@stage-labs/metro 0.1.0-beta.287 → 0.1.0-beta.289

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.287",
+  "version": "0.1.0-beta.289",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.287",
+  "version": "0.1.0-beta.289",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/marketplace/plugin/bin/policy.mjs

@@ -51,7 +51,7 @@ function targets(snap, name, input) {
 
 function decide(policy, name, group) {
   if (!isRecord(policy)) return 'allow';
-  const byTool = isRecord(policy.tools) ? policy.tools[name] : undefined;
+  const byTool = isRecord(policy.tools) && Object.hasOwn(policy.tools, name) ? policy.tools[name] : undefined;
   const access = byTool ?? policy[group] ?? 'allow';
   return access in RANK ? access : 'allow';
 }
@@ -62,7 +62,8 @@ function connectorCall(snap, toolName) {
   for (const [server, entry] of Object.entries(isRecord(snap.connectors) ? snap.connectors : {})) {
     if (!isRecord(entry)) continue;
     const name = text(entry.name);
-    const prefixes = [`mcp__plugin_metro_${server}__`, `mcp__${server}__`, `mcp__${normalized(`metro.box ${name}`)}__`];
+    const prefixes = [`mcp__plugin_metro_${server}__`, `mcp__${server}__`];
+    if (!/^org-[A-Za-z0-9][A-Za-z0-9_-]{10}$/.test(text(entry.id))) prefixes.push(`mcp__${normalized(`metro.box ${name}`)}__`);
     const prefix = prefixes.find((p) => toolName.startsWith(p) && toolName.length > p.length);
     if (prefix === undefined) continue;
     const called = toolName.slice(prefix.length);

package/runtime/node_modules/@metro-labs/core/package.json

@@ -6,6 +6,7 @@
   "type": "module",
   "exports": {
     "./log": "./src/log.ts",
+    "./connector-sync": "./src/connector-sync.ts",
     "./events": "./src/events.ts",
     "./is-record": "./src/is-record.ts",
     "./runner-activity": "./src/runner-activity.ts",

package/runtime/node_modules/@metro-labs/core/src/connector-sync.ts

@@ -0,0 +1,17 @@
+export interface ConnectorSyncReceipt {
+  state: 'waiting' | 'received' | 'expired' | 'unavailable';
+  lastReceivedAt: number | null;
+  leaseExpiresAt: number | null;
+  counts: { total: number; ready: number; unavailable: number } | null;
+}
+
+export interface ConnectorSyncStatus extends Omit<ConnectorSyncReceipt, 'state'> {
+  enabled: boolean;
+  source: 'saved' | 'environment' | 'default' | 'invalid' | 'scope_changed';
+  enrolled: boolean;
+  owner: string | null;
+  agentId: string | null;
+  scope: string;
+  liveEnabled: boolean;
+  state: 'off' | 'not_enrolled' | ConnectorSyncReceipt['state'];
+}

package/runtime/node_modules/@metro-labs/daemon/src/approvals/pending.ts

@@ -138,6 +138,12 @@ export function cancelPrompt(requestId: string, owner: object): void {
   });
 }
 
+export function revokeToolPrompts(matches: (tool: string) => boolean): void {
+  grants = grants.filter((entry) => !matches(entry.tool));
+  for (const entry of held.values())
+    if (matches(entry.tool)) cancelPrompt(entry.requestId, entry.owner);
+}
+
 export function revokeCallPrompts(route: CallRoute): void {
   grants = grants.filter((entry) => entry.call === undefined || !sameCall(entry.call.route, route));
   for (const entry of held.values())

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -21,7 +21,9 @@ import {
   trainEventToMetroEvent,
 } from '../routes/http.js';
 import { agentsDir, fileSource } from '../agents/files.js';
-import { syncPluginServers } from '../connectors/plugin-sync.js';
+import { publishLocalConnectors } from '../connectors/publication.js';
+import { readAgentKey } from '../connectors/agent-key.js';
+import { stopOrgConnectorSync, watchOrgConnectorSync } from '../connectors/org-sync-watch.js';
 import { loadConnectorPolicies, readLocalConnectors } from '../connectors/store.js';
 import { ensureMetroPlugin } from '../claude/plugin-install.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
@@ -158,9 +160,10 @@ installBearerSessions(agentsDir(), localOwner);
   );
   metroMcp.startInbound();
   startPromptExpiry();
-  syncPluginServers(readLocalConnectors());
+  publishLocalConnectors(readLocalConnectors());
   startUploadReaper();
   startAttachReaper();
+  watchOrgConnectorSync({ owner: localOwner, key: readAgentKey });
   startCloudWatchPublisher();
   watchFallbackUsage();
   announceLocalEndpoint();
@@ -192,7 +195,7 @@ async function startClaude(): Promise<void> {
   ensureMetroPlugin()
     .then((outcome) => {
       log.info({ outcome }, 'plugin: metro plugin for Claude Code');
-      if (outcome !== 'skipped') syncPluginServers(readLocalConnectors());
+      if (outcome !== 'skipped') publishLocalConnectors(readLocalConnectors());
     })
     .catch((err: unknown) => {
       log.warn({ err: errMsg(err) }, 'plugin: could not ensure the Claude Code plugin');
@@ -212,6 +215,7 @@ async function shutdown(): Promise<void> {
   if (shuttingDown) return;
   shuttingDown = true;
   log.info('dispatcher shutting down');
+  stopOrgConnectorSync();
   const leaving = leaveCallsForShutdown();
   unwatchSession();
   tunnel?.stop();

package/runtime/node_modules/@metro-labs/daemon/src/connectors/agent-key.ts

@@ -0,0 +1,148 @@
+import { createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, type KeyObject } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { parseId } from '@metro-labs/core/ids';
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+import { ensureSecureDir } from '@metro-labs/core/secure-fs';
+import { agentKeyId, rawPublicKey } from '@metro-labs/http/agent-signature';
+import { ApiError } from '@metro-labs/http/api-error';
+import { isOrganizationId } from '@metro-labs/http/workos-token';
+import { agentsDir } from '../agents/files.js';
+
+const FILE = 'agent-key.json';
+
+export interface Enrollment {
+  server: string;
+  organization: string;
+  at: string;
+}
+
+export interface AgentKey {
+  keyId: string;
+  signingKey: string;
+  sealingKey: string;
+  signing: KeyObject;
+  sealing: KeyObject;
+  enrollment: Enrollment | null;
+}
+
+const pathOf = (dir: string): string => join(dir, FILE);
+
+function privateKeyOf(raw: unknown, type: 'ed25519' | 'x25519'): KeyObject | null {
+  if (typeof raw !== 'string' || raw === '') return null;
+  try {
+    const key = createPrivateKey({ key: Buffer.from(raw, 'base64'), format: 'der', type: 'pkcs8' });
+    return key.asymmetricKeyType === type ? key : null;
+  } catch {
+    return null;
+  }
+}
+
+function enrollmentOf(raw: unknown): Enrollment | null {
+  if (!isRecord(raw) || typeof raw.organization !== 'string' || typeof raw.at !== 'string') return null;
+  const server = parseId(raw.server);
+  return server !== null && isOrganizationId(raw.organization) ? { server, organization: raw.organization, at: raw.at } : null;
+}
+
+function agentKeyOf(signing: KeyObject, sealing: KeyObject, enrollment: Enrollment | null): AgentKey {
+  const signingKey = rawPublicKey(createPublicKey(signing));
+  return { keyId: agentKeyId(signingKey), signingKey, sealingKey: rawPublicKey(createPublicKey(sealing)), signing, sealing, enrollment };
+}
+
+const unreadable = (): null => {
+  log.warn('agent-key.json: Metro cannot read this agent key, so the agent must be enrolled again');
+  return null;
+};
+
+function storedOf(path: string): Record<string, unknown> | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return unreadable();
+  }
+  return isRecord(parsed) ? parsed : unreadable();
+}
+
+function keyOf(stored: Record<string, unknown> | null): AgentKey | null {
+  if (stored === null) return null;
+  const signing = privateKeyOf(stored.signing, 'ed25519');
+  const sealing = privateKeyOf(stored.sealing, 'x25519');
+  if (stored.version !== 1 || signing === null || sealing === null) return unreadable();
+  return agentKeyOf(signing, sealing, enrollmentOf(stored.enrollment));
+}
+
+export function readAgentKey(dir = agentsDir()): AgentKey | null {
+  const path = existsSync(pathOf(dir)) ? pathOf(dir) : join(dir, 'box-key.json');
+  return existsSync(path) ? keyOf(storedOf(path)) : null;
+}
+
+const pendingPath = (dir: string): string => join(dir, 'agent-key.pending.json');
+
+function pendingFields(stored: Record<string, unknown> | null): { owner: string; ticketHash: string; expectedServer: string | null } {
+  if (typeof stored?.ticketHash !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(stored.ticketHash) || typeof stored.owner !== 'string' || !isOrganizationId(stored.owner)) {
+    throw new ApiError('Metro cannot read the pending enrollment key. Restore its file or permissions before enrolling again.', 503);
+  }
+  const expectedServer = stored.expectedServer === undefined ? null : parseId(stored.expectedServer);
+  if (stored.expectedServer !== undefined && expectedServer === null) throw new ApiError('Metro cannot read the pending enrollment identity. Restore its file before enrolling again.', 503);
+  return { owner: stored.owner, ticketHash: stored.ticketHash, expectedServer };
+}
+
+export function readPendingAgentKey(owner: string, dir: string): (AgentKey & { ticketHash: string; expectedServer: string | null }) | null {
+  if (!existsSync(pendingPath(dir))) return null;
+  const stored = storedOf(pendingPath(dir));
+  const fields = pendingFields(stored);
+  const key = keyOf(stored);
+  if (key === null) throw new ApiError('Metro cannot read the pending enrollment key. Restore its file or permissions before enrolling again.', 503);
+  return fields.owner === owner ? { ...key, ticketHash: fields.ticketHash, expectedServer: fields.expectedServer } : null;
+}
+
+function flush(path: string): void {
+  const file = openSync(path, 'r');
+  try {
+    fsyncSync(file);
+  } finally {
+    closeSync(file);
+  }
+}
+
+function writeKey(path: string, stored: Record<string, unknown>): void {
+  const dir = dirname(path);
+  ensureSecureDir(dir);
+  const temp = `${path}.${randomBytes(12).toString('hex')}.tmp`;
+  const file = openSync(temp, 'wx', 0o600);
+  try {
+    try {
+      writeFileSync(file, `${JSON.stringify(stored, null, 2)}\n`);
+      fsyncSync(file);
+    } finally {
+      closeSync(file);
+    }
+    renameSync(temp, path);
+    flush(dir);
+  } finally {
+    rmSync(temp, { force: true });
+  }
+}
+
+export function clearPendingAgentKey(dir: string): void {
+  rmSync(pendingPath(dir), { force: true });
+  flush(dir);
+}
+
+export function newAgentKey(): AgentKey {
+  return agentKeyOf(generateKeyPairSync('ed25519').privateKey, generateKeyPairSync('x25519').privateKey, null);
+}
+
+const exported = (key: KeyObject): string => key.export({ format: 'der', type: 'pkcs8' }).toString('base64');
+
+const privateKeys = (key: AgentKey): Record<string, unknown> => ({ version: 1, signing: exported(key.signing), sealing: exported(key.sealing) });
+
+export function savePendingAgentKey(key: AgentKey, owner: string, ticketHash: string, dir: string, expectedServer?: string): void {
+  writeKey(pendingPath(dir), { ...privateKeys(key), owner, ticketHash, ...(expectedServer === undefined ? {} : { expectedServer }) });
+}
+
+export function saveAgentKey(key: AgentKey, enrollment: Enrollment, dir = agentsDir()): void {
+  writeKey(pathOf(dir), { ...privateKeys(key), enrollment });
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/api.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import { log } from '@metro-labs/core/log';
 import { healthOf } from './health.js';
 import type { RemoteTool } from './tools.js';
+import type { ConnectorMigrationPreview } from './migration-preview.js';
 import { normalizePolicy, type ToolPolicy } from '../policy/policy.js';
 import {
   apiFailure,
@@ -9,6 +10,7 @@ import {
   bodyField,
   cors,
   readJsonBody,
+  requireAdmin,
   sendJson,
   stringOf,
 } from '@metro-labs/http/api-http';
@@ -20,7 +22,7 @@ import {
   startOAuth,
   type OAuthRouteDeps,
 } from './oauth-routes.js';
-import { ConnectorUnauthorized } from './verify.js';
+import { ConnectorUnauthorized } from '@metro-labs/http/connector-url';
 import type {
   Connector,
   ConnectorCheck,
@@ -31,6 +33,7 @@ import type {
 const PREFIX = '/api/connectors';
 
 export interface ConnectorApiDeps extends OAuthRouteDeps {
+  migrationPreview?: () => ConnectorMigrationPreview;
   listConnectors: () => Promise<Connector[]>;
   createConnector: (input: ConnectorInput) => Promise<Connector>;
   verifyConnector: (id: string) => Promise<ConnectorCheck>;
@@ -43,6 +46,7 @@ export interface ConnectorApiDeps extends OAuthRouteDeps {
 
 type Routable =
   | { kind: 'collection' }
+  | { kind: 'migration-preview' }
   | { kind: 'callback' }
   | { kind: 'connector'; id: string }
   | { kind: 'verify'; id: string }
@@ -74,6 +78,7 @@ function target(path: string): Target {
   const head = segments[0];
   if (head === undefined) return { kind: 'collection' };
   if (head === 'callback' && segments.length === 1) return { kind: 'callback' };
+  if (head === 'migration-preview' && segments.length === 1) return { kind: 'migration-preview' };
   const id = parseId(head);
   return id === null ? { kind: 'unknown' } : subTarget(id, segments.slice(1));
 }
@@ -217,7 +222,7 @@ async function handlePolicy(
   sendJson(req, res, 200, connectorPayload(row));
 }
 
-type ById = Exclude<Routable['kind'], 'collection' | 'callback'>;
+type ById = Exclude<Routable['kind'], 'collection' | 'callback' | 'migration-preview'>;
 
 const BY_ID: Record<ById, (req: IncomingMessage, res: ServerResponse, deps: ConnectorApiDeps, id: string) => Promise<void>> = {
   verify: handleVerify,
@@ -239,6 +244,11 @@ async function route(
 ): Promise<void> {
   try {
     if (tgt.kind === 'callback') return;
+    if (tgt.kind === 'migration-preview') {
+      if (deps.migrationPreview === undefined) sendJson(req, res, 503, { error: 'Migration preview is unavailable.' });
+      else sendJson(req, res, 200, deps.migrationPreview());
+      return;
+    }
     if (tgt.kind !== 'collection') await BY_ID[tgt.kind](req, res, deps, tgt.id);
     else if (req.method === 'GET') await handleList(req, res, deps);
     else await handleCreate(req, res, deps);
@@ -249,6 +259,7 @@ async function route(
 
 const ALLOWED: Record<Routable['kind'], string[]> = {
   collection: ['GET', 'POST'],
+  'migration-preview': ['GET'],
   callback: ['GET'],
   connector: ['GET', 'DELETE'],
   verify: ['POST'],
@@ -274,6 +285,7 @@ async function dispatch(
     sendJson(req, res, 401, { error: 'unauthorized' });
     return;
   }
+  if (tgt.kind === 'migration-preview') requireAdmin(session);
   await route(req, res, deps, tgt);
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/config.ts

@@ -1,24 +1,14 @@
-import { ApiError } from '@metro-labs/http/api-error';
 import { stringOf } from '@metro-labs/http/api-http';
 import type {
   ConnectorAuth,
   VerifiedRecord,
   VerifiedServer,
-} from './verify.js';
-import type { OAuthClient } from './oauth-client.js';
+} from '@metro-labs/http/connector-mcp';
+import type { OAuthClient } from '@metro-labs/http/connector-oauth';
 import { isRecord } from '@metro-labs/core/is-record';
 import type { ToolGroup } from '@metro-labs/core/stations/types';
 import { parsePolicy, type ToolPolicy } from '../policy/policy.js';
 
-const CONNECTOR_NAME_MAX = 64;
-const HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;
-const HEADER_VALUE_RE = /^[\x20-\x7e]{1,4096}$/;
-const CLIENT_ID_RE = /^[\x21-\x7e]{1,256}$/;
-const CLIENT_SECRET_RE = /^[\x21-\x7e]{1,1024}$/;
-const DEFAULT_HEADER = 'Authorization';
-
-export class ConnectorError extends ApiError {}
-
 export type ConnectorSignIn = 'connected' | 'disconnected' | null;
 
 export interface ConnectorConfig {
@@ -31,66 +21,6 @@ export interface ConnectorConfig {
   toolGroups?: Record<string, ToolGroup>;
 }
 
-function hasControlChar(value: string): boolean {
-  for (const ch of value) {
-    const code = ch.codePointAt(0) ?? 0;
-    if (code < 0x20 || code === 0x7f) return true;
-  }
-  return false;
-}
-
-export function connectorName(raw: unknown): string {
-  const name = typeof raw === 'string' ? raw.trim() : '';
-  if (name === '') throw new ConnectorError('a connector needs a name', 400);
-  if (name.length > CONNECTOR_NAME_MAX)
-    throw new ConnectorError(
-      `a connector name must be ${String(CONNECTOR_NAME_MAX)} characters or fewer`,
-      400,
-    );
-  if (hasControlChar(name))
-    throw new ConnectorError(
-      'a connector name must not contain control characters',
-      400,
-    );
-  return name;
-}
-
-export function connectorAuth(
-  rawHeader: unknown,
-  rawValue: unknown,
-): ConnectorAuth {
-  const header = stringOf(rawHeader).trim();
-  const value = stringOf(rawValue).trim();
-  if (header === '' && value === '') return { kind: 'none' };
-  if (value === '')
-    throw new ConnectorError(
-      'that header has no value — give both a header name and its value, or neither',
-      400,
-    );
-  const name = header === '' ? DEFAULT_HEADER : header;
-  if (!HEADER_NAME_RE.test(name))
-    throw new ConnectorError('that is not a valid HTTP header name', 400);
-  if (!HEADER_VALUE_RE.test(value))
-    throw new ConnectorError('that header value is not sendable', 400);
-  return { kind: 'header', name, value };
-}
-
-export function connectorClient(
-  rawId: unknown,
-  rawSecret: unknown,
-): OAuthClient | null {
-  const clientId = stringOf(rawId).trim();
-  const clientSecret = stringOf(rawSecret).trim();
-  if (clientId === '' && clientSecret === '') return null;
-  if (clientId === '')
-    throw new ConnectorError('a client secret needs the client ID it belongs to', 400);
-  if (!CLIENT_ID_RE.test(clientId))
-    throw new ConnectorError('that is not a client ID Metro can send', 400);
-  if (clientSecret !== '' && !CLIENT_SECRET_RE.test(clientSecret))
-    throw new ConnectorError('that client secret is not sendable', 400);
-  return { clientId, ...(clientSecret === '' ? {} : { clientSecret }) };
-}
-
 function readClient(raw: unknown): OAuthClient | null {
   if (!isRecord(raw)) return null;
   const clientId = stringOf(raw.clientId);

package/runtime/node_modules/@metro-labs/daemon/src/connectors/enroll-api.ts

@@ -0,0 +1,101 @@
+import { createHash } from 'node:crypto';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { resolve } from 'node:path';
+import { parseId } from '@metro-labs/core/ids';
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { readJsonBody, sessionRoute, type ApiSession } from '@metro-labs/http/api-http';
+import { agentsDir } from '../agents/files.js';
+import { clearPendingAgentKey, newAgentKey, readPendingAgentKey, saveAgentKey, savePendingAgentKey, type AgentKey } from './agent-key.js';
+import { agentCall, METRO_API, MetroApiRefusal, type MetroApi } from './metro-api.js';
+
+const PATH = '/api/enrollment';
+const TICKET_RE = /^[A-Za-z0-9_-]{43}$/;
+const enrolling = new Set<string>();
+
+export interface EnrollApiDeps {
+  owner: () => string | null;
+  dir?: () => string;
+  api?: MetroApi;
+  invalidate?: () => void;
+}
+
+export interface Enrolled {
+  server: string;
+  organization: string;
+  keyId: string;
+}
+
+const differently = (): ApiError => new ApiError('api.metro.box enrolled this agent differently than Metro asked. Try enrolling again.', 503);
+
+function enrolledOf(value: Record<string, unknown>, key: AgentKey, owner: string): Enrolled {
+  const server = parseId(value.server);
+  if (server === null || value.organization !== owner || value.keyId !== key.keyId) throw differently();
+  return { server, organization: owner, keyId: key.keyId };
+}
+
+function sameOwner(deps: EnrollApiDeps, owner: string): void {
+  if (deps.owner() !== owner) throw new ApiError('This agent changed organizations during enrollment. Enroll it again from its current organization.', 409);
+}
+
+async function recover(api: MetroApi, key: AgentKey, owner: string): Promise<Enrolled | null> {
+  try {
+    return enrolledOf(await agentCall(api, key, '/api/agents/session'), key, owner);
+  } catch (err) {
+    if (err instanceof MetroApiRefusal && err.upstreamStatus === 401 && err.code === 'agent_key_missing') return null;
+    throw err;
+  }
+}
+
+function saveRecovered(pending: ReturnType<typeof readPendingAgentKey>, enrolled: Enrolled | null, ticketHash: string, api: MetroApi, dir: string): Enrolled | null {
+  if (pending === null || enrolled === null) return null;
+  if (pending.expectedServer !== null && pending.expectedServer !== enrolled.server) throw differently();
+  saveAgentKey(pending, { server: enrolled.server, organization: enrolled.organization, at: new Date(api.now()).toISOString() }, dir);
+  if (pending.ticketHash !== ticketHash) return null;
+  clearPendingAgentKey(dir);
+  return enrolled;
+}
+
+async function exchange(ticket: string, owner: string, dir: string, deps: EnrollApiDeps): Promise<Enrolled> {
+  const api = deps.api ?? METRO_API;
+  const pending = readPendingAgentKey(owner, dir);
+  const ticketHash = createHash('sha256').update(ticket).digest('base64url');
+  const recovered = pending === null ? null : await recover(api, pending, owner);
+  sameOwner(deps, owner);
+  const finished = saveRecovered(pending, recovered, ticketHash, api, dir);
+  if (finished !== null) return finished;
+  const key = pending?.ticketHash === ticketHash ? pending : newAgentKey();
+  if (key !== pending) savePendingAgentKey(key, owner, ticketHash, dir);
+  const enrolled = enrolledOf(await agentCall(api, key, '/api/agents/enroll', { ticket, organization: owner, signingKey: key.signingKey, sealingKey: key.sealingKey }), key, owner);
+  sameOwner(deps, owner);
+  savePendingAgentKey(key, owner, ticketHash, dir, enrolled.server);
+  const confirmed = enrolledOf(await agentCall(api, key, '/api/agents/session'), key, owner);
+  sameOwner(deps, owner);
+  if (confirmed.server !== enrolled.server) throw differently();
+  saveAgentKey(key, { server: enrolled.server, organization: owner, at: new Date(api.now()).toISOString() }, dir);
+  clearPendingAgentKey(dir);
+  log.info({ server: enrolled.server, organization: owner, keyId: key.keyId }, 'enrollment: this agent is enrolled with its organization on api.metro.box');
+  return enrolled;
+}
+
+async function enroll(req: IncomingMessage, session: ApiSession, deps: EnrollApiDeps): Promise<Enrolled> {
+  const body = await readJsonBody(req);
+  const ticket = isRecord(body) && typeof body.ticket === 'string' ? body.ticket : '';
+  if (!TICKET_RE.test(ticket)) throw new ApiError('enrolling needs the ticket api.metro.box gave for this agent', 400);
+  const owner = deps.owner();
+  if (owner === null || owner !== session.subject) throw new ApiError('this machine has no organization yet', 409);
+  const dir = resolve(deps.dir?.() ?? agentsDir());
+  if (enrolling.has(dir)) throw new ApiError('This agent is already enrolling. Wait for it to finish before trying again.', 409);
+  enrolling.add(dir);
+  try {
+    deps.invalidate?.();
+    return await exchange(ticket, owner, dir, deps);
+  } finally {
+    enrolling.delete(dir);
+  }
+}
+
+export function handleEnrollRequest(req: IncomingMessage, res: ServerResponse, deps: EnrollApiDeps): boolean {
+  return sessionRoute(req, res, { methods: { [PATH]: ['POST'] }, admin: true, label: 'enrollment' }, (session) => enroll(req, session, deps));
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/gates.ts

@@ -1,9 +1,11 @@
 import type { ToolGroup } from '@metro-labs/core/stations/types';
-import { policyFor, setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
+import { decide, policyFor, setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
 import { serverKeysOf } from './plugin-sync.js';
-import { NEEDS_APPROVAL, settlePrompts, takeGrant } from '../approvals/pending.js';
+import { NEEDS_APPROVAL, revokeToolPrompts, settlePrompts, takeGrant } from '../approvals/pending.js';
+import { isOrgRelayId } from './relay-id.js';
+import type { BlockedReason } from './relay-policy.js';
 
-interface GateRow {
+export interface GateRow {
   id: string;
   name: string;
   config: { policy?: ToolPolicy; toolGroups?: Record<string, ToolGroup> };
@@ -21,8 +23,20 @@ let gates: ConnectorGate[] = [];
 
 const normalized = (name: string): string => name.replace(/[^a-zA-Z0-9_-]/g, '_');
 
+function approvalChanged(gate: ConnectorGate, tool: string, next: GateRow | undefined, keys: Map<string, string>): boolean {
+  if (next === undefined || gate.server !== keys.get(gate.id) || JSON.stringify([gate.name, gate.policy]) !== JSON.stringify([next.name, next.config.policy ?? {}])) return true;
+  const before = decide(gate.policy, { name: tool, group: toolGroupOf(gate, tool) });
+  const after = decide(next.config.policy, { name: tool, group: next.config.toolGroups?.[tool] === 'read' ? 'read' : 'write' });
+  return before !== after;
+}
+
 export function registerConnectors(rows: readonly GateRow[]): void {
   const keys = serverKeysOf([...rows]);
+  revokeToolPrompts((tool) => {
+    const found = connectorToolOf(tool);
+    if (found === undefined || !isOrgRelayId(found.gate.id)) return false;
+    return approvalChanged(found.gate, found.tool, rows.find((row) => row.id === found.gate.id), keys);
+  });
   gates = rows.map((row) => ({
     id: row.id,
     name: row.name,
@@ -55,8 +69,30 @@ export function blockedReason(connectorId: string, tool: string, args: Record<st
   return NEEDS_APPROVAL(gate.name, tool);
 }
 
+export function requestConnectorBlocker(): () => BlockedReason {
+  const permits = new Map<string, number>();
+  return () => {
+    const seen = new Map<string, number>();
+    return (id, tool, args) => {
+      const gate = gates.find((entry) => entry.id === id);
+      if (gate === undefined) return 'This organization connector is not available.';
+      const group = toolGroupOf(gate, tool);
+      const access = policyFor({ kind: 'connector', id }, { name: tool, group });
+      if (access !== 'ask') return blockedReason(id, tool, args);
+      const key = JSON.stringify([id, gate.server, gate.policy, group, tool, args]);
+      const occurrence = seen.get(key) ?? 0;
+      seen.set(key, occurrence + 1);
+      if (occurrence < (permits.get(key) ?? 0)) return null;
+      const reason = blockedReason(id, tool, args);
+      if (reason === null) permits.set(key, (permits.get(key) ?? 0) + 1);
+      return reason;
+    };
+  };
+}
+
 function prefixesOf(gate: ConnectorGate): string[] {
-  return [`mcp__plugin_metro_${gate.server}__`, `mcp__${gate.server}__`, `mcp__${normalized(`metro.box ${gate.name}`)}__`];
+  const prefixes = [`mcp__plugin_metro_${gate.server}__`, `mcp__${gate.server}__`];
+  return isOrgRelayId(gate.id) ? prefixes : [...prefixes, `mcp__${normalized(`metro.box ${gate.name}`)}__`];
 }
 
 export function connectorToolOf(toolName: string): { gate: ConnectorGate; tool: string } | undefined {