listeners.delete(listener); };
+  }
+
+  epoch(): number {
+    return this.generation;
+  }
+
+  private notify(): void {
+    for (const listener of [...this.listeners]) {
+      try {
+        listener();
+      } catch {
+        log.warn('organization connectors: a memory change listener failed');
+      }
+    }
+  }
+
+  private identity(): Identity | null {
+    if (!this.deps.enabled()) return null;
+    const owner = this.deps.owner();
+    const key = this.deps.key();
+    const enrollment = key?.enrollment;
+    if (owner === null || key === null || enrollment === null || enrollment === undefined || enrollment.organization !== owner) return null;
+    const context = { owner, agent: enrollment.server, keyId: key.keyId };
+    return { key, context, token: JSON.stringify(context) };
+  }
+
+  private forget(): void {
+    this.snapshot = null;
+    this.deadline = 0;
+    this.wallDeadline = 0;
+    if (this.expiry !== null) clearTimeout(this.expiry);
+    this.expiry = null;
+  }
+
+  invalidate(): void {
+    this.generation += 1;
+    this.token = null;
+    this.forget();
+    this.notify();
+  }
+
+  private validate(identity: Identity | null): void {
+    if (this.token === null) return;
+    if (identity === null || identity.token !== this.token || (this.snapshot !== null && (this.monotonic() >= this.deadline || this.deps.api.now() >= this.wallDeadline))) this.invalidate();
+  }
+
+  read(): DeliverySnapshot | null {
+    if (this.token === null) return null;
+    try {
+      this.validate(this.identity());
+    } catch {
+      this.invalidate();
+      log.warn('organization connectors: memory could not be checked and was cleared');
+    }
+    return this.snapshot === null ? null : structuredClone(this.snapshot);
+  }
+
+  async sync(refresh?: RefreshRequest): Promise<void> {
+    let identity: Identity | null;
+    try {
+      identity = this.identity();
+      this.validate(identity);
+    } catch (err) {
+      this.invalidate();
+      throw err;
+    }
+    if (identity === null) return;
+    if (this.running !== null) return refresh === undefined ? this.running : this.running.then(() => this.sync(refresh));
+    this.token = identity.token;
+    const generation = this.generation;
+    this.running = this.fetch(identity, refresh, generation).catch((err: unknown) => {
+      if (generation === this.generation) this.invalidate();
+      throw err;
+    }).finally(() => { this.running = null; });
+    return this.running;
+  }
+
+  async syncFresh(refresh?: RefreshRequest): Promise<void> {
+    if (this.running !== null) {
+      await this.running.catch(() => {
+        log.debug('organization connectors: a previous sync failed before a fresh check');
+      });
+    }
+    return this.sync(refresh);
+  }
+
+  private async fetch(identity: Identity, refresh: RefreshRequest | undefined, generation: number): Promise<void> {
+    const requestId = randomBytes(32).toString('base64url');
+    const context = { ...identity.context, requestId };
+    const started = this.deps.api.now();
+    const clock = this.monotonic();
+    const response = await agentCall(this.deps.api, identity.key, '/api/agents/connectors', { requestId, ...(refresh === undefined ? {} : { refresh }) }, { answerMax: CONNECTOR_DELIVERY_MAX_BYTES, timeoutMs: 60_000 });
+    this.validate(this.identity());
+    if (generation !== this.generation || this.token !== identity.token) throw invalid();
+    const snapshot = openConnectorDelivery(identity.key.sealing, context, response.sealed);
+    const remaining = lease(snapshot, started, this.monotonic() - clock, this.deps.api.now());
+    this.forget();
+    this.snapshot = snapshot;
+    this.deadline = this.monotonic() + remaining;
+    this.wallDeadline = this.deps.api.now() + remaining;
+    this.expiry = setTimeout(() => { this.invalidate(); }, remaining);
+    this.expiry.unref();
+    this.notify();
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/plugin-sync.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import { errMsg, log } from '@metro-labs/core/log';
 import { claudeDir } from '../claude/files.js';
 import { loopbackBase } from '../files/attach-serve.js';
+import { isOrgRelayId } from './relay-id.js';
 
 const MARKER = join('bin', 'metro-plugin.mjs');
 const FILE = '.mcp.json';
@@ -35,12 +36,21 @@ export function serverKey(name: string): string {
 export function serverKeysOf(rows: PluginRow[]): Map<string, string> {
   const taken = new Map<string, number>();
   const keys = new Map<string, string>();
-  for (const row of rows) {
+  for (const row of rows.filter((row) => !isOrgRelayId(row.id))) {
     const wanted = serverKey(row.name);
     const seen = taken.get(wanted) ?? 0;
     taken.set(wanted, seen + 1);
     keys.set(row.id, seen === 0 ? wanted : `${wanted}-${row.id.toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 4)}`);
   }
+  const reserved = new Set(keys.values());
+  for (const row of rows.filter((row) => isOrgRelayId(row.id)).sort((a, b) => a.id.localeCompare(b.id))) {
+    const wanted = `org-${serverKey(row.name).slice(0, 35)}-${Buffer.from(row.id.slice(4)).toString('hex')}`;
+    let key = wanted;
+    let suffix = 1;
+    while (reserved.has(key)) key = `${wanted}-${String(suffix++)}`;
+    reserved.add(key);
+    keys.set(row.id, key);
+  }
   return keys;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/publication.ts

@@ -0,0 +1,33 @@
+import { registerConnectors, type GateRow } from './gates.js';
+import { syncPluginServers } from './plugin-sync.js';
+import { isOrgRelayId } from './relay-id.js';
+
+let local: GateRow[] = [];
+let organization: GateRow[] = [];
+
+function metadata(rows: readonly GateRow[]): GateRow[] {
+  return rows.map((row) => structuredClone({
+    id: row.id,
+    name: row.name,
+    config: {
+      ...(row.config.policy === undefined ? {} : { policy: row.config.policy }),
+      ...(row.config.toolGroups === undefined ? {} : { toolGroups: row.config.toolGroups }),
+    },
+  }));
+}
+
+export function publishConnectors(): void {
+  const rows = [...local, ...organization];
+  registerConnectors(rows);
+  syncPluginServers(rows);
+}
+
+export function publishLocalConnectors(rows: readonly GateRow[]): void {
+  local = metadata(rows.filter((row) => !isOrgRelayId(row.id)));
+  publishConnectors();
+}
+
+export function publishOrgConnectors(rows: readonly GateRow[]): void {
+  organization = metadata(rows.filter((row) => isOrgRelayId(row.id)));
+  publishConnectors();
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay-id.ts

@@ -0,0 +1,2 @@
+export const orgRelayId = (id: string): string => `org-${id}`;
+export const isOrgRelayId = (id: string): boolean => /^org-[A-Za-z0-9][A-Za-z0-9_-]{10}$/.test(id);

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay-session.ts

@@ -0,0 +1,10 @@
+import type { BlockedReason } from './relay-policy.js';
+import type { RelayTarget } from './relay-target.js';
+
+export interface RelaySession {
+  target: (force: boolean) => Promise<RelayTarget>;
+  current: () => RelayTarget;
+  blocker: () => BlockedReason;
+  signal: AbortSignal;
+  close: () => void;
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay-target.ts

@@ -0,0 +1,4 @@
+export type RelayTarget =
+  | { kind: 'ok'; url: string; headers: Record<string, string> }
+  | { kind: 'missing' }
+  | { kind: 'signin' };

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay.ts

@@ -1,7 +1,10 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { whyUnreachable } from './reach.js';
+import { whyUnreachable } from '@metro-labs/http/connector-reach';
 import { noteHealth } from './health.js';
-import type { RelayTarget } from './store.js';
+import type { RelayTarget } from './relay-target.js';
+import type { RelaySession } from './relay-session.js';
+import { isOrgRelayId } from './relay-id.js';
+import { exchangeOrg } from './org-relay.js';
 import { ApiError } from '@metro-labs/http/api-error';
 import { errMsg, log } from '@metro-labs/core/log';
 import { answerBlocked, mergeBlocked, screenCalls, type BlockedReason } from './relay-policy.js';
@@ -11,9 +14,10 @@ export interface RelayApiDeps {
   identify: (req: IncomingMessage) => { subject: string; agentId: string } | null;
   signedOut: (connectorId: string) => void;
   blocked?: BlockedReason;
+  open?: (connectorId: string) => RelaySession | null;
 }
 
-const ID_PATH_RE = /^\/relay\/([A-Za-z0-9][A-Za-z0-9_-]{10})$/;
+const ID_PATH_RE = /^\/relay\/((?:org-)?[A-Za-z0-9][A-Za-z0-9_-]{10})$/;
 const METHODS = new Set(['POST', 'GET', 'DELETE']);
 const RELAY_BODY_MAX = 8 * 1024 * 1024;
 const FIRST_BYTE_MS = 120_000;
@@ -99,9 +103,10 @@ async function forward(
   target: { url: string; headers: Record<string, string> },
   body: Uint8Array<ArrayBuffer> | null,
   signal: AbortSignal,
+  sensitive = false,
 ): Promise<Response> {
   const firstByte = setTimeout(() => {
-    log.warn({ url: target.url }, 'relay: upstream sent no response in time');
+    log.warn(sensitive ? {} : { url: target.url }, 'relay: upstream sent no response in time');
   }, FIRST_BYTE_MS);
   firstByte.unref?.();
   try {
@@ -284,6 +289,16 @@ async function deliver(
   await pipe(res, out.upstream, answers);
 }
 
+async function relayOrg(req: IncomingMessage, res: ServerResponse, id: string, deps: RelayApiDeps, read: Uint8Array<ArrayBuffer> | null, signal: AbortSignal): Promise<void> {
+  const session = deps.open?.(id);
+  if (session === undefined || session === null) throw new ApiError('Organization connector tools are not switched on yet.', 503);
+  try {
+    const out = await exchangeOrg(id, session, read, signal, (target, body, guard) => forward(req, target, body, guard, true));
+    if (out.kind === 'blocked') answerBlocked(res, out.screened);
+    else await deliver(res, id, deps, out, out.answers);
+  } finally { session.close(); }
+}
+
 async function relayOnce(
   req: IncomingMessage,
   res: ServerResponse,
@@ -292,6 +307,7 @@ async function relayOnce(
   signal: AbortSignal,
 ): Promise<void> {
   const read = req.method === 'POST' ? await readCapped(req) : null;
+  if (isOrgRelayId(connectorId)) return relayOrg(req, res, connectorId, deps, read, signal);
   const screened = read === null || deps.blocked === undefined ? null : screenCalls(read, connectorId, deps.blocked);
   if (screened?.forward === null) {
     answerBlocked(res, screened);
@@ -316,6 +332,11 @@ function dispatch(
     .catch((err: unknown) => {
       if (err instanceof ApiError) {
         answer(res, err.status, { error: err.message });
+        if (!res.writableEnded) res.end();
+      } else if (isOrgRelayId(connectorId)) {
+        log.warn({ connector: connectorId }, 'organization relay: request failed');
+        answer(res, 503, { error: 'The organization connector is unavailable. Try again.' });
+        if (!res.writableEnded) res.end();
       } else {
         log.warn({ err: errMsg(err), connector: connectorId }, 'relay: failed');
         noteHealth(connectorId, false, `metro could not reach the connector: ${whyUnreachable(err)}`);