@stage-labs/metro 0.1.0-beta.288 → 0.1.0-beta.289

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.288",
+  "version": "0.1.0-beta.289",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.288",
+  "version": "0.1.0-beta.289",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/core/package.json

@@ -6,6 +6,7 @@
   "type": "module",
   "exports": {
     "./log": "./src/log.ts",
+    "./connector-sync": "./src/connector-sync.ts",
     "./events": "./src/events.ts",
     "./is-record": "./src/is-record.ts",
     "./runner-activity": "./src/runner-activity.ts",

package/runtime/node_modules/@metro-labs/core/src/connector-sync.ts

@@ -0,0 +1,17 @@
+export interface ConnectorSyncReceipt {
+  state: 'waiting' | 'received' | 'expired' | 'unavailable';
+  lastReceivedAt: number | null;
+  leaseExpiresAt: number | null;
+  counts: { total: number; ready: number; unavailable: number } | null;
+}
+
+export interface ConnectorSyncStatus extends Omit<ConnectorSyncReceipt, 'state'> {
+  enabled: boolean;
+  source: 'saved' | 'environment' | 'default' | 'invalid' | 'scope_changed';
+  enrolled: boolean;
+  owner: string | null;
+  agentId: string | null;
+  scope: string;
+  liveEnabled: boolean;
+  state: 'off' | 'not_enrolled' | ConnectorSyncReceipt['state'];
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/metro-api.ts

@@ -59,6 +59,7 @@ function refusal(status: number, value: unknown): ApiError {
 interface AgentCallOptions {
   answerMax?: number;
   timeoutMs?: number;
+  signal?: AbortSignal;
 }
 
 function signedCall(api: MetroApi, key: AgentKey, path: string, body: Record<string, unknown> | undefined): { url: URL; method: string; text: string; authorization: string } {
@@ -78,7 +79,7 @@ export async function agentCall(api: MetroApi, key: AgentKey, path: string, body
       headers: { authorization, ...(body === undefined ? {} : { 'content-type': 'application/json' }) },
       ...(body === undefined ? {} : { body: text }),
       redirect: 'error',
-      signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+      signal: AbortSignal.any([AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS), ...(options.signal === undefined ? [] : [options.signal])]),
     });
   } catch {
     throw unreachable();

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-preview.ts

@@ -8,6 +8,7 @@ import { connectorAuth, connectorClient, connectorName } from '@metro-labs/http/
 import { parseConnectorUrl } from '@metro-labs/http/connector-url';
 import { agentsDir } from '../agents/files.js';
 import { normalizePolicy, type ToolPolicy } from '../policy/policy.js';
+import { connectorSyncScope, syncOptedIn, syncSetting } from './org-sync-setting.js';
 import { readAgentKey } from './agent-key.js';
 import { migrationOrigin } from './migration-url.js';
 
@@ -191,7 +192,7 @@ function previewRows(dir: string): MigrationConnector[] {
 }
 
 export function connectorMigrationPreview(owner: string | null, dir = agentsDir()): ConnectorMigrationPreview {
-  const enabled = process.env.METRO_CONNECTORS_SYNC_ENABLED === 'true';
+  const enabled = syncOptedIn(dir) && syncSetting(dir, connectorSyncScope(owner, readAgentKey(dir))).enabled;
   const liveEnabled = process.env.METRO_CONNECTORS_LIVE_ENABLED === 'true';
   if (!enabled) return { enabled, enrolled: false, agentId: null, owner, liveEnabled, connectors: [] };
   const enrollment = owner === null ? null : readAgentKey(dir)?.enrollment;

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync-api.ts

@@ -0,0 +1,25 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { ConnectorSyncStatus } from '@metro-labs/core/connector-sync';
+import { isRecord } from '@metro-labs/core/is-record';
+import { ApiError } from '@metro-labs/http/api-error';
+import { readJsonBody, sessionRoute } from '@metro-labs/http/api-http';
+
+const PATH = '/api/connectors/sync';
+
+export interface ConnectorSyncApiDeps {
+  status: () => ConnectorSyncStatus;
+  set: (enabled: boolean, scope: string) => ConnectorSyncStatus;
+}
+
+export function handleConnectorSyncRequest(req: IncomingMessage, res: ServerResponse, deps: ConnectorSyncApiDeps): boolean {
+  return sessionRoute(req, res, { methods: { [PATH]: ['GET', 'PUT'] }, admin: true, label: 'connector-sync-api' }, async (session) => {
+    const body = req.method === 'PUT' ? await readJsonBody(req) : null;
+    const current = deps.status();
+    if (current.owner === null || current.owner !== session.subject) throw new ApiError('This agent belongs to another organization.', 403);
+    if (req.method !== 'PUT') return current;
+    if (!isRecord(body) || typeof body.enabled !== 'boolean' || typeof body.scope !== 'string' || !/^[a-f0-9]{64}$/.test(body.scope) || Object.keys(body).some((key) => key !== 'enabled' && key !== 'scope')) {
+      throw new ApiError('Sync needs an enabled flag and the current enrollment scope.', 400);
+    }
+    return deps.set(body.enabled, body.scope);
+  });
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync-control.ts

@@ -0,0 +1,138 @@
+import { createHash, randomBytes } from 'node:crypto';
+import type { ConnectorSyncStatus } from '@metro-labs/core/connector-sync';
+import { log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { agentsDir } from '../agents/files.js';
+import { METRO_API, type MetroApi } from './metro-api.js';
+import { OrgConnectorSync, type OrgSyncDeps } from './org-sync.js';
+import { OrgConnectorRuntime } from './org-runtime.js';
+import { connectorSyncScope, disableSavedSync, saveSyncSetting, syncOptedIn, syncSetting } from './org-sync-setting.js';
+import type { RelaySession } from './relay-session.js';
+
+type ControlDeps = Pick<OrgSyncDeps, 'owner' | 'key' | 'monotonic'> & { api?: MetroApi; dir?: string };
+type Context = Pick<ConnectorSyncStatus, 'owner' | 'agentId' | 'scope' | 'enrolled'>;
+const POLL_MS = 60_000;
+const liveEnabled = (): boolean => process.env.METRO_CONNECTORS_LIVE_ENABLED === 'true';
+const emptyReceipt = { lastReceivedAt: null, leaseExpiresAt: null, counts: null };
+
+export class OrgConnectorControl {
+  private readonly dir: string;
+  private readonly api: MetroApi;
+  private sync: OrgConnectorSync | null = null;
+  private runtime: OrgConnectorRuntime | null = null;
+  private scope: string | null = null;
+  private operation = randomBytes(16).toString('hex');
+  private timer: ReturnType<typeof setInterval> | null = null;
+
+  constructor(private readonly deps: ControlDeps) {
+    this.dir = deps.dir ?? agentsDir();
+    this.api = deps.api ?? METRO_API;
+  }
+
+  private context(): Context {
+    const owner = this.deps.owner();
+    const key = this.deps.key();
+    const enrollment = key?.enrollment;
+    const agentId = owner !== null && enrollment?.organization === owner ? enrollment.server : null;
+    const scope = connectorSyncScope(owner, key);
+    return { owner, agentId, scope, enrolled: agentId !== null };
+  }
+
+  private clear(): void {
+    this.sync?.invalidate();
+    this.sync = null;
+    const runtime = this.runtime;
+    this.runtime = null;
+    try {
+      runtime?.stop();
+    } catch {
+      log.warn('organization connectors: stopped runtime publication could not be cleared');
+    }
+  }
+
+  private reconcile(start: boolean): { context: Context; setting: ReturnType<typeof syncSetting> } {
+    const context = this.context();
+    if (this.scope !== null && this.scope !== context.scope) {
+      this.clear();
+      this.operation = randomBytes(16).toString('hex');
+      disableSavedSync(this.dir);
+    }
+    this.scope = context.scope;
+    const setting = syncSetting(this.dir, context.scope);
+    if (setting.source === 'scope_changed') disableSavedSync(this.dir);
+    if (!setting.enabled || !context.enrolled) this.clear();
+    else if (start && this.sync === null) {
+      const scope = context.scope;
+      this.sync = new OrgConnectorSync({ ...this.deps, api: this.api, enabled: () => this.context().scope === scope && syncSetting(this.dir, scope).enabled });
+      if (liveEnabled()) this.runtime = new OrgConnectorRuntime(this.sync, { enabled: liveEnabled });
+    }
+    return { context, setting };
+  }
+
+  status(): ConnectorSyncStatus {
+    try {
+      const { context, setting } = this.reconcile(false);
+      const receipt = this.sync?.status() ?? { state: 'waiting' as const, ...emptyReceipt };
+      const state = !setting.enabled ? 'off' : !context.enrolled ? 'not_enrolled' : receipt.state;
+      const scope = createHash('sha256').update(`${context.scope}:${this.operation}`).digest('hex');
+      return { ...context, ...setting, ...receipt, scope, state, liveEnabled: liveEnabled() };
+    } catch {
+      this.clear();
+      throw new ApiError('Metro could not read the connector sync status.', 503);
+    }
+  }
+
+  set(enabled: boolean, scope: string): ConnectorSyncStatus {
+    const current = this.status();
+    if (scope !== current.scope) throw new ApiError('The organization or enrollment changed. Refresh the sync status before trying again.', 409);
+    if (enabled && !current.enrolled) throw new ApiError('Enroll this agent with its organization before enabling sync.', 409);
+    if (enabled && liveEnabled()) throw new ApiError('Live organization tools are enabled separately on this server. Disable that setting before enabling memory-only sync here.', 409);
+    saveSyncSetting(this.dir, enabled, this.context().scope);
+    if (!enabled) this.clear();
+    else this.tick();
+    return this.status();
+  }
+
+  async poll(): Promise<void> {
+    if (this.sync === null && !syncOptedIn(this.dir)) return;
+    try {
+      this.reconcile(true);
+    } catch (err) {
+      this.clear();
+      throw err;
+    }
+    await this.sync?.sync();
+  }
+
+  private tick(): void {
+    this.poll().catch(() => {
+      log.warn('organization connectors: memory sync unavailable; cached credentials were cleared');
+    });
+  }
+
+  start(): void {
+    if (this.timer !== null) return;
+    this.tick();
+    this.timer = setInterval(() => { this.tick(); }, POLL_MS);
+    this.timer.unref();
+  }
+
+  invalidate(): void {
+    this.operation = randomBytes(16).toString('hex');
+    this.clear();
+    disableSavedSync(this.dir);
+  }
+
+  stop(): void {
+    if (this.timer !== null) clearInterval(this.timer);
+    this.timer = null;
+    this.clear();
+  }
+
+  open(id: string): RelaySession {
+    if (this.runtime === null) throw new ApiError('Organization connectors are not available on this agent.', 503);
+    this.reconcile(false);
+    if (!liveEnabled() || this.runtime === null) throw new ApiError('Organization connectors are not available on this agent.', 503);
+    return this.runtime.open(id);
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync-setting.ts

@@ -0,0 +1,60 @@
+import { createHash } from 'node:crypto';
+import type { AgentKey } from './agent-key.js';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import type { ConnectorSyncStatus } from '@metro-labs/core/connector-sync';
+import { isRecord } from '@metro-labs/core/is-record';
+import { writeSecure } from '@metro-labs/core/secure-fs';
+import { ApiError } from '@metro-labs/http/api-error';
+
+interface SavedSetting {
+  version: 1;
+  enabled: boolean;
+  scope: string;
+}
+
+type Stored = SavedSetting | 'absent' | 'invalid';
+const pathOf = (dir: string): string => join(dir, 'org-connector-sync.json');
+
+function read(dir: string): Stored {
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(pathOf(dir), 'utf8')) as unknown;
+  } catch (err) {
+    return isRecord(err) && err.code === 'ENOENT' ? 'absent' : 'invalid';
+  }
+  if (!isRecord(raw) || raw.version !== 1 || typeof raw.enabled !== 'boolean' || typeof raw.scope !== 'string' || !/^[a-f0-9]{64}$/.test(raw.scope)) return 'invalid';
+  return { version: 1, enabled: raw.enabled, scope: raw.scope };
+}
+
+export function connectorSyncScope(owner: string | null, key: AgentKey | null): string {
+  const agentId = owner !== null && key?.enrollment?.organization === owner ? key.enrollment.server : null;
+  return createHash('sha256').update(JSON.stringify([owner, agentId, key?.keyId ?? null, key?.sealingKey ?? null])).digest('hex');
+}
+
+export function syncOptedIn(dir: string): boolean {
+  const saved = read(dir);
+  if (saved === 'absent') return process.env.METRO_CONNECTORS_SYNC_ENABLED === 'true';
+  return saved !== 'invalid' && saved.enabled;
+}
+
+export function syncSetting(dir: string, scope: string): Pick<ConnectorSyncStatus, 'enabled' | 'source'> {
+  const saved = read(dir);
+  if (saved === 'invalid') return { enabled: false, source: 'invalid' };
+  if (saved === 'absent') return process.env.METRO_CONNECTORS_SYNC_ENABLED === 'true' ? { enabled: true, source: 'environment' } : { enabled: false, source: 'default' };
+  if (saved.scope !== scope) return { enabled: false, source: 'scope_changed' };
+  return { enabled: saved.enabled, source: 'saved' };
+}
+
+export function saveSyncSetting(dir: string, enabled: boolean, scope: string): void {
+  try {
+    writeSecure(pathOf(dir), `${JSON.stringify({ version: 1, enabled, scope })}\n`);
+  } catch {
+    throw new ApiError('Metro could not save the connector sync setting.', 503);
+  }
+}
+
+export function disableSavedSync(dir: string): void {
+  const saved = read(dir);
+  if (typeof saved !== 'string' && saved.enabled) saveSyncSetting(dir, false, saved.scope);
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync-watch.ts

@@ -1,22 +1,26 @@
-import { log } from '@metro-labs/core/log';
 import { ApiError } from '@metro-labs/http/api-error';
-import { METRO_API, type MetroApi } from './metro-api.js';
-import { OrgConnectorSync, type OrgSyncDeps } from './org-sync.js';
-import { OrgConnectorRuntime } from './org-runtime.js';
+import type { ConnectorSyncStatus } from '@metro-labs/core/connector-sync';
+import { OrgConnectorControl } from './org-sync-control.js';
 import { isOrgRelayId } from './relay-id.js';
 import type { RelaySession } from './relay-session.js';
 
-const POLL_MS = 60_000;
-let active: OrgConnectorSync | null = null;
-let runtime: OrgConnectorRuntime | null = null;
-let timer: ReturnType<typeof setInterval> | null = null;
+let active: OrgConnectorControl | null = null;
 
-const liveEnabled = (): boolean => process.env.METRO_CONNECTORS_LIVE_ENABLED === 'true';
+function control(): OrgConnectorControl {
+  if (active === null) throw new ApiError('Organization connector sync is unavailable. Restart Metro before trying again.', 503);
+  return active;
+}
 
 export function orgConnectorRelaySession(id: string): RelaySession | null {
-  if (!isOrgRelayId(id)) return null;
-  if (!liveEnabled() || runtime === null) throw new ApiError('Organization connectors are not available on this agent.', 503);
-  return runtime.open(id);
+  return isOrgRelayId(id) ? control().open(id) : null;
+}
+
+export function orgConnectorSyncStatus(): ConnectorSyncStatus {
+  return control().status();
+}
+
+export function setOrgConnectorSync(enabled: boolean, scope: string): ConnectorSyncStatus {
+  return control().set(enabled, scope);
 }
 
 export function invalidateOrgConnectorSync(): void {
@@ -24,27 +28,12 @@ export function invalidateOrgConnectorSync(): void {
 }
 
 export function stopOrgConnectorSync(): void {
-  if (timer !== null) clearInterval(timer);
-  timer = null;
-  runtime?.stop();
-  runtime = null;
-  active?.invalidate();
+  active?.stop();
   active = null;
 }
 
-export function watchOrgConnectorSync(deps: Pick<OrgSyncDeps, 'owner' | 'key'> & { api?: MetroApi }): void {
+export function watchOrgConnectorSync(deps: ConstructorParameters<typeof OrgConnectorControl>[0]): void {
   stopOrgConnectorSync();
-  const enabled = (): boolean => process.env.METRO_CONNECTORS_SYNC_ENABLED === 'true';
-  if (!enabled()) return;
-  const sync = new OrgConnectorSync({ ...deps, enabled, api: deps.api ?? METRO_API });
-  active = sync;
-  if (liveEnabled()) runtime = new OrgConnectorRuntime(sync, { enabled: liveEnabled });
-  const tick = (): void => {
-    sync.sync().catch((err: unknown) => {
-      log.warn({ status: err instanceof ApiError ? err.status : 503 }, 'organization connectors: memory sync failed; cached credentials were cleared');
-    });
-  };
-  tick();
-  timer = setInterval(tick, POLL_MS);
-  timer.unref();
+  active = new OrgConnectorControl(deps);
+  active.start();
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync.ts

@@ -1,5 +1,6 @@
 import { randomBytes } from 'node:crypto';
 import { log } from '@metro-labs/core/log';
+import type { ConnectorSyncReceipt } from '@metro-labs/core/connector-sync';
 import { ApiError } from '@metro-labs/http/api-error';
 import { AGENT_CLOCK_SKEW_MS } from '@metro-labs/http/agent-signature';
 import { CONNECTOR_DELIVERY_LEASE_MS, CONNECTOR_DELIVERY_MAX_BYTES, openConnectorDelivery, type DeliveryContext, type DeliverySnapshot } from '@metro-labs/http/connector-delivery';
@@ -39,6 +40,9 @@ function lease(snapshot: DeliverySnapshot, started: number, elapsed: number, now
 export class OrgConnectorSync {
   private snapshot: DeliverySnapshot | null = null;
   private token: string | null = null;
+  private controller: AbortController | null = null;
+  private receiptToken: string | null = null;
+  private receipt: ConnectorSyncReceipt = { state: 'waiting', lastReceivedAt: null, leaseExpiresAt: null, counts: null };
   private deadline = 0;
   private wallDeadline = 0;
   private generation = 0;
@@ -77,7 +81,7 @@ export class OrgConnectorSync {
     const enrollment = key?.enrollment;
     if (owner === null || key === null || enrollment === null || enrollment === undefined || enrollment.organization !== owner) return null;
     const context = { owner, agent: enrollment.server, keyId: key.keyId };
-    return { key, context, token: JSON.stringify(context) };
+    return { key, context, token: JSON.stringify([context, key.sealingKey]) };
   }
 
   private forget(): void {
@@ -88,8 +92,14 @@ export class OrgConnectorSync {
     this.expiry = null;
   }
 
-  invalidate(): void {
+  invalidate(reason: 'waiting' | 'expired' | 'unavailable' = 'waiting'): void {
     this.generation += 1;
+    this.controller?.abort();
+    this.controller = null;
+    if (reason === 'waiting') {
+      this.receiptToken = null;
+      this.receipt = { state: reason, lastReceivedAt: null, leaseExpiresAt: null, counts: null };
+    } else this.receipt = { ...this.receipt, state: reason, counts: null };
     this.token = null;
     this.forget();
     this.notify();
@@ -97,7 +107,8 @@ export class OrgConnectorSync {
 
   private validate(identity: Identity | null): void {
     if (this.token === null) return;
-    if (identity === null || identity.token !== this.token || (this.snapshot !== null && (this.monotonic() >= this.deadline || this.deps.api.now() >= this.wallDeadline))) this.invalidate();
+    if (identity === null || identity.token !== this.token) this.invalidate();
+    else if (this.snapshot !== null && (this.monotonic() >= this.deadline || this.deps.api.now() >= this.wallDeadline)) this.invalidate('expired');
   }
 
   read(): DeliverySnapshot | null {
@@ -111,6 +122,16 @@ export class OrgConnectorSync {
     return this.snapshot === null ? null : structuredClone(this.snapshot);
   }
 
+  status(): ConnectorSyncReceipt {
+    this.read();
+    try {
+      if (this.receiptToken !== null && this.identity()?.token !== this.receiptToken) this.invalidate();
+    } catch {
+      this.invalidate();
+    }
+    return structuredClone(this.receipt);
+  }
+
   async sync(refresh?: RefreshRequest): Promise<void> {
     let identity: Identity | null;
     try {
@@ -124,8 +145,9 @@ export class OrgConnectorSync {
     if (this.running !== null) return refresh === undefined ? this.running : this.running.then(() => this.sync(refresh));
     this.token = identity.token;
     const generation = this.generation;
-    this.running = this.fetch(identity, refresh, generation).catch((err: unknown) => {
-      if (generation === this.generation) this.invalidate();
+    this.controller = new AbortController();
+    this.running = this.fetch(identity, refresh, generation, this.controller.signal).catch((err: unknown) => {
+      if (generation === this.generation) this.invalidate('unavailable');
       throw err;
     }).finally(() => { this.running = null; });
     return this.running;
@@ -140,12 +162,12 @@ export class OrgConnectorSync {
     return this.sync(refresh);
   }
 
-  private async fetch(identity: Identity, refresh: RefreshRequest | undefined, generation: number): Promise<void> {
+  private async fetch(identity: Identity, refresh: RefreshRequest | undefined, generation: number, signal: AbortSignal): Promise<void> {
     const requestId = randomBytes(32).toString('base64url');
     const context = { ...identity.context, requestId };
     const started = this.deps.api.now();
     const clock = this.monotonic();
-    const response = await agentCall(this.deps.api, identity.key, '/api/agents/connectors', { requestId, ...(refresh === undefined ? {} : { refresh }) }, { answerMax: CONNECTOR_DELIVERY_MAX_BYTES, timeoutMs: 60_000 });
+    const response = await agentCall(this.deps.api, identity.key, '/api/agents/connectors', { requestId, ...(refresh === undefined ? {} : { refresh }) }, { answerMax: CONNECTOR_DELIVERY_MAX_BYTES, timeoutMs: 60_000, signal });
     this.validate(this.identity());
     if (generation !== this.generation || this.token !== identity.token) throw invalid();
     const snapshot = openConnectorDelivery(identity.key.sealing, context, response.sealed);
@@ -154,7 +176,11 @@ export class OrgConnectorSync {
     this.snapshot = snapshot;
     this.deadline = this.monotonic() + remaining;
     this.wallDeadline = this.deps.api.now() + remaining;
-    this.expiry = setTimeout(() => { this.invalidate(); }, remaining);
+    this.receiptToken = identity.token;
+    const total = snapshot.connectors.length;
+    const ready = snapshot.connectors.filter((row) => row.state === 'ready').length;
+    this.receipt = { state: 'received', lastReceivedAt: this.deps.api.now(), leaseExpiresAt: this.wallDeadline, counts: { total, ready, unavailable: total - ready } };
+    this.expiry = setTimeout(() => { this.invalidate('expired'); }, remaining);
     this.expiry.unref();
     this.notify();
   }

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -7,7 +7,7 @@ import { detachWithGmailRevocation } from './gmail-detach.js';
 import { recentSenders } from '../agents/senders.js';
 import { forwardTrainCall } from '../stations/train-call.js';
 import { publishLocalConnectors } from '../connectors/publication.js';
-import { invalidateOrgConnectorSync, orgConnectorRelaySession } from '../connectors/org-sync-watch.js';
+import { invalidateOrgConnectorSync, orgConnectorRelaySession, orgConnectorSyncStatus, setOrgConnectorSync } from '../connectors/org-sync-watch.js';
 import type { AgentApiDeps } from '../agents/api.js';
 import { ATTACHABLE, type AccountApiDeps } from '../agents/accounts-api.js';
 import type { SessionApis } from './session-apis.js';
@@ -205,6 +205,7 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
     agentApi: agentApi(deps),
     bundleApi: bundleApi(deps),
     connectorApi,
+    connectorSyncApi: { status: orgConnectorSyncStatus, set: setOrgConnectorSync },
     connectorTransfers: new ConnectorTransfers({ read: readLocalConnectors, copy: copyConnectorRows }),
     enrollApi: { owner: () => localOwner(), invalidate: invalidateOrgConnectorSync },
     relayApi,

package/runtime/node_modules/@metro-labs/daemon/src/routes/session-apis.ts

@@ -8,6 +8,7 @@ import {
 } from '../connectors/api.js';
 import type { RelayApiDeps } from '../connectors/relay.js';
 import type { ConnectorTransfers } from '../connectors/transfer-api.js';
+import { handleConnectorSyncRequest, type ConnectorSyncApiDeps } from '../connectors/org-sync-api.js';
 import { handleEnrollRequest, type EnrollApiDeps } from '../connectors/enroll-api.js';
 import { handleClaudeRequest, type ClaudeApiDeps } from '../claude/api.js';
 import type { ModeInfo } from '@metro-labs/http/mode-api';
@@ -39,6 +40,7 @@ export interface SessionApis {
   connectorApi?: ConnectorApiDeps;
   connectorTransfers?: ConnectorTransfers;
   enrollApi?: EnrollApiDeps;
+  connectorSyncApi?: ConnectorSyncApiDeps;
   relayApi?: RelayApiDeps;
   mode?: () => ModeInfo;
 }
@@ -57,6 +59,7 @@ export function handleSessionApis(
     () => handleApprovalsRequest(req, res),
     ...when(apis.connectorTransfers, (d) => d.handle(req, res)),
     ...when(apis.enrollApi, (d) => handleEnrollRequest(req, res, d)),
+    ...when(apis.connectorSyncApi, (d) => handleConnectorSyncRequest(req, res, d)),
     ...when(apis.connectorApi, (d) => handleConnectorApiRequest(req, res, d)),
     ...when(apis.bundleApi, (d) => handleBundleRequest(req, res, d)),
     ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.288"
+  "version": "0.1.0-beta.289"
 }

package/runtime/sdk-runner/node_modules/@metro-labs/core/package.json

@@ -6,6 +6,7 @@
   "type": "module",
   "exports": {
     "./log": "./src/log.ts",
+    "./connector-sync": "./src/connector-sync.ts",
     "./events": "./src/events.ts",
     "./is-record": "./src/is-record.ts",
     "./runner-activity": "./src/runner-activity.ts",

package/runtime/sdk-runner/node_modules/@metro-labs/core/src/connector-sync.ts

@@ -0,0 +1,17 @@
+export interface ConnectorSyncReceipt {
+  state: 'waiting' | 'received' | 'expired' | 'unavailable';
+  lastReceivedAt: number | null;
+  leaseExpiresAt: number | null;
+  counts: { total: number; ready: number; unavailable: number } | null;
+}
+
+export interface ConnectorSyncStatus extends Omit<ConnectorSyncReceipt, 'state'> {
+  enabled: boolean;
+  source: 'saved' | 'environment' | 'default' | 'invalid' | 'scope_changed';
+  enrolled: boolean;
+  owner: string | null;
+  agentId: string | null;
+  scope: string;
+  liveEnabled: boolean;
+  state: 'off' | 'not_enrolled' | ConnectorSyncReceipt['state'];
+}

package/runtime/sdk-runner/runner.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-beta.288",
+  "version": "0.1.0-beta.289",
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.287",
     "@modelcontextprotocol/sdk": "^1.29.0",