@stage-labs/metro 0.1.0-beta.291 → 0.1.0-beta.293

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-preview.ts

@@ -5,6 +5,7 @@ import { isRecord } from '@metro-labs/core/is-record';
 import { ApiError } from '@metro-labs/http/api-error';
 import { bodyField } from '@metro-labs/http/api-http';
 import { connectorAuth, connectorClient, connectorName } from '@metro-labs/http/connector-input';
+import { portableGrant } from '@metro-labs/http/connector-grant';
 import { connectorPolicyOf } from '@metro-labs/http/connector-delivery';
 import { readConfig } from './config.js';
 import type { LocalConnectorRow } from './store.js';
@@ -12,9 +13,10 @@ import { agentsDir } from '../agents/files.js';
 import { normalizePolicy, type ToolPolicy } from '../policy/policy.js';
 import { connectorSyncScope, syncOptedIn, syncSetting } from './org-sync-setting.js';
 import { readAgentKey } from './agent-key.js';
+import { MigrationBlocked } from './migration-source.js';
 import { migrationOrigin } from './migration-url.js';
 
-export type MigrationIssue = 'invalid_config' | 'unsupported_url' | 'custom_policy' | 'oauth_sign_in' | 'header_reentry' | 'unused_oauth_client';
+export type MigrationIssue = 'invalid_config' | 'unsupported_url' | 'custom_policy' | 'oauth_sign_in' | 'header_reentry' | 'unused_oauth_client' | 'oauth_unsupported';
 
 export interface MigrationConnector {
   id: string;
@@ -29,6 +31,7 @@ export interface MigrationConnector {
 export interface ConnectorMigrationPreview {
   migrationSupported: true;
   oauthResourceSupported: true;
+  moveAllSupported: true;
   enabled: boolean;
   enrolled: boolean;
   agentId: string | null;
@@ -54,7 +57,7 @@ function validClient(raw: unknown): boolean {
 }
 
 function oauthAuth(raw: Record<string, unknown>): 'oauth' {
-  if (!onlyKeys(raw, ['kind', 'accessToken', 'refreshToken', 'clientId', 'clientSecret', 'tokenEndpoint', 'issuer', 'scope', 'expiresAt'])) invalid();
+  if (!onlyKeys(raw, ['kind', 'accessToken', 'refreshToken', 'clientId', 'clientSecret', 'tokenEndpoint', 'issuer', 'scope', 'expiresAt', 'resource', 'tokenEndpointAuthMethod'])) invalid();
   return 'oauth';
 }
 
@@ -145,8 +148,17 @@ function rowIdentity(row: Record<string, unknown>, index: number): { id: string;
   return { id: id ?? `invalid-${String(index + 1)}`, name: name ?? `Connector ${String(index + 1)}`, valid: id !== null && name !== null };
 }
 
+function grantIssues(row: Record<string, unknown>): MigrationIssue[] {
+  const grant = bodyField(row.config, 'auth');
+  if (!isRecord(grant) || grant.kind !== 'oauth') return ['oauth_sign_in'];
+  try {
+    const portable = portableGrant(grant, String(row.url));
+    return portable.expiresAt !== undefined && portable.expiresAt <= Date.now() && portable.refreshToken === undefined ? ['oauth_sign_in'] : [];
+  } catch { return ['oauth_unsupported']; }
+}
+
 function authIssues(row: Record<string, unknown>, auth: MigrationConnector['auth']): MigrationIssue[] {
-  if (auth === 'oauth') return ['oauth_sign_in'];
+  if (auth === 'oauth') return grantIssues(row);
   const client = bodyField(row.config, 'client');
   return (auth === 'none' || auth === 'header') && client !== undefined && client !== null ? ['unused_oauth_client'] : [];
 }
@@ -189,21 +201,25 @@ function previewRows(dir: string): MigrationConnector[] {
   const rows = readRows(dir).map(previewRow);
   const seen = new Map<string, MigrationConnector>();
   for (const row of rows) {
-    for (const key of [`id:${row.id}`, `name:${row.name}`]) {
-      const prior = seen.get(key);
-      if (prior !== undefined) {
-        for (const duplicate of [prior, row]) if (!duplicate.issues.includes('invalid_config')) duplicate.issues.push('invalid_config');
-      }
-      seen.set(key, row);
+    const prior = seen.get(row.id);
+    if (prior !== undefined) {
+      for (const duplicate of [prior, row]) if (!duplicate.issues.includes('invalid_config')) duplicate.issues.push('invalid_config');
     }
+    seen.set(row.id, row);
   }
   return rows;
 }
 
-export function migrationSource(id: string, dir = agentsDir()): LocalConnectorRow {
+function assertTransferable(source: MigrationConnector): void {
+  if (source.issues.includes('oauth_sign_in')) throw new MigrationBlocked('sign_in', 'No usable local OAuth grant is saved. Sign in locally before moving it.');
+  if (source.issues.includes('oauth_unsupported')) throw new MigrationBlocked('unsupported_grant', 'This OAuth grant has unsupported client authentication or provider binding. Keep it local or sign in separately.');
+}
+
+export function migrationSource(id: string, dir = agentsDir(), transfer = false): LocalConnectorRow {
   const source = previewRows(dir).find((row) => row.id === id);
   if (source === undefined) throw new ApiError('The local connector is missing.', 404);
-  if (source.issues.some((issue) => issue !== 'oauth_sign_in')) throw new ApiError('This connector cannot be migrated without changing its settings or permissions. Resolve the preview blockers first.', 409);
+  if (source.issues.some((issue) => issue !== 'oauth_sign_in' && issue !== 'oauth_unsupported')) throw new ApiError('This connector cannot be migrated without changing its settings or permissions. Resolve the preview blockers first.', 409);
+  if (transfer) assertTransferable(source);
   const raw = readRows(dir).find((row) => isRecord(row) && row.id === id);
   if (!isRecord(raw) || typeof raw.url !== 'string') throw unavailable();
   return { id, name: source.name, url: raw.url, config: { ...readConfig(raw.config), oauth: source.auth === 'oauth', policy: source.policy } };
@@ -212,8 +228,8 @@ export function migrationSource(id: string, dir = agentsDir()): LocalConnectorRo
 export function connectorMigrationPreview(owner: string | null, dir = agentsDir()): ConnectorMigrationPreview {
   const enabled = syncOptedIn(dir) && syncSetting(dir, connectorSyncScope(owner, readAgentKey(dir))).enabled;
   const liveEnabled = process.env.METRO_CONNECTORS_LIVE_ENABLED === 'true';
-  if (!enabled) return { migrationSupported: true, oauthResourceSupported: true, enabled, enrolled: false, agentId: null, owner, liveEnabled, connectors: [] };
+  if (!enabled) return { migrationSupported: true, oauthResourceSupported: true, moveAllSupported: true, enabled, enrolled: false, agentId: null, owner, liveEnabled, connectors: [] };
   const enrollment = owner === null ? null : readAgentKey(dir)?.enrollment;
   const agentId = enrollment?.organization === owner ? enrollment?.server ?? null : null;
-  return { migrationSupported: true, oauthResourceSupported: true, enabled, enrolled: agentId !== null, agentId, owner, liveEnabled, connectors: previewRows(dir) };
+  return { migrationSupported: true, oauthResourceSupported: true, moveAllSupported: true, enabled, enrolled: agentId !== null, agentId, owner, liveEnabled, connectors: previewRows(dir) };
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-source.ts

@@ -2,12 +2,17 @@ import { createHash } from 'node:crypto';
 import type { MigrationPayload } from '@metro-labs/http/connector-migration';
 import { connectorPolicyOf } from '@metro-labs/http/connector-delivery';
 import { ApiError } from '@metro-labs/http/api-error';
+import { portableGrant } from '@metro-labs/http/connector-grant';
 import { boundOAuthResource } from '@metro-labs/http/connector-public-url';
 import type { LocalConnectorRow } from './store.js';
 
-export function migrationPayload(row: LocalConnectorRow, oauthResource?: string): MigrationPayload {
+export class MigrationBlocked extends ApiError {
+  constructor(readonly reason: string, message: string) { super(message, 409); }
+}
+
+export function migrationPayload(row: LocalConnectorRow, oauthResource?: string, transfer = false): MigrationPayload {
   const oauth = row.config.oauth || row.config.auth.kind === 'oauth';
-  const auth = oauth ? { kind: 'oauth' as const } : row.config.auth;
+  const auth = sourceAuth(row, oauth, transfer);
   if (!oauth && oauthResource !== undefined) throw new ApiError('Only an OAuth connector accepts a public OAuth resource.', 400);
   return stamped({
     name: row.name, url: row.url, auth, client: row.config.client, policy: connectorPolicyOf(row.config.policy ?? {}),
@@ -15,6 +20,11 @@ export function migrationPayload(row: LocalConnectorRow, oauthResource?: string)
   });
 }
 
+function sourceAuth(row: LocalConnectorRow, oauth: boolean, transfer: boolean): MigrationPayload['auth'] {
+  if (!oauth) return row.config.auth;
+  return transfer ? { kind: 'oauth', grant: transferableGrant(row) } : { kind: 'oauth' };
+}
+
 function stamped(value: Omit<MigrationPayload, 'sourceStamp'>): MigrationPayload {
   const policy = value.policy;
   const canonical = {
@@ -24,3 +34,9 @@ function stamped(value: Omit<MigrationPayload, 'sourceStamp'>): MigrationPayload
   const sourceStamp = createHash('sha256').update(JSON.stringify(canonical)).digest('base64url');
   return { ...value, sourceStamp };
 }
+
+function transferableGrant(row: LocalConnectorRow): ReturnType<typeof portableGrant> {
+  if (row.config.auth.kind !== 'oauth') throw new MigrationBlocked('sign_in', 'This connector has no saved OAuth grant. Sign in locally before moving it.');
+  try { return portableGrant(row.config.auth, row.url); }
+  catch { throw new MigrationBlocked('unsupported_grant', 'This OAuth grant has unsupported client authentication or provider binding. Keep it local or sign in separately.'); }
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-state.ts

@@ -10,7 +10,7 @@ import { publicOAuthResource } from '@metro-labs/http/connector-public-url';
 import { agentsDir } from '../agents/files.js';
 import { captureMigrationOperations } from './migration-operations.js';
 
-export type MigrationPhase = 'preparing' | 'prepared' | 'cutover' | 'active' | 'rollback' | 'rolled_back';
+export type MigrationPhase = 'recovering' | 'freezing' | 'preparing' | 'prepared' | 'cutover' | 'active' | 'rollback' | 'rolled_back';
 export type MigrationAuth = 'none' | 'header' | 'oauth';
 
 export interface MigrationRecord {
@@ -24,14 +24,18 @@ export interface MigrationRecord {
   phase: MigrationPhase;
   auth: MigrationAuth;
   oauthResource?: string;
+  move?: boolean;
+  grantImported?: boolean;
+  captured?: boolean;
+  recoveryReceipt?: string;
   sourceStamp: string;
   policy: ConnectorPolicy;
   reason: string | null;
 }
 
-const phases: readonly MigrationPhase[] = ['preparing', 'prepared', 'cutover', 'active', 'rollback', 'rolled_back'];
+const phases: readonly MigrationPhase[] = ['recovering', 'freezing', 'preparing', 'prepared', 'cutover', 'active', 'rollback', 'rolled_back'];
 const auths: readonly MigrationAuth[] = ['none', 'header', 'oauth'];
-const fields = ['id', 'owner', 'agentId', 'keyId', 'sourceId', 'name', 'destinationId', 'phase', 'auth', 'oauthResource', 'sourceStamp', 'policy', 'reason'];
+const fields = ['id', 'owner', 'agentId', 'keyId', 'sourceId', 'name', 'destinationId', 'phase', 'auth', 'oauthResource', 'sourceStamp', 'policy', 'reason', 'move', 'grantImported', 'captured', 'recoveryReceipt'];
 const unavailable = (): ApiError => new ApiError('Protected connector migration records cannot be read. Restore their file or permissions before using connectors.', 503);
 const DIGEST = /^[A-Za-z0-9_-]{43}$/;
 const pathOf = (dir: string): string => join(dir, 'connector-migrations.json');
@@ -48,12 +52,25 @@ function field(value: unknown, pattern: RegExp): string {
   return value;
 }
 
+function movementOf(value: Record<string, unknown>): Pick<MigrationRecord, 'move' | 'grantImported' | 'captured' | 'recoveryReceipt'> {
+  const result: Pick<MigrationRecord, 'move' | 'grantImported' | 'captured' | 'recoveryReceipt'> = {};
+  for (const key of ['move', 'grantImported', 'captured'] as const) {
+    const flag = value[key];
+    if (flag === undefined) continue;
+    if (typeof flag !== 'boolean') throw unavailable();
+    result[key] = flag;
+  }
+  if (value.recoveryReceipt !== undefined) result.recoveryReceipt = field(value.recoveryReceipt, /^[a-f0-9]{64}$/);
+  return result;
+}
+
 function recordOf(value: unknown): MigrationRecord {
   if (!isRecord(value) || Object.keys(value).some((key) => !fields.includes(key))) throw unavailable();
   const phase = phases.find((item) => item === value.phase);
   const auth = auths.find((item) => item === value.auth);
   if (phase === undefined || auth === undefined || (value.oauthResource !== undefined && auth !== 'oauth')) throw unavailable();
   return {
+    ...movementOf(value),
     ...(value.oauthResource === undefined ? {} : { oauthResource: publicOAuthResource(value.oauthResource) }),
     id: requiredId(value.id), sourceId: requiredId(value.sourceId), agentId: requiredId(value.agentId),
     owner: field(value.owner, /^org_[A-Za-z0-9]{1,128}$/), keyId: field(value.keyId, DIGEST), sourceStamp: field(value.sourceStamp, DIGEST),

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth-routes.ts

@@ -51,7 +51,7 @@ export async function startOAuth(
       returnTo,
     }, operation.fetch);
     const row = await deps.createPendingConnector({
-      name: bodyField(body, 'name'),
+      name,
       url: bodyField(body, 'url'),
       clientId,
       clientSecret,
@@ -69,7 +69,7 @@ export async function startOAuth(
       'connector-api: stored unconnected, sending the user to sign in',
     );
     sendJson(req, res, 201, { ...payload(row), authorizeUrl: authorize });
-  }, true, name);
+  }, true);
 }
 
 export async function handleConnect(

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth.ts

@@ -102,6 +102,7 @@ function authOf(pendingAuth: PendingAuth, tokens: OAuthTokens): OAuthAuth {
     kind: 'oauth',
     issuer: pendingAuth.server.issuer,
     tokenEndpoint: pendingAuth.server.tokenEndpoint,
+    resource: pendingAuth.resource,
     clientId: pendingAuth.client.clientId,
     ...(pendingAuth.client.clientSecret === undefined
       ? {}
@@ -156,7 +157,7 @@ export async function refreshOAuth(
     server,
     client,
     auth.refreshToken,
-    resource,
+    auth.resource ?? resource,
     auth.scope,
     send,
   );

package/runtime/node_modules/@metro-labs/daemon/src/connectors/plugin-sync.ts

@@ -33,21 +33,48 @@ export function serverKey(name: string): string {
   return slug === '' ? 'connector' : slug;
 }
 
-export function serverKeysOf(rows: PluginRow[]): Map<string, string> {
+function legacyOwners(rows: PluginRow[], published: PluginRow[]): Map<string, string> {
+  const visible = new Set(published.map((row) => row.id));
   const taken = new Map<string, number>();
-  const keys = new Map<string, string>();
-  for (const row of rows.filter((row) => !isOrgRelayId(row.id))) {
-    const wanted = serverKey(row.name);
-    const seen = taken.get(wanted) ?? 0;
-    taken.set(wanted, seen + 1);
-    keys.set(row.id, seen === 0 ? wanted : `${wanted}-${row.id.toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 4)}`);
+  const owners = new Map<string, string>();
+  const reserved = new Set<string>();
+  for (const row of rows.filter((entry) => !isOrgRelayId(entry.id))) {
+    const slug = serverKey(row.name);
+    const seen = taken.get(slug) ?? 0;
+    taken.set(slug, seen + 1);
+    const key = seen === 0 ? slug : `${slug}-${row.id.toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 4)}`;
+    reserved.add(key);
+    if (visible.has(row.id)) owners.set(key, row.id);
+  }
+  for (const row of rows.filter((entry) => isOrgRelayId(entry.id) && visible.has(entry.id)).sort((a, b) => a.id.localeCompare(b.id))) {
+    const key = availableKey(orgKey(row), reserved);
+    reserved.add(key);
+    owners.set(key, row.id);
   }
+  return new Map([...owners].map(([key, id]) => [id, key]));
+}
+
+const orgKey = (row: PluginRow): string => `org-${serverKey(row.name).slice(0, 35)}-${Buffer.from(row.id.slice(4)).toString('hex')}`;
+
+function availableKey(wanted: string, reserved: ReadonlySet<string>): string {
+  let key = wanted;
+  let suffix = 1;
+  while (reserved.has(key)) key = `${wanted}-${String(suffix++)}`;
+  return key;
+}
+
+export function serverKeysOf(rows: PluginRow[], saved?: ReadonlyMap<string, string>, published: PluginRow[] = rows): Map<string, string> {
+  const keys = new Map(saved ?? legacyOwners(rows, published));
   const reserved = new Set(keys.values());
-  for (const row of rows.filter((row) => isOrgRelayId(row.id)).sort((a, b) => a.id.localeCompare(b.id))) {
-    const wanted = `org-${serverKey(row.name).slice(0, 35)}-${Buffer.from(row.id.slice(4)).toString('hex')}`;
-    let key = wanted;
-    let suffix = 1;
-    while (reserved.has(key)) key = `${wanted}-${String(suffix++)}`;
+  const local = rows.filter((row) => !isOrgRelayId(row.id));
+  const organization = rows.filter((row) => isOrgRelayId(row.id)).sort((a, b) => a.id.localeCompare(b.id));
+  for (const row of [...local, ...organization]) {
+    if (keys.has(row.id)) continue;
+    const slug = serverKey(row.name);
+    const wanted = isOrgRelayId(row.id)
+      ? orgKey(row)
+      : reserved.has(slug) ? `${slug}-${row.id.toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 4)}` : slug;
+    const key = availableKey(wanted, reserved);
     reserved.add(key);
     keys.set(row.id, key);
   }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/publication.ts

@@ -1,5 +1,6 @@
 import { registerConnectors, type GateRow } from './gates.js';
-import { serverKeysOf, syncPluginServers } from './plugin-sync.js';
+import { syncPluginServers } from './plugin-sync.js';
+import { persistentServerKeys } from './server-keys.js';
 import { isOrgRelayId } from './relay-id.js';
 import { migrationRecords } from './migration-state.js';
 
@@ -17,14 +18,7 @@ function metadata(rows: readonly GateRow[]): GateRow[] {
   }));
 }
 
-export function publishConnectors(): void {
-  let records: ReturnType<typeof migrationRecords>;
-  try { records = migrationRecords().filter((record) => record.phase !== 'rolled_back'); }
-  catch (error) {
-    registerConnectors([], local.map((row) => row.id));
-    syncPluginServers([]);
-    throw error;
-  }
+function publishedRows(records: ReturnType<typeof migrationRecords>): GateRow[] {
   const retired = new Set(records.filter((record) => !['preparing', 'prepared'].includes(record.phase)).map((record) => record.sourceId));
   const aliases = new Map(organization.filter((row) => records.some((record) => record.phase === 'active' && record.sourceId === row.id && record.name === row.name)).map((row) => [row.id, row]));
   const rows = local.flatMap((row) => {
@@ -32,8 +26,25 @@ export function publishConnectors(): void {
     return alias !== undefined ? [alias] : retired.has(row.id) ? [] : [row];
   });
   rows.push(...organization.filter((row) => isOrgRelayId(row.id) && !records.some((record) => row.id === `org-${record.destinationId ?? ''}`)));
-  const keys = serverKeysOf([...local, ...rows.filter((row) => isOrgRelayId(row.id))]);
-  registerConnectors(rows, [...retired, ...aliases.keys()], keys);
+  return rows;
+}
+
+export function publishConnectors(): void {
+  let rows: GateRow[];
+  let keys: Map<string, string>;
+  try {
+    const records = migrationRecords().filter((record) => record.phase !== 'rolled_back');
+    rows = publishedRows(records);
+    const active = new Set(records.filter((record) => record.phase === 'active').map((record) => record.sourceId));
+    const reserved = [...rows, ...local.filter((row) => active.has(row.id))];
+    keys = persistentServerKeys([...local, ...organization.filter((row) => isOrgRelayId(row.id))], undefined, reserved);
+  }
+  catch (error) {
+    registerConnectors([]);
+    syncPluginServers([]);
+    throw error;
+  }
+  registerConnectors(rows, keys);
   syncPluginServers(rows, { keys });
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay-passive.ts

@@ -0,0 +1,96 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { JSONRPCNotificationSchema, ServerNotificationSchema } from '@modelcontextprotocol/sdk/types.js';
+import { isRecord } from '@metro-labs/core/is-record';
+import type { MigrationOperation } from './migration-operations.js';
+
+export const isRelaySse = (contentType: string | null | undefined): boolean => /^text\/event-stream\s*(?:;|$)/i.test(contentType ?? '');
+const MAX_FRAME = 64 * 1024;
+const NOTIFICATIONS = new Set(['notifications/tools/list_changed', 'notifications/resources/list_changed', 'notifications/prompts/list_changed', 'notifications/resources/updated', 'notifications/message']);
+
+export class PassiveSseListener {
+  forwarding = false;
+  private pending: Buffer[] = [];
+  private length = 0;
+  private data: string[] = [];
+  private fields = false;
+  private size = 0;
+  private unsafe = false;
+  private skipLf = false;
+  private first = true;
+  private readonly decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+
+  idle(): boolean { return !this.unsafe && this.length === 0 && !this.fields && !this.forwarding; }
+  keepaliveAllowed(): boolean { return this.unsafe || this.idle(); }
+
+  observe(chunk: Uint8Array): void {
+    if (this.unsafe) return;
+    this.scan(chunk);
+    if (this.unsafe) { this.pending = []; this.length = 0; this.data = []; }
+  }
+
+  private append(bytes: Uint8Array): void {
+    this.length += bytes.length;
+    if (this.length + this.size > MAX_FRAME) this.unsafe = true;
+    else if (bytes.length > 0) this.pending.push(Buffer.from(bytes));
+  }
+
+  private scan(bytes: Uint8Array): void {
+    let start = 0;
+    for (let at = 0; at < bytes.length; at += 1) {
+      if (at - start + this.length + this.size > MAX_FRAME) { this.unsafe = true; return; }
+      const byte = bytes[at];
+      if (this.skipLf && byte === 10) { this.skipLf = false; start = at + 1; continue; }
+      this.skipLf = false;
+      if (byte !== 10 && byte !== 13) continue;
+      this.append(bytes.subarray(start, at));
+      try { this.line(this.decoder.decode(Buffer.concat(this.pending, this.length)), this.length); }
+      catch { this.unsafe = true; }
+      this.pending = []; this.length = 0;
+      this.skipLf = byte === 13;
+      start = at + 1;
+      if (this.unsafe) return;
+    }
+    this.append(bytes.subarray(start));
+  }
+
+  private line(raw: string, length: number): void {
+    const line = this.first && raw.charCodeAt(0) === 0xfeff ? raw.slice(1) : raw;
+    this.first = false;
+    if (line === '') {
+      if (this.data.length > 0 && !this.notification()) this.unsafe = true;
+      this.data = []; this.fields = false; this.size = 0;
+      return;
+    }
+    if (line.startsWith(':')) return;
+    this.size += length;
+    if (this.size > MAX_FRAME) { this.unsafe = true; return; }
+    this.fields = true;
+    const colon = line.indexOf(':');
+    const field = colon < 0 ? line : line.slice(0, colon);
+    const value = colon < 0 ? '' : line.slice(colon + 1).replace(/^ /, '');
+    this.field(field, value);
+  }
+
+  private field(field: string, value: string): void {
+    if (field === 'data') this.data.push(value);
+    else if (field === 'event') { if (value !== '' && value !== 'message') this.unsafe = true; }
+    else if (field === 'retry') { if (!/^\d+$/.test(value)) this.unsafe = true; }
+    else this.unsafe = true;
+  }
+
+  private notification(): boolean {
+    const text = this.data.join('\n');
+    if (text === '') return true;
+    const value: unknown = JSON.parse(text);
+    return isRecord(value) && typeof value.method === 'string' && NOTIFICATIONS.has(value.method)
+      && JSONRPCNotificationSchema.safeParse(value).success && ServerNotificationSchema.safeParse(value).success;
+  }
+}
+
+export function passiveRelayListener(req: IncomingMessage, res: ServerResponse, upstream: Response, operation: MigrationOperation, stop: () => void): PassiveSseListener | undefined {
+  if (req.method !== 'GET' || req.headers['last-event-id'] !== undefined || req.headers['transfer-encoding'] !== undefined || Number(req.headers['content-length'] ?? 0) !== 0) return undefined;
+  if (upstream.status !== 200 || upstream.body === null || !isRelaySse(upstream.headers.get('content-type'))) return undefined;
+  const listener = new PassiveSseListener();
+  operation.passiveListener({ idle: () => listener.idle() && res.writableLength === 0 && !res.destroyed, stop });
+  return listener;
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay.ts

@@ -3,6 +3,7 @@ import { whyUnreachable } from '@metro-labs/http/connector-reach';
 import { noteHealth } from './health.js';
 import type { RelayTarget } from './relay-target.js';
 import type { RelaySession } from './relay-session.js';
+import { isRelaySse, passiveRelayListener, type PassiveSseListener } from './relay-passive.js';
 import { isOrgRelayId } from './relay-id.js';
 import { exchangeOrg } from './org-relay.js';
 import { assertLocalMigrationUse, migrationSource, withLocalMigrationOperation } from './migration-guard.js';
@@ -131,12 +132,12 @@ interface Keepalive {
   stop: () => void;
 }
 
-function startKeepalive(res: ServerResponse): Keepalive {
+function startKeepalive(res: ServerResponse, listener?: PassiveSseListener): Keepalive {
   let timer: ReturnType<typeof setTimeout> | undefined;
   const arm = (): void => {
     timer = setTimeout(() => {
       try {
-        res.write(': keepalive\n\n');
+        if (listener?.keepaliveAllowed() !== false) res.write(': keepalive\n\n');
       } catch {
         log.debug('relay: keepalive write failed');
       }
@@ -172,13 +173,17 @@ async function pumpBody(
   res: ServerResponse,
   body: ReadableStream<Uint8Array>,
   touch: () => void,
+  listener?: PassiveSseListener,
 ): Promise<void> {
   const reader = body.getReader();
   for (;;) {
     const { done, value } = await reader.read();
     if (done) return;
+    listener?.observe(value);
     touch();
+    if (listener !== undefined) listener.forwarding = true;
     if (!res.write(value)) await drainedOrClosed(res);
+    if (listener !== undefined) listener.forwarding = false;
   }
 }
 
@@ -191,22 +196,23 @@ function passedHeaders(upstream: Response): Record<string, string> {
   return headers;
 }
 
-async function pipe(res: ServerResponse, upstream: Response, answers: Record<string, unknown>[]): Promise<void> {
+async function pipe(res: ServerResponse, upstream: Response, answers: Record<string, unknown>[], listener?: PassiveSseListener): Promise<void> {
   const headers = passedHeaders(upstream);
   if (answers.length > 0 && (upstream.status === 200 || upstream.status === 202)) {
     await mergeBlocked(res, upstream, headers, answers);
     return;
   }
-  const sse = (headers['content-type'] ?? '').includes('text/event-stream');
+  const sse = isRelaySse(headers['content-type']);
   if (sse) headers['x-accel-buffering'] = 'no';
   res.writeHead(upstream.status, headers);
+  if (sse) res.flushHeaders();
   if (upstream.body === null) {
     res.end();
     return;
   }
-  const keepalive = sse ? startKeepalive(res) : null;
+  const keepalive = sse ? startKeepalive(res, listener) : null;
   try {
-    await pumpBody(res, upstream.body, () => keepalive?.touch());
+    await pumpBody(res, upstream.body, () => keepalive?.touch(), listener);
   } finally {
     keepalive?.stop();
   }
@@ -262,7 +268,7 @@ async function relayExchange(
     res.socket?.removeListener('close', bail);
   });
   try {
-    await relayOnce(req, res, connectorId, deps, control.signal);
+    await relayOnce(req, res, connectorId, deps, control);
   } catch (err) {
     if (!control.signal.aborted) throw err;
     log.debug({ connector: connectorId }, 'relay: the client left before the answer ended');
@@ -276,6 +282,7 @@ async function deliver(
   deps: RelayApiDeps,
   out: Exchanged,
   answers: Record<string, unknown>[],
+  listener?: PassiveSseListener,
 ): Promise<void> {
   if (out.kind === 'missing') {
     answer(res, 404, { error: 'no such connector' });
@@ -295,7 +302,7 @@ async function deliver(
   }
   const { status } = out.upstream;
   noteHealth(connectorId, status < 400, status < 400 ? null : `the connector answered ${String(status)}`);
-  await pipe(res, out.upstream, answers);
+  await pipe(res, out.upstream, answers, listener);
 }
 
 async function relayOrg(req: IncomingMessage, res: ServerResponse, id: string, deps: RelayApiDeps, read: Uint8Array<ArrayBuffer> | null, signal: AbortSignal): Promise<void> {
@@ -316,8 +323,9 @@ async function relayOnce(
   res: ServerResponse,
   connectorId: string,
   deps: RelayApiDeps,
-  signal: AbortSignal,
+  control: AbortController,
 ): Promise<void> {
+  const { signal } = control;
   const read = req.method === 'POST' ? await readCapped(req) : null;
   const dir = deps.migrationDir ?? agentsDir();
   if (isOrgRelayId(connectorId) || migrationSource(connectorId, dir)?.phase === 'active') return relayOrg(req, res, connectorId, deps, read, signal);
@@ -328,7 +336,8 @@ async function relayOnce(
       return;
     }
     const out = await exchange(req, connectorId, deps, screened === null ? read : screened.forward, signal, operation.dispatch);
-    await deliver(res, connectorId, deps, out, screened?.answers ?? []);
+    const listener = out.kind === 'response' ? passiveRelayListener(req, res, out.upstream, operation, () => { control.abort(); }) : undefined;
+    await deliver(res, connectorId, deps, out, screened?.answers ?? [], listener);
   });
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/server-keys.ts

@@ -0,0 +1,46 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isRecord } from '@metro-labs/core/is-record';
+import { writeSecure } from '@metro-labs/core/secure-fs';
+import { agentsDir } from '../agents/files.js';
+import { serverKeysOf, type PluginRow } from './plugin-sync.js';
+
+const invalid = (): Error => new Error('Invalid connector server keys. Restore the saved namespace mapping and initialization marker.');
+
+function readKeys(path: string, marker: string): Map<string, string> | undefined {
+  try {
+    const marked = existsSync(marker);
+    if (marked && readFileSync(marker, 'utf8') !== '1\n') throw invalid();
+    if (!existsSync(path)) {
+      if (marked) throw invalid();
+      return undefined;
+    }
+    if (!marked) throw invalid();
+    return parseKeys(readFileSync(path, 'utf8'));
+  } catch { throw invalid(); }
+}
+
+function parseKeys(text: string): Map<string, string> {
+  const raw: unknown = JSON.parse(text);
+  if (!isRecord(raw) || raw.version !== 1 || !isRecord(raw.keys)) throw invalid();
+  const keys = new Map<string, string>();
+  const reserved = new Set<string>();
+  for (const [id, key] of Object.entries(raw.keys)) {
+    if (typeof key !== 'string' || !/^[a-z0-9-]+$/.test(key) || reserved.has(key)) throw invalid();
+    reserved.add(key);
+    keys.set(id, key);
+  }
+  return keys;
+}
+
+export function persistentServerKeys(rows: PluginRow[], dir = agentsDir(), published: PluginRow[] = rows): Map<string, string> {
+  const path = join(dir, 'connector-server-keys.json');
+  const marker = join(dir, 'connector-server-keys.initialized');
+  const saved = readKeys(path, marker);
+  const keys = serverKeysOf(rows, saved, published);
+  if (keys.size > 0 && keys.size !== saved?.size) {
+    if (saved === undefined) writeSecure(marker, '1\n');
+    writeSecure(path, `${JSON.stringify({ version: 1, keys: Object.fromEntries(keys) }, null, 2)}\n`);
+  }
+  return keys;
+}