@stage-labs/metro 0.1.0-beta.30 → 0.1.0-beta.31

package/dist/api.js

@@ -1,4 +1,4 @@
-import { metroUrl, readToken } from './store.js';
+import { metroUrl, readRunTokens, readToken } from './store.js';
 export class NotSignedIn extends Error {
 }
 const TIMEOUT_MS = 20_000;
@@ -18,11 +18,15 @@ export function carriesSecretsSafely(base) {
 function tokenOrThrow() {
     if (!carriesSecretsSafely(metroUrl()))
         throw new Error(`refusing to send your session to ${metroUrl()} in the clear — use https, or a loopback address`);
-    const token = readToken();
+    const token = readToken() ?? soleRunToken();
     if (token === null)
-        throw new NotSignedIn('not signed in — run `metro login` first');
+        throw new NotSignedIn('not signed in — run `metro login`, or `metro start <agent-id>` on this machine');
     return token;
 }
+function soleRunToken() {
+    const tokens = readRunTokens();
+    return tokens.length === 1 ? (tokens[0] ?? null) : null;
+}
 async function get(path) {
     const auth = tokenOrThrow();
     let res;
@@ -36,7 +40,7 @@ async function get(path) {
         throw new Error(`could not reach ${metroUrl()}`);
     }
     if (res.status === 401)
-        throw new NotSignedIn('that sign-in has expired — run `metro login` again');
+        throw new NotSignedIn("metro refused this machine's sign-in — run `metro login` again");
     if (!res.ok)
         throw new Error(`metro answered ${String(res.status)}`);
     return res.json();
@@ -98,13 +102,9 @@ export async function claimCode(code) {
     if (!isRecord(body) ||
         typeof body.token !== 'string' ||
         typeof body.email !== 'string' ||
-        typeof body.collection !== 'string')
+        typeof body.agent !== 'string')
         throw new Error('metro returned an unexpected response');
-    return {
-        token: body.token,
-        email: body.email,
-        collection: body.collection,
-    };
+    return { token: body.token, email: body.email, agent: body.agent };
 }
 export async function claimRuntime(code, label) {
     const body = await post('/api/run/claim', { code, label });
@@ -125,7 +125,7 @@ export async function whoisAuthorized() {
     const body = await get('/api/cli/session');
     if (!isRecord(body) ||
         typeof body.email !== 'string' ||
-        typeof body.collection !== 'string')
+        typeof body.agent !== 'string')
         throw new Error('metro returned an unexpected response');
-    return { email: body.email, collection: body.collection };
+    return { email: body.email, agent: body.agent };
 }

package/dist/bedrock.js

@@ -25,9 +25,11 @@ export function settingsFiles(cwd = process.cwd(), env = process.env) {
     const explicit = env.CLAUDE_CONFIG_DIR?.trim() ?? '';
     const configDir = explicit === '' ? join(homedir(), '.claude') : explicit;
     return [
-        join(configDir, 'settings.json'),
-        join(cwd, '.claude', 'settings.json'),
-        join(cwd, '.claude', 'settings.local.json'),
+        ...new Set([
+            join(configDir, 'settings.json'),
+            join(cwd, '.claude', 'settings.json'),
+            join(cwd, '.claude', 'settings.local.json'),
+        ]),
     ];
 }
 function envBlock(file) {

package/dist/cli.js

@@ -23,10 +23,11 @@ const USAGE = `metro — the command line for your MCP connectors
                   show the detached daemon's log
   metro tail <agent-id>
                   follow this machine's inbound events, one JSON line each
-  metro login     authorize a connector collection with a code from the web UI
+  metro login [code]
+                  authorize this machine for one agent with a code from its page
   metro logout    forget this machine's sign-in
-  metro whoami    print the account and collection this machine may read
-  metro mcp       print the mcpServers block for the authorized collection
+  metro whoami    print the account and agent this machine may read
+  metro mcp       print the mcpServers block of the authorized agent's connectors
   metro plugin    set up the Claude Code plugin (connector servers + /metro:login)
   metro claude [args...]
                   open Claude Code with the metro channel; every argument is passed through
@@ -42,7 +43,8 @@ Start Claude Code with all of them, without writing them to disk:
 
   METRO_URL          the metro to talk to (default https://mcp.metro.box)
   METRO_UI_URL       where the web UI lives (default https://metro.box)
-  METRO_TOKEN        use this connector sign-in instead of the stored one
+  METRO_TOKEN        use this agent sign-in instead of the stored one; with neither,
+                     a machine running metro start uses its run token
   METRO_RUN_TOKEN    use this runtime authorization instead of the stored one
   METRO_BEDROCK_MODEL
                      send every request to this Bedrock model id (default: derive from the
@@ -109,23 +111,28 @@ function logs(argv) {
     const agentId = assertAgentId(argv[0]);
     return tail(agentId, argv.includes('-f') || argv.includes('--follow'));
 }
-async function login() {
-    process.stderr.write(`Choose a connector collection at ${metroWebUrl()}/#/authorize\n`);
-    const { token, email, collection } = await claimCode(await askSecret('Paste the code here (input is hidden): '));
+async function pastedCode(given) {
+    if (given !== undefined && given.trim() !== '')
+        return given.trim();
+    process.stderr.write(`Get a pairing code from the agent's page, or pick the agent at ${metroWebUrl()}/#/authorize\n`);
+    return askSecret('Paste the code here (input is hidden): ');
+}
+async function login(given) {
+    const { token, email, agent } = await claimCode(await pastedCode(given));
     writeToken(token);
-    process.stderr.write(`Authorized '${collection}' for ${email}. Stored in ${credentialsPath()}\n`);
+    process.stderr.write(`Authorized '${agent}' for ${email}. Stored in ${credentialsPath()}\n`);
     if (syncPluginServers())
         process.stderr.write('Claude Code plugin refreshed — new sessions have the connectors; ' +
             'run /reload-plugins in any session already open.\n');
 }
 async function whoami() {
-    const { email, collection } = await whoisAuthorized();
-    process.stdout.write(`${email} · collection '${collection}' on ${metroUrl()}\n`);
+    const { email, agent } = await whoisAuthorized();
+    process.stdout.write(`${email} · agent '${agent}' on ${metroUrl()}\n`);
 }
 const HELP = new Set([undefined, 'help', '--help', '-h']);
 const COMMANDS = {
     login: async () => {
-        await login();
+        await login(process.argv[3]);
         return 0;
     },
     logout: async () => {

package/dist/store.js

@@ -1,4 +1,4 @@
-import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { chmodSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 const DEFAULT_BASE = 'https://mcp.metro.box';
@@ -21,10 +21,10 @@ function configDir() {
 export function credentialsPath() {
     return join(configDir(), 'credentials.json');
 }
-function readStored() {
+function readStoredAt(path) {
     let raw;
     try {
-        raw = readFileSync(credentialsPath(), 'utf8');
+        raw = readFileSync(path, 'utf8');
     }
     catch {
         return null;
@@ -43,6 +43,29 @@ function readStored() {
         return null;
     return { token, url: typeof url === 'string' ? url : DEFAULT_BASE };
 }
+const readStored = () => readStoredAt(credentialsPath());
+const RUN_TOKEN_FILE = /^runtime-[A-Za-z0-9_-]{11}\.json$/;
+export function readRunTokens() {
+    const fromEnv = process.env.METRO_RUN_TOKEN?.trim();
+    if (fromEnv !== undefined && fromEnv !== '')
+        return [fromEnv];
+    let names;
+    try {
+        names = readdirSync(configDir());
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of names) {
+        if (!RUN_TOKEN_FILE.test(name))
+            continue;
+        const stored = readStoredAt(join(configDir(), name));
+        if (stored !== null && stored.url === metroUrl())
+            out.push(stored.token);
+    }
+    return out;
+}
 export function readToken() {
     const fromEnv = process.env.METRO_TOKEN?.trim();
     if (fromEnv !== undefined && fromEnv !== '')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.30",
+  "version": "0.1.0-beta.31",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/agent-api.ts

@@ -50,12 +50,9 @@ export interface AgentApiDeps extends AccountApiDeps {
   }>;
   capabilities: () => Record<string, string[]>;
   liveness: () => Map<string, { connected: boolean; lastSeenAt: number }>;
-  mintRuntimeCode: (
-    email: string,
-    agentId: string,
-  ) => Promise<{ code: string; expiresAt: number }>;
   releaseRuntime: (email: string, agentId: string) => Promise<void>;
   runtimes: (agentIds: string[]) => Promise<Map<string, string>>;
+  connectorIds: (agentIds: string[]) => Promise<Map<string, string[]>>;
 }
 
 type Routable =
@@ -134,12 +131,14 @@ function agentPayload(
   agent: AgentSummary,
   live: Map<string, { connected: boolean; lastSeenAt: number }>,
   runtimes: Map<string, string>,
+  connectors: Map<string, string[]>,
 ): Record<string, unknown> {
   return {
     id: agent.id,
     name: agent.name,
     owned: agent.owned,
     runtime: agent.owned ? (runtimes.get(agent.id) ?? null) : null,
+    connector_ids: connectors.get(agent.id) ?? [],
     ...livenessPayload(agent, live),
     ...keyPayload(agent),
   };
@@ -166,10 +165,11 @@ async function handleList(
   const held = await deps.runtimes(
     list.filter((a) => a.owned).map((a) => a.id),
   );
+  const connectors = await deps.connectorIds(list.map((a) => a.id));
   const base = {
     email: session.email,
     endpoint: mcpEndpoint(),
-    agents: list.map((a) => agentPayload(a, live, held)),
+    agents: list.map((a) => agentPayload(a, live, held, connectors)),
     capabilities: deps.capabilities(),
     attachable: ATTACHABLE,
   };
@@ -190,14 +190,9 @@ async function handleRuntime(
   session: ApiSession,
   id: string,
 ): Promise<void> {
-  if (req.method === 'DELETE') {
-    await deps.releaseRuntime(session.email, id);
-    log.info({ agent: id }, 'agent-api: runtime released');
-    sendJson(req, res, 200, { agent: id, runtime: null });
-    return;
-  }
-  const minted = await deps.mintRuntimeCode(session.email, id);
-  sendJson(req, res, 201, minted);
+  await deps.releaseRuntime(session.email, id);
+  log.info({ agent: id }, 'agent-api: runtime released');
+  sendJson(req, res, 200, { agent: id, runtime: null });
 }
 
 async function handleCreate(
@@ -286,7 +281,7 @@ const ALLOWED: Record<AgentTarget['kind'], string[]> = {
   collection: ['GET', 'POST'],
   agent: ['DELETE'],
   key: ['POST'],
-  runtime: ['POST', 'DELETE'],
+  runtime: ['DELETE'],
 };
 
 function methodAllowed(tgt: Routable, method: string | undefined): boolean {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/agent-connector-api.ts

@@ -0,0 +1,150 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from './log.js';
+import {
+  apiFailure,
+  apiSession,
+  bodyField,
+  cors,
+  readJsonBody,
+  sendJson,
+  type ApiSession,
+} from './api-http.js';
+import { parseId } from '../db/ids.js';
+import type { AgentConnectors } from '../db/agent-connectors.js';
+
+const PREFIX = '/api/agents';
+
+export interface AgentConnectorApiDeps {
+  agentConnectors: (email: string, agentId: string) => Promise<AgentConnectors>;
+  addConnector: (
+    email: string,
+    agentId: string,
+    connectorId: string,
+  ) => Promise<AgentConnectors>;
+  removeConnector: (
+    email: string,
+    agentId: string,
+    connectorId: string,
+  ) => Promise<AgentConnectors>;
+  mintCode: (
+    email: string,
+    agentId: string,
+  ) => Promise<{ code: string; expiresAt: number; agent: string }>;
+}
+
+type Routable =
+  | { kind: 'connectors'; id: string }
+  | { kind: 'connector'; id: string; connectorId: string }
+  | { kind: 'code'; id: string };
+
+type Target = Routable | { kind: 'unknown' } | null;
+
+const ALLOWED: Record<Routable['kind'], string[]> = {
+  connectors: ['GET', 'POST'],
+  connector: ['DELETE'],
+  code: ['POST'],
+};
+
+function connectorTarget(id: string, rest: string[]): Target {
+  if (rest.length === 1) return { kind: 'connectors', id };
+  if (rest.length > 2) return { kind: 'unknown' };
+  const connectorId = parseId(rest[1] ?? '');
+  return connectorId === null
+    ? { kind: 'unknown' }
+    : { kind: 'connector', id, connectorId };
+}
+
+export function target(path: string): Target {
+  if (!path.startsWith(`${PREFIX}/`)) return null;
+  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
+  const id = parseId(segments[0] ?? '');
+  const head = segments[1];
+  if (id === null || head === undefined) return null;
+  if (head === 'connectors') return connectorTarget(id, segments.slice(1));
+  if (head === 'code' && segments.length === 2) return { kind: 'code', id };
+  return null;
+}
+
+async function handleConnectors(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: AgentConnectorApiDeps,
+  session: ApiSession,
+  id: string,
+): Promise<void> {
+  if (req.method === 'GET') {
+    sendJson(req, res, 200, await deps.agentConnectors(session.email, id));
+    return;
+  }
+  const connectorId = bodyField(await readJsonBody(req), 'connectorId');
+  if (typeof connectorId !== 'string' || parseId(connectorId) === null) {
+    sendJson(req, res, 400, { error: 'connectorId is required' });
+    return;
+  }
+  sendJson(req, res, 200, await deps.addConnector(session.email, id, connectorId));
+}
+
+async function handleCode(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: AgentConnectorApiDeps,
+  session: ApiSession,
+  id: string,
+): Promise<void> {
+  const minted = await deps.mintCode(session.email, id);
+  log.info({ agent: id, email: session.email }, 'agent-api: minted pairing code');
+  sendJson(req, res, 201, minted);
+}
+
+async function route(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: AgentConnectorApiDeps,
+  session: ApiSession,
+  tgt: Routable,
+): Promise<void> {
+  try {
+    if (tgt.kind === 'connectors') await handleConnectors(req, res, deps, session, tgt.id);
+    else if (tgt.kind === 'code') await handleCode(req, res, deps, session, tgt.id);
+    else
+      sendJson(
+        req,
+        res,
+        200,
+        await deps.removeConnector(session.email, tgt.id, tgt.connectorId),
+      );
+  } catch (err) {
+    apiFailure(req, res, err, 'agent-api');
+  }
+}
+
+export function handleAgentConnectorRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: AgentConnectorApiDeps,
+): boolean {
+  const tgt = target((req.url ?? '').split('?')[0] ?? '');
+  if (tgt === null) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (tgt.kind === 'unknown') {
+    sendJson(req, res, 404, { error: 'no such connector' });
+    return true;
+  }
+  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  const session = apiSession(req);
+  if (!session) {
+    sendJson(req, res, 401, { error: 'unauthorized' });
+    return true;
+  }
+  route(req, res, deps, session, tgt).catch((err: unknown) => {
+    log.warn({ err: errMsg(err) }, 'agent-api: unhandled error');
+    if (!res.headersSent) sendJson(req, res, 500, { error: 'agent api failed' });
+  });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/agent-pair.ts

@@ -0,0 +1,20 @@
+import { makeCodeStore } from './pair-codes.js';
+
+export interface AgentCode {
+  email: string;
+  agentId: string;
+}
+
+const store = makeCodeStore<AgentCode>('ma');
+
+export const AGENT_CODE_RE = store.pattern;
+
+export const mintAgentCode = (
+  entry: AgentCode,
+  now?: number,
+): { code: string; expiresAt: number } => store.mint(entry, now);
+
+export const takeAgentCode = (code: string, now?: number): AgentCode | undefined =>
+  store.take(code, now);
+
+export const agentCodeCount = (): number => store.count();

package/runtime/node_modules/@metro-labs/mcp/src/daemon/api-http.ts

@@ -2,10 +2,10 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import { ApiError } from './api-error.js';
 import { errMsg, log } from './log.js';
 import {
-  verifyCliToken,
+  verifyAgentToken,
   verifyRunToken,
   verifySession,
-  type CliClaims,
+  type AgentClaims,
   type RunClaims,
 } from './session.js';
 import { extractToken } from '../mcp/request-identity.js';
@@ -67,16 +67,39 @@ export function runIdentity(req: IncomingMessage): RunClaims | null {
   }
 }
 
-export function cliIdentity(req: IncomingMessage): CliClaims | null {
+export interface AgentIdentity extends AgentClaims {
+  runtimeId?: string;
+}
+
+export function agentIdentity(req: IncomingMessage): AgentIdentity | null {
   const secret = process.env.METRO_SESSION_SECRET?.trim() ?? '';
   if (secret === '') return null;
   const token = extractToken(req) ?? '';
   if (token === '') return null;
   try {
-    const { email, collectionId } = verifyCliToken(token, secret);
-    return { email: email.toLowerCase(), collectionId };
+    const { email, agentId } = verifyAgentToken(token, secret);
+    return { email: email.toLowerCase(), agentId };
   } catch {
-    return null;
+    const run = runIdentity(req);
+    if (run === null) return null;
+    return { email: run.email, agentId: run.agentId, runtimeId: run.runtimeId };
+  }
+}
+
+export type Fence = (runtimeId: string, agentId: string) => Promise<void>;
+
+const RELEASED = 'this machine no longer holds the agent';
+
+export async function assertLease(
+  who: AgentIdentity,
+  fence: Fence,
+): Promise<void> {
+  if (who.runtimeId === undefined) return;
+  try {
+    await fence(who.runtimeId, who.agentId);
+  } catch (err) {
+    if (err instanceof ApiError) throw new ApiError(RELEASED, 401);
+    throw err;
   }
 }
 

package/runtime/node_modules/@metro-labs/mcp/src/daemon/boot.ts

@@ -26,7 +26,8 @@ import {
   touchRuntime,
 } from '../db/runtimes.js';
 import {
-  mintRuntimeCodeForEmail,
+  blockedStationsFor,
+  mintAgentCodeForEmail,
   releaseRuntimeForEmail,
 } from '../db/runtime-admin.js';
 import { loadAgentForRuntime, localAgentKey } from '../db/materialize.js';
@@ -82,14 +83,12 @@ import {
   setMemberRoleForEmail,
 } from '../db/projects.js';
 import {
-  addToCollectionForEmail,
-  createCollectionForEmail,
-  deleteCollectionForEmail,
-  getCollectionForEmail,
-  listCollectionsForEmail,
-  removeFromCollectionForEmail,
-  renameCollectionForEmail,
-} from '../db/connector-collections.js';
+  addConnectorToAgentForEmail,
+  agentConnectorsForEmail,
+  connectorIdsByAgent,
+  removeConnectorFromAgentForEmail,
+} from '../db/agent-connectors.js';
+import type { AgentConnectorApiDeps } from './agent-connector-api.js';
 import type { StationName } from '../db/schema.js';
 import { AttachSessions } from './attach-session.js';
 import { startUploadReaper } from './upload-store.js';
@@ -208,8 +207,8 @@ const agentApi: AgentApiDeps = {
   gatherAccounts: gatherAccountsForAgents,
   capabilities: accountStationCapabilities,
   liveness: agentLiveness,
-  mintRuntimeCode: mintRuntimeCodeForEmail,
   releaseRuntime: releaseRuntimeForEmail,
+  connectorIds: connectorIdsByAgent,
   runtimes: runtimeLabels,
   prepareAccount,
   attachAccount: attachAccountToAgent,
@@ -222,6 +221,14 @@ const runApi: RunApiDeps = {
   fenceRuntime,
   touchRuntime,
   loadAgent: loadAgentForRuntime,
+  blockedStations: blockedStationsFor,
+};
+
+const agentConnectorApi: AgentConnectorApiDeps = {
+  agentConnectors: agentConnectorsForEmail,
+  addConnector: addConnectorToAgentForEmail,
+  removeConnector: removeConnectorFromAgentForEmail,
+  mintCode: mintAgentCodeForEmail,
 };
 
 const projectApi: ProjectApiDeps = {
@@ -238,13 +245,8 @@ const projectApi: ProjectApiDeps = {
 const connectorApi: ConnectorApiDeps = {
   listConnectors: listConnectorsForEmail,
   connectorNamesByIds,
-  listCollections: listCollectionsForEmail,
-  getCollection: getCollectionForEmail,
-  createCollection: createCollectionForEmail,
-  renameCollection: renameCollectionForEmail,
-  deleteCollection: deleteCollectionForEmail,
-  addToCollection: addToCollectionForEmail,
-  removeFromCollection: removeFromCollectionForEmail,
+  agentConnectors: agentConnectorsForEmail,
+  fenceRuntime,
   renameConnector: renameConnectorForEmail,
   createConnector: createConnectorForEmail,
   createPendingConnector: createPendingConnectorForEmail,
@@ -263,7 +265,14 @@ async function main(): Promise<void> {
   const metroMcp = await createMetroMcp();
   webhookServer = await startWebhookServer(
     emit,
-    { agentApi, connectorApi, projectApi, runApi, relayApi: { target: relayTarget } },
+    {
+      agentApi,
+      agentConnectorApi,
+      connectorApi,
+      projectApi,
+      runApi,
+      relayApi: { target: relayTarget, fence: fenceRuntime },
+    },
     metroMcp.httpHandler,
     metroCall,
   );

package/runtime/node_modules/@metro-labs/mcp/src/daemon/cli-pair-api.ts

@@ -1,18 +1,20 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
+import { log } from './log.js';
 import {
+  agentIdentity,
+  apiFailure,
+  assertLease,
   bodyField,
-  cliIdentity,
   cors,
   readJsonBody,
   sendJson,
 } from './api-http.js';
 import { extractToken } from '../mcp/request-identity.js';
 import { publicBaseOrDefault } from './attach-serve.js';
-import { CLI_CODE_RE, takeCliCode } from './cli-pair.js';
+import { AGENT_CODE_RE, takeAgentCode } from './agent-pair.js';
 import { relayServersJson } from './connector-json.js';
 import { sessionTtlFromEnv } from './google-oauth.js';
-import { signCliToken } from './session.js';
+import { signAgentToken } from './session.js';
 import type { ConnectorApiDeps } from './connector-api.js';
 
 const CLAIM_PATH = '/api/cli/claim';
@@ -42,28 +44,28 @@ async function handleClaim(
   }
   const raw = bodyField(await readJsonBody(req), 'code');
   const code = typeof raw === 'string' ? raw.trim() : '';
-  if (!CLI_CODE_RE.test(code)) {
+  if (!AGENT_CODE_RE.test(code)) {
     sendJson(req, res, 400, {
       error:
-        'that does not look like a collection code — metro login wants the mc_… code from metro.box/#/authorize',
+        'that does not look like an agent code — metro login wants the ma_… code from the agent page',
     });
     return;
   }
-  const taken = takeCliCode(code);
+  const taken = takeAgentCode(code);
   if (taken === undefined) {
     sendJson(req, res, 400, {
       error: 'that code has expired or was already used',
     });
     return;
   }
-  const collection = await deps.getCollection(taken.email, taken.collectionId);
-  const token = signCliToken(
-    { email: taken.email, collectionId: collection.id },
+  const agent = await deps.agentConnectors(taken.email, taken.agentId);
+  const token = signAgentToken(
+    { email: taken.email, agentId: agent.id },
     secret,
     { ttlSec: sessionTtlFromEnv() },
   );
-  log.info({ email: taken.email, collection: collection.id }, 'cli: code claimed');
-  sendJson(req, res, 200, { token, email: taken.email, collection: collection.name });
+  log.info({ email: taken.email, agent: agent.id }, 'cli: code claimed');
+  sendJson(req, res, 200, { token, email: taken.email, agent: agent.name });
 }
 
 async function handleRead(
@@ -72,23 +74,24 @@ async function handleRead(
   deps: ConnectorApiDeps,
   path: string,
 ): Promise<void> {
-  const who = cliIdentity(req);
+  const who = agentIdentity(req);
   if (who === null) {
     sendJson(req, res, 401, { error: 'unauthorized' });
     return;
   }
-  const collection = await deps.getCollection(who.email, who.collectionId);
+  await assertLease(who, deps.fenceRuntime);
+  const agent = await deps.agentConnectors(who.email, who.agentId);
   if (path === SESSION_PATH) {
-    sendJson(req, res, 200, { email: who.email, collection: collection.name });
+    sendJson(req, res, 200, { email: who.email, agent: agent.name });
     return;
   }
-  const entries = await deps.connectorNamesByIds(collection.connectorIds);
+  const entries = await deps.connectorNamesByIds(agent.connectorIds);
   const json = relayServersJson(
     entries,
     publicBaseOrDefault(),
     extractToken(req) ?? '',
   );
-  sendJson(req, res, 200, { json, collection: collection.name });
+  sendJson(req, res, 200, { json, agent: agent.name });
 }
 
 export function handleCliPairRequest(
@@ -116,8 +119,7 @@ export function handleCliPairRequest(
       ? handleClaim(req, res, deps)
       : handleRead(req, res, deps, path);
   work.catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'cli: unhandled error');
-    if (!res.headersSent) sendJson(req, res, 500, { error: 'cli api failed' });
+    apiFailure(req, res, err, 'cli');
   });
   return true;
 }