@stage-labs/metro 0.1.0-beta.292 → 0.1.0-beta.294

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.292",
+  "version": "0.1.0-beta.294",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.292",
+  "version": "0.1.0-beta.294",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/marketplace/plugin/bin/policy.mjs

@@ -59,7 +59,10 @@ function decide(policy, name, group) {
 const normalized = (name) => name.replace(/[^a-zA-Z0-9_-]/g, '_');
 
 function connectorCall(snap, toolName) {
-  for (const [server, entry] of Object.entries(isRecord(snap.connectors) ? snap.connectors : {})) {
+  const entries = Object.entries(isRecord(snap.connectors) ? snap.connectors : {});
+  const legacy = entries.filter(([, entry]) => isRecord(entry) && !/^org-[A-Za-z0-9][A-Za-z0-9_-]{10}$/.test(text(entry.id)) && toolName.startsWith(`mcp__${normalized(`metro.box ${text(entry.name)}`)}__`));
+  if (legacy.length > 1) return { name: 'ambiguous connector name; use its instance server key', tool: toolName, group: 'write', policy: { write: 'deny' } };
+  for (const [server, entry] of entries) {
     if (!isRecord(entry)) continue;
     const name = text(entry.name);
     const prefixes = [`mcp__plugin_metro_${server}__`, `mcp__${server}__`];

package/runtime/node_modules/@metro-labs/daemon/src/connectors/gates.ts

@@ -20,7 +20,6 @@ export interface ConnectorGate {
 }
 
 let gates: ConnectorGate[] = [];
-let managed = new Set<string>();
 
 const normalized = (name: string): string => name.replace(/[^a-zA-Z0-9_-]/g, '_');
 
@@ -31,21 +30,21 @@ function approvalChanged(gate: ConnectorGate, tool: string, next: GateRow | unde
   return before !== after;
 }
 
-export function registerConnectors(rows: readonly GateRow[], managedIds: readonly string[] = [], keys: ReadonlyMap<string, string> = serverKeysOf([...rows])): void {
-  const nextManaged = new Set(managedIds);
-  revokeToolPrompts((tool) => {
-    const found = connectorToolOf(tool);
-    if (found === undefined || (!isOrgRelayId(found.gate.id) && !managed.has(found.gate.id) && !nextManaged.has(found.gate.id))) return false;
-    return approvalChanged(found.gate, found.tool, rows.find((row) => row.id === found.gate.id), keys);
-  });
-  managed = nextManaged;
-  gates = rows.map((row) => ({
+export function registerConnectors(rows: readonly GateRow[], keys: ReadonlyMap<string, string> = serverKeysOf([...rows])): void {
+  const next = rows.map((row) => ({
     id: row.id,
     name: row.name,
     server: keys.get(row.id) ?? '',
     policy: row.config.policy ?? {},
     tools: row.config.toolGroups ?? {},
   }));
+  revokeToolPrompts((tool) => {
+    const before = connectorToolOf(tool);
+    const after = connectorToolOf(tool, next);
+    if (before?.gate.id !== after?.gate.id) return true;
+    return before !== undefined && approvalChanged(before.gate, before.tool, rows.find((row) => row.id === before.gate.id), keys);
+  });
+  gates = next;
   const entries = rows.flatMap((row): [PolicyTarget, ToolPolicy][] =>
     row.config.policy === undefined ? [] : [[{ kind: 'connector', id: row.id }, row.config.policy]],
   );
@@ -63,7 +62,7 @@ const promptFor = (connectorId: string, tool: string) => (asked: string): boolea
 
 export function blockedReason(connectorId: string, tool: string, args: Record<string, unknown> = {}): string | null {
   const gate = gates.find((g) => g.id === connectorId);
-  if (gate === undefined) return null;
+  if (gate === undefined) return 'This connector is not available.';
   settlePrompts(promptFor(connectorId, tool), args);
   const access = policyFor({ kind: 'connector', id: connectorId }, { name: tool, group: toolGroupOf(gate, tool) });
   if (access === 'deny') return `Blocked by the owner's policy for ${gate.name} (${tool}).`;
@@ -92,19 +91,24 @@ export function requestConnectorBlocker(): () => BlockedReason {
   };
 }
 
-function prefixesOf(gate: ConnectorGate): string[] {
-  const prefixes = [`mcp__plugin_metro_${gate.server}__`, `mcp__${gate.server}__`];
-  return isOrgRelayId(gate.id) ? prefixes : [...prefixes, `mcp__${normalized(`metro.box ${gate.name}`)}__`];
+function resolvedTool(gate: ConnectorGate, called: string): { gate: ConnectorGate; tool: string } {
+  const known = [...Object.keys(gate.tools), ...Object.keys(gate.policy.tools ?? {})];
+  return { gate, tool: known.find((name) => name === called) ?? known.find((name) => normalized(name) === called) ?? called };
 }
 
-export function connectorToolOf(toolName: string): { gate: ConnectorGate; tool: string } | undefined {
+export function connectorToolOf(toolName: string, entries: readonly ConnectorGate[] = gates): { gate: ConnectorGate; tool: string } | undefined {
   if (toolName.startsWith('mcp__metro__')) return undefined;
-  for (const gate of gates)
-    for (const prefix of prefixesOf(gate))
-      if (toolName.startsWith(prefix) && toolName.length > prefix.length) {
-        const called = toolName.slice(prefix.length);
-        const known = [...Object.keys(gate.tools), ...Object.keys(gate.policy.tools ?? {})];
-        return { gate, tool: known.find((name) => name === called) ?? known.find((name) => normalized(name) === called) ?? called };
-      }
-  return undefined;
+  for (const gate of entries)
+    for (const prefix of [`mcp__plugin_metro_${gate.server}__`, `mcp__${gate.server}__`])
+      if (toolName.startsWith(prefix) && toolName.length > prefix.length) return resolvedTool(gate, toolName.slice(prefix.length));
+  return legacyToolOf(toolName, entries);
+}
+
+function legacyToolOf(toolName: string, entries: readonly ConnectorGate[]): { gate: ConnectorGate; tool: string } | undefined {
+  if (!toolName.startsWith('mcp__metro_box_')) return undefined;
+  const legacy = entries.filter((gate) => !isOrgRelayId(gate.id) && toolName.startsWith(`mcp__${normalized(`metro.box ${gate.name}`)}__`));
+  const gate = legacy.length === 1 ? legacy[0] : undefined;
+  if (gate === undefined) return undefined;
+  const called = toolName.slice(`mcp__${normalized(`metro.box ${gate.name}`)}__`.length);
+  return called === '' ? undefined : resolvedTool(gate, called);
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-control.ts

@@ -62,7 +62,7 @@ function checkResponse(record: MigrationRecord, remote: RemoteMigration): void {
 }
 
 function callFailure(error: unknown, action: string): ApiError {
-  if (error instanceof MetroApiRefusal && error.code === 'migration_conflict') return new MigrationBlocked('destination_changed', 'The destination already has credentials, a name conflict or changed settings. Inspect it and reconcile; Metro will not overwrite credentials or create a duplicate.');
+  if (error instanceof MetroApiRefusal && error.code === 'migration_conflict') return new MigrationBlocked('destination_changed', 'The mapped destination already has credentials or changed settings. Inspect it and reconcile; Metro will not overwrite credentials or create a duplicate.');
   if (action === 'prepare' && error instanceof MetroApiRefusal && error.upstreamStatus === 400 && error.code === 'oauth_resource_required') {
     return new ApiError("Enter the provider's public OAuth resource. Roll back this preparation, then prepare again with that public value; never enter credentials.", 400);
   }
@@ -71,7 +71,9 @@ function callFailure(error: unknown, action: string): ApiError {
 
 function received(record: MigrationRecord, snapshot: DeliverySnapshot): boolean {
   const delivered = snapshot.connectors.find((row) => row.id === record.destinationId);
-  return delivered?.state === 'ready' && delivered.name === record.name && samePolicy(delivered.policy, record.policy);
+  if (delivered?.state !== 'ready' || delivered.name !== record.name) return false;
+  const layers = delivered.policyLayers;
+  return layers === undefined ? samePolicy(delivered.policy, record.policy) : samePolicy(layers.organization, record.policy) && samePolicy(layers.agent, {});
 }
 
 export class ConnectorMigrations {
@@ -210,7 +212,8 @@ export class ConnectorMigrations {
 
   private waiting(context: Context, record: MigrationRecord, includeOrganization = false): boolean {
     const uncertain = migrationUncertaintyReceipt(record.sourceId, this.dir) !== null;
-    if (!uncertain && this.localIdle(record.sourceId) && (!includeOrganization || this.orgIdle(record.sourceId))) return false;
+    const localIdle = this.localIdle(record.sourceId);
+    if (!uncertain && localIdle && (!includeOrganization || this.orgIdle(record.sourceId))) return false;
     this.save(context, { ...record, reason: uncertain ? migrationRefreshUncertain(record.sourceId, this.dir) ? 'local_refresh_uncertain' : 'requests_uncertain' : 'waiting_for_local' });
     return true;
   }
@@ -300,6 +303,7 @@ export class ConnectorMigrations {
   private async resolve(context: Context, record: MigrationRecord, receipt: string | null): Promise<void> {
     this.check(context, record);
     if (receipt === null || receipt !== migrationUncertaintyReceipt(record.sourceId, this.dir)) throw conflict('The outstanding request receipt changed. Refresh before confirming that vendor requests have settled.');
+    localMigrationIdle(record.sourceId, this.dir, true);
     if (migrationRefreshUncertain(record.sourceId, this.dir)) return this.recoverRefresh(context, record, receipt);
     if (!resolveMigrationUncertainty(record.sourceId, receipt, this.dir)) throw conflict('Requests are still running or their receipt changed. Wait for vendor completion, then refresh before confirming settlement.');
     this.save(context, { ...record, reason: record.phase === 'prepared' ? 'not_verified' : null });

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-guard.ts

@@ -3,7 +3,7 @@ import type { FetchLike } from '@metro-labs/core/stations/oauth';
 import { agentsDir } from '../agents/files.js';
 import type { AgentKey } from './agent-key.js';
 import { migrationRecord, migrationRecords } from './migration-state.js';
-import { assertMigrationOutcomeKnown, beginMigrationOperation, migrationOperationsIdle, migrationRequestEffectful, type MigrationOperation } from './migration-operations.js';
+import { assertMigrationOutcomeKnown, beginMigrationOperation, drainMigrationListeners, migrationOperationsIdle, migrationRequestEffectful, type MigrationOperation } from './migration-operations.js';
 
 const locked = (phase: string): boolean => phase !== 'rolled_back';
 const retired = (record: NonNullable<ReturnType<typeof migrationRecord>>): boolean => record.move === true || record.phase === 'cutover' || record.phase === 'active' || record.phase === 'rollback';
@@ -26,17 +26,19 @@ export function assertLocalMigrationUse(id: string, dir = agentsDir()): void {
   assertMigrationOutcomeKnown(id, dir);
 }
 
-export function assertLocalMigrationEdit(id: string, name: string | undefined, dir = agentsDir()): void {
-  if (migrationRecords(dir).some((record) => locked(record.phase) && (record.sourceId === id || record.name === name))) throw refused();
+export function assertLocalMigrationEdit(id: string, dir = agentsDir()): void {
+  if (migrationRecords(dir).some((record) => locked(record.phase) && record.sourceId === id)) throw refused();
 }
 
 export function migrationExportableRows<T extends { id: string; name: string }>(rows: readonly T[], dir = agentsDir()): T[] {
   const records = migrationRecords(dir).filter((record) => locked(record.phase));
-  return rows.filter((row) => !records.some((record) => record.sourceId === row.id || record.name === row.name));
+  return rows.filter((row) => !records.some((record) => record.sourceId === row.id));
 }
 
 export function localMigrationIdle(id: string, dir = agentsDir(), allowUncertain = false): boolean {
-  return migrationOperationsIdle(id, dir, !allowUncertain && migrationSource(id, dir) !== null);
+  const record = migrationSource(id, dir);
+  if (record !== null && retired(record)) drainMigrationListeners(id, dir);
+  return migrationOperationsIdle(id, dir, !allowUncertain && record !== null);
 }
 
 export interface LocalMigrationOperation extends MigrationOperation {
@@ -45,11 +47,11 @@ export interface LocalMigrationOperation extends MigrationOperation {
   close: () => void;
 }
 
-export function beginLocalMigrationOperation(id: string, dir = agentsDir(), edit = false, name?: string): LocalMigrationOperation {
+export function beginLocalMigrationOperation(id: string, dir = agentsDir(), edit = false): LocalMigrationOperation {
   let closed = false;
   const check = (): void => {
     if (closed) throw refused();
-    if (edit) assertLocalMigrationEdit(id, name, dir);
+    if (edit) assertLocalMigrationEdit(id, dir);
     else assertLocalMigrationUse(id, dir);
   };
   check();
@@ -61,14 +63,15 @@ export function beginLocalMigrationOperation(id: string, dir = agentsDir(), edit
   return {
     check,
     dispatch,
+    passiveListener: tracked.passiveListener,
     persistedRefresh: tracked.persistedRefresh,
     fetch: (input, init) => dispatch(() => fetch(input, init), { effectful: migrationRequestEffectful(init?.method, init?.body) }),
     close: () => { closed = true; tracked.close(); },
   };
 }
 
-export async function withLocalMigrationOperation<T>(id: string, dir: string, run: (operation: LocalMigrationOperation) => Promise<T>, edit = false, name?: string): Promise<T> {
-  const operation = beginLocalMigrationOperation(id, dir, edit, name);
+export async function withLocalMigrationOperation<T>(id: string, dir: string, run: (operation: LocalMigrationOperation) => Promise<T>, edit = false): Promise<T> {
+  const operation = beginLocalMigrationOperation(id, dir, edit);
   try { return await run(operation); }
   finally { operation.close(); }
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-operations.ts

@@ -17,13 +17,20 @@ interface RequestOperation {
   refresh: boolean;
 }
 
+interface PassiveListener {
+  idle: () => boolean;
+  stop: () => void;
+}
+
 export interface MigrationOperation {
+  passiveListener: (listener: PassiveListener) => void;
   dispatch: (send: () => Promise<Response>, options?: { protectedSource?: boolean; effectful?: boolean; refresh?: boolean }) => Promise<Response>;
   close: () => void;
   persistedRefresh: () => void;
 }
 
 const leases = new Map<string, Set<string>>();
+const listeners = new Map<string, PassiveListener>();
 const requests = new Map<string, RequestOperation>();
 const held = new Map<string, RequestOperation>();
 const keyOf = (source: string, dir: string): string => JSON.stringify([resolve(dir), source]);
@@ -103,6 +110,17 @@ export function assertMigrationOutcomeKnown(source: string, dir = agentsDir()):
   if (migrationUncertaintyReceipt(source, dir) !== null) throw uncertain();
 }
 
+export function drainMigrationListeners(source: string, dir: string): void {
+  const active = [...(leases.get(keyOf(source, dir)) ?? [])];
+  if (active.length === 0 || active.some((lease) => listeners.get(lease)?.idle() !== true)) return;
+  if (readPending(source, dir).some((id) => requests.has(id))) return;
+  for (const lease of active) {
+    const listener = listeners.get(lease);
+    listeners.delete(lease);
+    listener?.stop();
+  }
+}
+
 export function migrationOperationsIdle(source: string, dir: string, protectedSource: boolean): boolean {
   if (leases.has(keyOf(source, dir))) return false;
   return !protectedSource || readPending(source, dir).length === 0;
@@ -181,6 +199,7 @@ export function beginMigrationOperation(source: string, dir: string, protectedSo
   leases.set(key, active);
   let closed = false;
   return {
+    passiveListener: (listener) => { if (!closed) listeners.set(lease, listener); },
     dispatch: (send, options = {}) => {
       if (closed) return Promise.reject(uncertain());
       return dispatch(source, dir, lease, options.protectedSource ?? protectedSource, options.effectful ?? true, options.refresh ?? false, send);
@@ -191,6 +210,7 @@ export function beginMigrationOperation(source: string, dir: string, protectedSo
     close: () => {
       if (closed) return;
       closed = true;
+      listeners.delete(lease);
       for (const request of held.values()) if (request.lease === lease) {
         finish(request, false);
         held.delete(request.id);

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-preview.ts

@@ -201,13 +201,11 @@ function previewRows(dir: string): MigrationConnector[] {
   const rows = readRows(dir).map(previewRow);
   const seen = new Map<string, MigrationConnector>();
   for (const row of rows) {
-    for (const key of [`id:${row.id}`, `name:${row.name}`]) {
-      const prior = seen.get(key);
-      if (prior !== undefined) {
-        for (const duplicate of [prior, row]) if (!duplicate.issues.includes('invalid_config')) duplicate.issues.push('invalid_config');
-      }
-      seen.set(key, row);
+    const prior = seen.get(row.id);
+    if (prior !== undefined) {
+      for (const duplicate of [prior, row]) if (!duplicate.issues.includes('invalid_config')) duplicate.issues.push('invalid_config');
     }
+    seen.set(row.id, row);
   }
   return rows;
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth-routes.ts

@@ -51,7 +51,7 @@ export async function startOAuth(
       returnTo,
     }, operation.fetch);
     const row = await deps.createPendingConnector({
-      name: bodyField(body, 'name'),
+      name,
       url: bodyField(body, 'url'),
       clientId,
       clientSecret,
@@ -69,7 +69,7 @@ export async function startOAuth(
       'connector-api: stored unconnected, sending the user to sign in',
     );
     sendJson(req, res, 201, { ...payload(row), authorizeUrl: authorize });
-  }, true, name);
+  }, true);
 }
 
 export async function handleConnect(

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-runtime-discovery.ts

@@ -1,7 +1,7 @@
 import type { FetchLike } from '@metro-labs/core/stations/oauth';
 import type { ToolGroup } from '@metro-labs/core/stations/types';
 import { ApiError } from '@metro-labs/http/api-error';
-import type { DeliveredConnector } from '@metro-labs/http/connector-delivery';
+import { validConnectorToolName, type DeliveredConnector } from '@metro-labs/http/connector-delivery';
 import { MetroApiRefusal } from './metro-api.js';
 import { listRemoteTools } from './tools.js';
 
@@ -106,8 +106,8 @@ export async function discoverOrgGroups(url: string, guard: DiscoveryGuard): Pro
     if (failure.error !== null) throw failure.error;
     guard.current();
     guard.signal.throwIfAborted();
-    if (tools.length > MAX_TOOLS) throw orgUnavailable();
-    return Object.fromEntries(tools.filter((tool) => /^[A-Za-z0-9_.-]{1,128}$/.test(tool.name)).map((tool) => [tool.name, tool.readOnly ? 'read' : 'write']));
+    if (tools.length > MAX_TOOLS || tools.some((tool) => !validConnectorToolName(tool.name))) throw orgUnavailable();
+    return Object.fromEntries(tools.map((tool) => [tool.name, tool.readOnly ? 'read' : 'write']));
   } catch (error) {
     throw orgRuntimeError(error);
   }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-runtime.ts

@@ -3,7 +3,7 @@ import { agentsDir } from '../agents/files.js';
 import { assertMigrationOutcomeKnown, beginMigrationOperation, migrationRequestEffectful, type MigrationOperation } from './migration-operations.js';
 import type { FetchLike } from '@metro-labs/core/stations/oauth';
 import type { ToolGroup } from '@metro-labs/core/stations/types';
-import type { DeliveredConnector } from '@metro-labs/http/connector-delivery';
+import { effectiveConnectorPolicy, type DeliveredConnector } from '@metro-labs/http/connector-delivery';
 import type { ApiError } from '@metro-labs/http/api-error';
 import { requestConnectorBlocker, type GateRow } from './gates.js';
 import { publishOrgConnectors } from './publication.js';
@@ -49,7 +49,7 @@ interface Session {
 
 const stampOf = (row: RuntimeRow): string => JSON.stringify([
   row.relayId, row.relayName, row.name, row.url, row.auth, row.policy.read ?? 'allow', row.policy.write ?? 'allow',
-  Object.entries(row.policy.tools ?? {}).sort(([a], [b]) => a.localeCompare(b)),
+  Object.entries(row.policy.tools ?? {}).sort(([a], [b]) => a.localeCompare(b)), row.policyLayers,
 ]);
 
 const rowError = (row: DeliveredConnector | undefined): ApiError | null => {
@@ -94,7 +94,7 @@ export class OrgConnectorRuntime {
   private publish(rows: RuntimeRow[]): void {
     const metadata: GateRow[] = rows.filter((row) => row.state === 'ready').map((row) => ({
       id: row.relayId, name: row.relayName,
-      config: { policy: structuredClone(row.policy), toolGroups: { ...this.entries.get(row.id)?.groups } },
+      config: { policy: effectiveConnectorPolicy(row, this.entries.get(row.id)?.groups ?? {}), toolGroups: { ...this.entries.get(row.id)?.groups } },
     }));
     const text = JSON.stringify(metadata);
     if (text === this.published) return;
@@ -230,15 +230,21 @@ export class OrgConnectorRuntime {
   private discover(entry: Entry): Promise<void> | null {
     if (entry.scan !== null) return entry.scan;
     if (performance.now() < entry.nextScan) {
-      if (entry.error !== null) throw entry.error;
+      if (entry.error !== null) {
+        log.debug({ stage: 'discovery_backoff', status: entry.error.status }, 'organization connectors: request unavailable');
+        throw entry.error;
+      }
       return null;
     }
-    if (this.scans >= 4) throw orgUnavailable();
+    if (this.scans >= 4) {
+      log.debug({ stage: 'discovery_capacity', active: this.scans }, 'organization connectors: request unavailable');
+      throw orgUnavailable();
+    }
     this.scans += 1;
     entry.scan = this.scan(entry).catch((error: unknown) => {
       entry.error = orgRuntimeError(error);
       entry.nextScan = performance.now() + 30_000;
-      log.debug({ status: entry.error.status }, 'organization connectors: tool discovery failed');
+      log.debug({ stage: 'tool_discovery', status: entry.error.status }, 'organization connectors: tool discovery failed');
       throw entry.error;
     }).finally(() => {
       this.scans -= 1;

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync-control.ts

@@ -11,6 +11,7 @@ import type { RelaySession } from './relay-session.js';
 import type { DeliverySnapshot } from '@metro-labs/http/connector-delivery';
 import { localMigrationIdle, migrationRuntimeMapping } from './migration-guard.js';
 import { publishConnectors } from './publication.js';
+import { orgRuntimeError, orgUnavailable } from './org-runtime-discovery.js';
 
 type ControlDeps = Pick<OrgSyncDeps, 'owner' | 'key' | 'monotonic'> & { api?: MetroApi; dir?: string };
 type Context = Pick<ConnectorSyncStatus, 'owner' | 'agentId' | 'scope' | 'enrolled'>;
@@ -163,10 +164,22 @@ export class OrgConnectorControl {
     this.clear();
   }
 
-  open(id: string): RelaySession {
+  async open(id: string): Promise<RelaySession> {
     if (this.runtime === null && !syncOptedIn(this.dir)) throw new ApiError('Organization connectors are not available on this agent.', 503);
     this.reconcile(true);
-    if (this.runtime === null) throw new ApiError('Organization connectors are not available on this agent.', 503);
-    return this.runtime.open(id);
+    const runtime = this.runtime;
+    const sync = this.sync;
+    if (runtime === null || sync === null) throw new ApiError('Organization connectors are not available on this agent.', 503);
+    const state = sync.status().state;
+    try {
+      await sync.recover();
+      this.reconcile(false);
+      if (this.runtime !== runtime || this.sync !== sync) throw orgUnavailable();
+    } catch (error) {
+      const safe = orgRuntimeError(error);
+      log.debug({ stage: 'receipt_open', state, status: safe.status }, 'organization connectors: request unavailable');
+      throw safe;
+    }
+    return runtime.open(id);
   }
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync-watch.ts

@@ -13,7 +13,7 @@ function control(): OrgConnectorControl {
   return active;
 }
 
-export function orgConnectorRelaySession(id: string): RelaySession | null {
+export function orgConnectorRelaySession(id: string): Promise<RelaySession> | null {
   return isOrgRelayId(id) || migrationSource(id)?.phase === 'active' ? control().open(id) : null;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync.ts

@@ -47,6 +47,7 @@ export class OrgConnectorSync {
   private wallDeadline = 0;
   private generation = 0;
   private running: Promise<void> | null = null;
+  private recovery: Promise<void> | null = null;
   private expiry: ReturnType<typeof setTimeout> | null = null;
   private readonly monotonic: () => number;
   private readonly listeners = new Set<() => void>();
@@ -153,6 +154,12 @@ export class OrgConnectorSync {
     return this.running;
   }
 
+  recover(): Promise<void> {
+    if (this.read() !== null) return Promise.resolve();
+    this.recovery ??= this.syncFresh().finally(() => { this.recovery = null; });
+    return this.recovery;
+  }
+
   async syncFresh(refresh?: RefreshRequest): Promise<void> {
     if (this.running !== null) {
       await this.running.catch(() => {
@@ -167,7 +174,7 @@ export class OrgConnectorSync {
     const context = { ...identity.context, requestId };
     const started = this.deps.api.now();
     const clock = this.monotonic();
-    const response = await agentCall(this.deps.api, identity.key, '/api/agents/connectors', { requestId, ...(refresh === undefined ? {} : { refresh }) }, { answerMax: CONNECTOR_DELIVERY_MAX_BYTES, timeoutMs: 60_000, signal });
+    const response = await agentCall(this.deps.api, identity.key, '/api/agents/connectors?policy_layers=1', { requestId, ...(refresh === undefined ? {} : { refresh }) }, { answerMax: CONNECTOR_DELIVERY_MAX_BYTES, timeoutMs: 60_000, signal });
     this.validate(this.identity());
     if (generation !== this.generation || this.token !== identity.token) throw invalid();
     const snapshot = openConnectorDelivery(identity.key.sealing, context, response.sealed);

package/runtime/node_modules/@metro-labs/daemon/src/connectors/plugin-sync.ts

@@ -33,21 +33,48 @@ export function serverKey(name: string): string {
   return slug === '' ? 'connector' : slug;
 }
 
-export function serverKeysOf(rows: PluginRow[]): Map<string, string> {
+function legacyOwners(rows: PluginRow[], published: PluginRow[]): Map<string, string> {
+  const visible = new Set(published.map((row) => row.id));
   const taken = new Map<string, number>();
-  const keys = new Map<string, string>();
-  for (const row of rows.filter((row) => !isOrgRelayId(row.id))) {
-    const wanted = serverKey(row.name);
-    const seen = taken.get(wanted) ?? 0;
-    taken.set(wanted, seen + 1);
-    keys.set(row.id, seen === 0 ? wanted : `${wanted}-${row.id.toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 4)}`);
+  const owners = new Map<string, string>();
+  const reserved = new Set<string>();
+  for (const row of rows.filter((entry) => !isOrgRelayId(entry.id))) {
+    const slug = serverKey(row.name);
+    const seen = taken.get(slug) ?? 0;
+    taken.set(slug, seen + 1);
+    const key = seen === 0 ? slug : `${slug}-${row.id.toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 4)}`;
+    reserved.add(key);
+    if (visible.has(row.id)) owners.set(key, row.id);
+  }
+  for (const row of rows.filter((entry) => isOrgRelayId(entry.id) && visible.has(entry.id)).sort((a, b) => a.id.localeCompare(b.id))) {
+    const key = availableKey(orgKey(row), reserved);
+    reserved.add(key);
+    owners.set(key, row.id);
   }
+  return new Map([...owners].map(([key, id]) => [id, key]));
+}
+
+const orgKey = (row: PluginRow): string => `org-${serverKey(row.name).slice(0, 35)}-${Buffer.from(row.id.slice(4)).toString('hex')}`;
+
+function availableKey(wanted: string, reserved: ReadonlySet<string>): string {
+  let key = wanted;
+  let suffix = 1;
+  while (reserved.has(key)) key = `${wanted}-${String(suffix++)}`;
+  return key;
+}
+
+export function serverKeysOf(rows: PluginRow[], saved?: ReadonlyMap<string, string>, published: PluginRow[] = rows): Map<string, string> {
+  const keys = new Map(saved ?? legacyOwners(rows, published));
   const reserved = new Set(keys.values());
-  for (const row of rows.filter((row) => isOrgRelayId(row.id)).sort((a, b) => a.id.localeCompare(b.id))) {
-    const wanted = `org-${serverKey(row.name).slice(0, 35)}-${Buffer.from(row.id.slice(4)).toString('hex')}`;
-    let key = wanted;
-    let suffix = 1;
-    while (reserved.has(key)) key = `${wanted}-${String(suffix++)}`;
+  const local = rows.filter((row) => !isOrgRelayId(row.id));
+  const organization = rows.filter((row) => isOrgRelayId(row.id)).sort((a, b) => a.id.localeCompare(b.id));
+  for (const row of [...local, ...organization]) {
+    if (keys.has(row.id)) continue;
+    const slug = serverKey(row.name);
+    const wanted = isOrgRelayId(row.id)
+      ? orgKey(row)
+      : reserved.has(slug) ? `${slug}-${row.id.toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 4)}` : slug;
+    const key = availableKey(wanted, reserved);
     reserved.add(key);
     keys.set(row.id, key);
   }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/publication.ts

@@ -1,5 +1,6 @@
 import { registerConnectors, type GateRow } from './gates.js';
-import { serverKeysOf, syncPluginServers } from './plugin-sync.js';
+import { syncPluginServers } from './plugin-sync.js';
+import { persistentServerKeys } from './server-keys.js';
 import { isOrgRelayId } from './relay-id.js';
 import { migrationRecords } from './migration-state.js';
 
@@ -17,14 +18,7 @@ function metadata(rows: readonly GateRow[]): GateRow[] {
   }));
 }
 
-export function publishConnectors(): void {
-  let records: ReturnType<typeof migrationRecords>;
-  try { records = migrationRecords().filter((record) => record.phase !== 'rolled_back'); }
-  catch (error) {
-    registerConnectors([], local.map((row) => row.id));
-    syncPluginServers([]);
-    throw error;
-  }
+function publishedRows(records: ReturnType<typeof migrationRecords>): GateRow[] {
   const retired = new Set(records.filter((record) => !['preparing', 'prepared'].includes(record.phase)).map((record) => record.sourceId));
   const aliases = new Map(organization.filter((row) => records.some((record) => record.phase === 'active' && record.sourceId === row.id && record.name === row.name)).map((row) => [row.id, row]));
   const rows = local.flatMap((row) => {
@@ -32,8 +26,25 @@ export function publishConnectors(): void {
     return alias !== undefined ? [alias] : retired.has(row.id) ? [] : [row];
   });
   rows.push(...organization.filter((row) => isOrgRelayId(row.id) && !records.some((record) => row.id === `org-${record.destinationId ?? ''}`)));
-  const keys = serverKeysOf([...local, ...rows.filter((row) => isOrgRelayId(row.id))]);
-  registerConnectors(rows, [...retired, ...aliases.keys()], keys);
+  return rows;
+}
+
+export function publishConnectors(): void {
+  let rows: GateRow[];
+  let keys: Map<string, string>;
+  try {
+    const records = migrationRecords().filter((record) => record.phase !== 'rolled_back');
+    rows = publishedRows(records);
+    const active = new Set(records.filter((record) => record.phase === 'active').map((record) => record.sourceId));
+    const reserved = [...rows, ...local.filter((row) => active.has(row.id))];
+    keys = persistentServerKeys([...local, ...organization.filter((row) => isOrgRelayId(row.id))], undefined, reserved);
+  }
+  catch (error) {
+    registerConnectors([]);
+    syncPluginServers([]);
+    throw error;
+  }
+  registerConnectors(rows, keys);
   syncPluginServers(rows, { keys });
 }