@stage-labs/metro 0.1.0-beta.303 → 0.1.0-beta.305

package/runtime/node_modules/@metro-labs/daemon/src/mcp/permission-relay.ts

@@ -24,7 +24,7 @@ type PermissionRequest = z.infer<typeof PermissionRequestSchema>;
 
 const trainOf = (line: string): string => line.split('/')[2] ?? '';
 
-async function metroSend(line: string, text: string): Promise<void> {
+export async function metroSend(line: string, text: string): Promise<void> {
   await metroCall(trainOf(line), 'send', { line, text });
 }
 
@@ -36,15 +36,17 @@ export interface PermissionRelayDeps {
   log: (...a: unknown[]) => void;
 }
 
-const callChat = (deps: PermissionRelayDeps): string | undefined => {
+export type PromptLineDeps = Pick<PermissionRelayDeps, 'relay' | 'inScope' | 'live' | 'log'>;
+
+const callChat = (deps: PromptLineDeps): string | undefined => {
   const route = sharedCalls.snapshot();
   return route !== null && deps.inScope(route.line) ? route.line : undefined;
 };
 
-const ownerChat = (deps: PermissionRelayDeps, owner: OwnerLine | undefined): string | undefined =>
+const ownerChat = (deps: PromptLineDeps, owner: OwnerLine | undefined): string | undefined =>
   owner !== undefined && mayApprove(owner.line, owner.from) && deps.inScope(owner.line) && lineReceives(owner.line) ? owner.line : undefined;
 
-function relayLine(deps: PermissionRelayDeps, requestId: string, callLine?: string): string | undefined {
+export function relayLine(deps: PromptLineDeps, requestId: string, callLine?: string): string | undefined {
   if (!deps.live()) {
     deps.log('permission_request: live events are off, so no chat answer can arrive; held for the page only', requestId);
     return undefined;

package/runtime/node_modules/@metro-labs/daemon/src/mcp/policy-snapshot.ts

@@ -7,7 +7,6 @@ import { agentsDir } from '../agents/files.js';
 import { knownAccounts } from '../agents/map.js';
 import { onPoliciesChanged, storedPolicies, type ToolPolicy } from '../policy/policy.js';
 import { UNGATED } from './policy-gate.js';
-import { connectorGates } from '../connectors/gates.js';
 import { stationToolOwners, TOOL_DEFS, toolGroupOf } from './tool-catalog.js';
 
 interface PolicySnapshot {
@@ -17,14 +16,6 @@ interface PolicySnapshot {
   ungated: string[];
   accounts: Record<string, ToolPolicy>;
   stations: Record<string, string[]>;
-  connectors: Record<string, SnapshotConnector>;
-}
-
-interface SnapshotConnector {
-  id: string;
-  name: string;
-  policy: ToolPolicy;
-  tools: Record<string, ToolGroup>;
 }
 
 const FILE = 'policy.json';
@@ -44,11 +35,6 @@ function policySnapshot(): PolicySnapshot {
     ungated: [...UNGATED],
     accounts,
     stations,
-    connectors: Object.fromEntries(
-      connectorGates()
-        .filter((gate) => gate.server !== '')
-        .map((gate) => [gate.server, { id: gate.id, name: gate.name, policy: gate.policy, tools: gate.tools }]),
-    ),
   };
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/mcp/server-approvals.ts

@@ -0,0 +1,108 @@
+import type { MetroEvent } from '@metro-labs/core/events';
+import { errMsg, log } from '@metro-labs/core/log';
+import type { McpApproval, McpDecision } from '@metro-labs/http/mcp-server-protocol';
+import { holdPrompt, isPromptHeld, type Behavior } from '../approvals/pending.js';
+import { ownerLine } from '../approvals/owner-line.js';
+import { metroNotice } from '../channels/notice.js';
+import { announcedLine, noteAnnounced } from '../mcp-server/announced.js';
+import type { AnswerOutcome } from '../mcp-server/link.js';
+import { serverPromptBody } from './permission-prompt.js';
+import { metroSend, relayLine } from './permission-relay.js';
+import { channelLog, type McpSession } from './session.js';
+
+const RECENT_MS = 10 * 60_000;
+const RECENT_MAX = 1_000;
+
+const owner = {};
+const recent = new Map<string, number>();
+let current: () => McpSession | undefined = () => undefined;
+
+export function connectServerApprovals(session: () => McpSession | undefined): void {
+  current = session;
+}
+
+function promptLineFor(requestId: string): string | undefined {
+  const session = current();
+  if (session === undefined) return undefined;
+  return relayLine({ relay: session.relay, inScope: (line) => session.inScope(line), live: session.live, log: channelLog }, requestId);
+}
+
+const noticeLineFor = (line: string | undefined): string | undefined => line ?? current()?.relay.knownLine ?? ownerLine()?.line;
+
+function remember(id: string, now = Date.now()): void {
+  for (const [seen, at] of recent) if (now - at >= RECENT_MS) recent.delete(seen);
+  recent.set(id, now);
+  while (recent.size > RECENT_MAX) {
+    const oldest = recent.keys().next();
+    if (oldest.done) break;
+    recent.delete(oldest.value);
+  }
+}
+
+const answeredRecently = (id: string, now = Date.now()): boolean => now - (recent.get(id) ?? -Infinity) < RECENT_MS;
+
+const noticeText = (tool: string, id: string, behavior: Behavior): string =>
+  behavior === 'allow' ? `Approved: ${tool} (${id}). Call call_tool again with the same arguments and approval: "${id}".` : `Denied: ${tool} (${id}).`;
+
+const requestedAt = (at: number, now = Date.now()): number => (Number.isFinite(at) && at > 0 ? Math.min(at, now) : now);
+
+interface Held {
+  id: string;
+  tool: string;
+  line: string | undefined;
+  answer: (decision: McpDecision) => Promise<AnswerOutcome>;
+  publish: (event: MetroEvent) => void;
+}
+
+async function deliver(held: Held, behavior: Behavior): Promise<void> {
+  const outcome = await held.answer(behavior);
+  if (outcome !== 'acknowledged') {
+    log.info({ id: held.id, outcome }, 'mcp-server: the answer was not taken, so the agent is not told');
+    return;
+  }
+  const line = noticeLineFor(held.line);
+  if (line === undefined) {
+    log.warn({ id: held.id }, 'mcp-server: no chat is known to tell the agent the answer');
+    return;
+  }
+  held.publish(metroNotice(line, noticeText(held.tool, held.id, behavior)));
+}
+
+function sender(held: Held): (behavior: Behavior) => Promise<void> {
+  return (behavior) => {
+    remember(held.id);
+    deliver(held, behavior).catch((err: unknown) => {
+      log.warn({ id: held.id, err: errMsg(err) }, 'mcp-server: the answer could not be delivered');
+    });
+    return Promise.resolve();
+  };
+}
+
+function announce(id: string, line: string, text: string): void {
+  metroSend(line, text).then(() => {
+    noteAnnounced(id, line);
+  }).catch((err: unknown) => {
+    log.warn({ id, err: errMsg(err) }, 'mcp-server: the approval prompt could not be posted');
+  });
+}
+
+export function holdServerApproval(approval: McpApproval, answer: Held['answer'], publish: Held['publish']): boolean {
+  if (isPromptHeld(approval.id) || answeredRecently(approval.id)) return false;
+  const tool = `${approval.connector}.${approval.tool}`;
+  const announced = announcedLine(approval.id);
+  const line = announced ?? promptLineFor(approval.id);
+  const held: Held = { id: approval.id, tool, line, answer, publish };
+  holdPrompt(
+    { requestId: approval.id, tool, description: approval.connector, preview: approval.preview, line, at: requestedAt(approval.requestedAt), origin: 'mcp-server' },
+    owner,
+    sender(held),
+    line === undefined ? undefined : async (text) => metroSend(line, text),
+  );
+  log.info({ id: approval.id, tool, inChat: line !== undefined, announced: announced !== undefined }, 'mcp-server: an approval is waiting for the owner');
+  if (line !== undefined && announced === undefined) announce(approval.id, line, serverPromptBody({ requestId: approval.id, tool, preview: approval.preview }));
+  return true;
+}
+
+export function forgetServerApprovals(): void {
+  recent.clear();
+}

package/runtime/node_modules/@metro-labs/daemon/src/mcp-server/announced.ts

@@ -0,0 +1,68 @@
+import { errMsg, log } from '@metro-labs/core/log';
+import { isRecord } from '@metro-labs/core/is-record';
+import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { MCP_APPROVAL_ID_RE } from '@metro-labs/http/mcp-server-protocol';
+
+const KEEP_MS = 24 * 3_600_000;
+const MAX = 200;
+
+interface Announced {
+  line: string;
+  at: number;
+}
+
+let file: string | undefined;
+let known = new Map<string, Announced>();
+
+function entryOf(raw: unknown): Announced | null {
+  if (!isRecord(raw) || typeof raw.line !== 'string' || !raw.line.startsWith('metro://') || typeof raw.at !== 'number' || !Number.isFinite(raw.at)) return null;
+  return { line: raw.line, at: raw.at };
+}
+
+function parse(raw: unknown): Map<string, Announced> {
+  const out = new Map<string, Announced>();
+  const entries = isRecord(raw) && raw.version === 1 && isRecord(raw.announced) ? raw.announced : {};
+  for (const [id, value] of Object.entries(entries)) {
+    const entry = entryOf(value);
+    if (MCP_APPROVAL_ID_RE.test(id) && entry !== null) out.set(id, entry);
+  }
+  return out;
+}
+
+function prune(now: number): void {
+  for (const [id, entry] of known) if (now - entry.at >= KEEP_MS || entry.at > now) known.delete(id);
+  const oldest = [...known].sort(([, a], [, b]) => a.at - b.at);
+  for (const [id] of oldest.slice(0, Math.max(0, known.size - MAX))) known.delete(id);
+}
+
+function save(): void {
+  if (file === undefined) return;
+  const announced = Object.fromEntries([...known].map(([id, entry]) => [id, { line: entry.line, at: entry.at }]));
+  try {
+    writeSecure(file, `${JSON.stringify({ version: 1, announced })}\n`);
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'mcp-server: the announced approvals could not be saved, so they are kept in memory only');
+  }
+}
+
+export function setAnnouncedFile(path: string, now = Date.now()): void {
+  file = path;
+  known = parse(readJson<unknown>(path, null, { warn: 'mcp-server: the announced approvals file is not valid JSON, so it was ignored' }));
+  prune(now);
+}
+
+export function announcedLine(id: string, now = Date.now()): string | undefined {
+  const entry = known.get(id);
+  return entry !== undefined && now - entry.at < KEEP_MS && entry.at <= now ? entry.line : undefined;
+}
+
+export function noteAnnounced(id: string, line: string, now = Date.now()): void {
+  known.set(id, { line, at: now });
+  prune(now);
+  save();
+}
+
+export function forgetAnnounced(): void {
+  file = undefined;
+  known = new Map();
+}

package/runtime/node_modules/@metro-labs/daemon/src/mcp-server/config.ts

@@ -0,0 +1,31 @@
+import { log } from '@metro-labs/core/log';
+
+export const MCP_SERVER_KEY = 'mcp';
+
+const DEFAULT_URL = 'https://mcp.metro.box';
+
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);
+
+let refused: string | undefined;
+
+function usable(raw: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  const secure = url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.has(url.hostname));
+  return secure && url.username === '' && url.password === '' && url.search === '' && url.hash === '';
+}
+
+export function mcpServerUrl(env: NodeJS.ProcessEnv = process.env): string | null {
+  const raw = env.METRO_MCP_SERVER_URL?.trim() ?? DEFAULT_URL;
+  if (raw === '') return null;
+  if (usable(raw)) return raw.replace(/\/+$/, '');
+  if (refused !== raw) {
+    refused = raw;
+    log.warn({ url: raw }, 'mcp-server: METRO_MCP_SERVER_URL must be an https url (http only on this machine), so it is ignored');
+  }
+  return null;
+}

package/runtime/node_modules/@metro-labs/daemon/src/mcp-server/link.ts

@@ -0,0 +1,186 @@
+import { errMsg, log } from '@metro-labs/core/log';
+import { MCP_APPROVAL_WAIT_MS, MCP_PATHS, mcpApprovalsOf, type McpApproval, type McpDecision } from '@metro-labs/http/mcp-server-protocol';
+import { agentsDir } from '../agents/files.js';
+import { readAgentKey, type AgentKey } from '../connectors/agent-key.js';
+import { agentCall, MetroApiRefusal, type AgentFetch, type MetroApi } from '../connectors/metro-api.js';
+import { mcpServerUrl } from './config.js';
+import { ensureMcpToken } from './token.js';
+
+export type AnswerOutcome = 'acknowledged' | 'gone' | 'stopped';
+
+export type HoldApproval = (approval: McpApproval, answer: (decision: McpDecision) => Promise<AnswerOutcome>) => void;
+
+export interface McpTiming {
+  retryMs: number;
+  retryMaxMs: number;
+  idleMs: number;
+  minPollMs: number;
+  pollTimeoutMs: number;
+}
+
+export interface McpLinkDeps {
+  url: string;
+  owner: () => string | null;
+  key: () => AgentKey | null;
+  dir: () => string;
+  hold: HoldApproval;
+  fetch?: AgentFetch;
+  timing?: Partial<McpTiming>;
+}
+
+const TIMING: McpTiming = { retryMs: 2_000, retryMaxMs: 60_000, idleMs: 30_000, minPollMs: 1_000, pollTimeoutMs: MCP_APPROVAL_WAIT_MS + 15_000 };
+const APPROVALS_MAX = 256 * 1024;
+
+const refusedWith = (err: unknown, status: number): boolean => err instanceof MetroApiRefusal && err.upstreamStatus === status;
+
+export class McpServerLink {
+  private readonly api: MetroApi;
+  private readonly timing: McpTiming;
+  private readonly abort = new AbortController();
+  private registered: string | null = null;
+  private failures = 0;
+  private running: Promise<void> | null = null;
+
+  constructor(private readonly deps: McpLinkDeps) {
+    this.api = { base: deps.url, fetch: deps.fetch ?? ((url, init) => fetch(url, init)), now: () => Date.now() };
+    this.timing = { ...TIMING, ...deps.timing };
+  }
+
+  private get stopped(): boolean {
+    return this.abort.signal.aborted;
+  }
+
+  start(): void {
+    this.running ??= this.run().catch((err: unknown) => {
+      log.error({ err: errMsg(err) }, 'mcp-server: the token and approval loop stopped');
+    });
+  }
+
+  async stop(): Promise<void> {
+    this.abort.abort();
+    await this.running;
+  }
+
+  async answer(id: string, decision: McpDecision): Promise<AnswerOutcome> {
+    for (let attempt = 0; !this.stopped; attempt += 1) {
+      if (attempt > 0) await this.pause(this.delay(attempt));
+      const key = this.enrolledKey();
+      if (key === null || this.stopped) continue;
+      try {
+        await agentCall(this.api, key, MCP_PATHS.answer, { id, decision }, { signal: this.abort.signal });
+        log.info({ id, decision }, 'mcp-server: the owner answer reached the server');
+        return 'acknowledged';
+      } catch (err) {
+        if (refusedWith(err, 404)) return 'gone';
+        if (refusedWith(err, 401)) this.registered = null;
+        if (!this.stopped) log.warn({ id, attempt: attempt + 1, err: errMsg(err) }, 'mcp-server: the owner answer did not reach the server; trying again');
+      }
+    }
+    return 'stopped';
+  }
+
+  private enrolledKey(): AgentKey | null {
+    try {
+      const key = this.deps.key();
+      const owner = this.deps.owner();
+      return key !== null && owner !== null && key.enrollment?.organization === owner ? key : null;
+    } catch (err) {
+      log.warn({ err: errMsg(err) }, 'mcp-server: the agent key could not be read');
+      return null;
+    }
+  }
+
+  private async run(): Promise<void> {
+    while (!this.stopped) {
+      const key = this.enrolledKey();
+      if (key === null) {
+        this.registered = null;
+        await this.pause(this.timing.idleMs);
+      } else if (await this.step(key)) this.failures = 0;
+      else await this.pause(this.delay(++this.failures));
+    }
+  }
+
+  private async step(key: AgentKey): Promise<boolean> {
+    let doing = 'register the MCP token';
+    try {
+      await this.register(key);
+      doing = 'ask for approvals';
+      await this.poll(key);
+      return true;
+    } catch (err) {
+      if (this.stopped) return true;
+      if (refusedWith(err, 401)) this.registered = null;
+      log.warn({ server: this.deps.url, failures: this.failures + 1, err: errMsg(err) }, `mcp-server: could not ${doing}; trying again`);
+      return false;
+    }
+  }
+
+  private async register(key: AgentKey): Promise<void> {
+    const token = ensureMcpToken(key.keyId, this.deps.dir());
+    if (token.fresh) log.info({ keyId: key.keyId }, 'mcp-server: made a new MCP token for this agent');
+    const binding = `${key.keyId} ${token.hash}`;
+    if (this.registered === binding) return;
+    await agentCall(this.api, key, MCP_PATHS.token, { tokenHash: token.hash }, { signal: this.abort.signal });
+    this.registered = binding;
+    log.info({ server: this.deps.url, keyId: key.keyId }, 'mcp-server: the MCP token is registered');
+  }
+
+  private async poll(key: AgentKey): Promise<void> {
+    const started = Date.now();
+    const answer = await agentCall(this.api, key, MCP_PATHS.approvals, {}, { signal: this.abort.signal, timeoutMs: this.timing.pollTimeoutMs, answerMax: APPROVALS_MAX });
+    const approvals = mcpApprovalsOf(answer);
+    for (const approval of approvals) this.receive(approval);
+    const rest = this.timing.minPollMs - (Date.now() - started);
+    if (approvals.length === 0 && rest > 0) await this.pause(rest);
+  }
+
+  private receive(approval: McpApproval): void {
+    try {
+      this.deps.hold(approval, (decision) => this.answer(approval.id, decision));
+    } catch (err) {
+      log.warn({ id: approval.id, err: errMsg(err) }, 'mcp-server: an approval could not be held');
+    }
+  }
+
+  private delay(attempt: number): number {
+    return Math.min(this.timing.retryMs * 2 ** Math.min(attempt - 1, 20), this.timing.retryMaxMs);
+  }
+
+  private pause(ms: number): Promise<void> {
+    if (this.stopped) return Promise.resolve();
+    const signal = this.abort.signal;
+    return new Promise((resolve) => {
+      const done = (): void => {
+        clearTimeout(timer);
+        signal.removeEventListener('abort', done);
+        resolve();
+      };
+      const timer = setTimeout(done, ms);
+      timer.unref();
+      signal.addEventListener('abort', done, { once: true });
+    });
+  }
+}
+
+let active: McpServerLink | null = null;
+
+export interface McpServerWatch {
+  owner: () => string | null;
+  hold: HoldApproval;
+}
+
+export function watchMcpServer(watch: McpServerWatch, env: NodeJS.ProcessEnv = process.env): boolean {
+  const url = mcpServerUrl(env);
+  if (url === null || active !== null) return false;
+  active = new McpServerLink({ url, owner: watch.owner, key: () => readAgentKey(), dir: agentsDir, hold: watch.hold });
+  active.start();
+  log.info({ server: url }, 'mcp-server: connector approvals relay from this server once the agent is enrolled');
+  return true;
+}
+
+export async function stopMcpServer(): Promise<void> {
+  const link = active;
+  active = null;
+  await link?.stop();
+}

package/runtime/node_modules/@metro-labs/daemon/src/mcp-server/token.ts

@@ -0,0 +1,50 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isRecord } from '@metro-labs/core/is-record';
+import { writeSecure } from '@metro-labs/core/secure-fs';
+import { MCP_TOKEN_RE } from '@metro-labs/http/mcp-server-protocol';
+
+export const MCP_TOKEN_FILE = 'mcp-token';
+const BINDING_FILE = 'mcp-token.json';
+
+export interface McpToken {
+  token: string;
+  hash: string;
+  fresh: boolean;
+}
+
+export const mcpTokenHash = (token: string): string => createHash('sha256').update(token).digest('base64url');
+
+const readText = (path: string): string | null => {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch {
+    return null;
+  }
+};
+
+export function readMcpToken(dir: string): string | null {
+  const text = readText(join(dir, MCP_TOKEN_FILE))?.trim() ?? '';
+  return MCP_TOKEN_RE.test(text) ? text : null;
+}
+
+function boundKeyId(dir: string): string | null {
+  const text = readText(join(dir, BINDING_FILE));
+  if (text === null) return null;
+  try {
+    const parsed: unknown = JSON.parse(text);
+    return isRecord(parsed) && parsed.version === 1 && typeof parsed.keyId === 'string' ? parsed.keyId : null;
+  } catch {
+    return null;
+  }
+}
+
+export function ensureMcpToken(keyId: string, dir: string): McpToken {
+  const kept = readMcpToken(dir);
+  if (kept !== null && boundKeyId(dir) === keyId) return { token: kept, hash: mcpTokenHash(kept), fresh: false };
+  const token = `mcp_${randomBytes(32).toString('base64url')}`;
+  writeSecure(join(dir, MCP_TOKEN_FILE), `${token}\n`);
+  writeSecure(join(dir, BINDING_FILE), `${JSON.stringify({ version: 1, keyId })}\n`);
+  return { token, hash: mcpTokenHash(token), fresh: true };
+}

package/runtime/node_modules/@metro-labs/daemon/src/policy/policy.ts

@@ -13,9 +13,11 @@ export interface ToolPolicy {
   tools?: Record<string, Access>;
 }
 
-export type PolicyTarget =
-  | { kind: 'channel'; station: string; account: string }
-  | { kind: 'connector'; id: string };
+export interface PolicyTarget {
+  kind: 'channel';
+  station: string;
+  account: string;
+}
 
 export interface PolicyTool {
   name: string;
@@ -28,8 +30,7 @@ const RANK: Record<Access, number> = { allow: 0, ask: 1, deny: 2 };
 
 const isAccess = (value: unknown): value is Access => typeof value === 'string' && (ACCESS as readonly string[]).includes(value);
 
-export const targetKey = (target: PolicyTarget): string =>
-  target.kind === 'channel' ? `channel:${target.station}/${target.account}` : `connector:${target.id}`;
+export const targetKey = (target: PolicyTarget): string => `channel:${target.station}/${target.account}`;
 
 export function decide(policy: ToolPolicy | undefined, tool: PolicyTool): Access {
   const byTool = policy?.tools !== undefined && Object.hasOwn(policy.tools, tool.name) ? policy.tools[tool.name] : undefined;

package/runtime/node_modules/@metro-labs/daemon/src/routes/http.ts

@@ -1,6 +1,5 @@
 import { handleSessionApis, type SessionApis } from './session-apis.js';
 import { handleGatewayRequest } from '../gateway/gateway.js';
-import { handleRelayRequest } from '../connectors/relay.js';
 import { handleThreemaCallback } from './threema-callback.js';
 import { BodyTooLargeError, readBody, WEBHOOK_BODY_MAX } from './body.js';
 
@@ -346,7 +345,6 @@ async function handlePreMcpRoutes(
   if (handleEarlyRoutes(req, res, apis)) return true;
   if (handleUploadRequest(req, res)) return true;
   if (handleAttachRequest(req, res)) return true;
-  if (apis.relayApi && handleRelayRequest(req, res, apis.relayApi)) return true;
   if (await handleWebhookRoute(req, res, emit)) return true;
   if (await handleThreemaCallback(req, res)) return true;
   return monitor && handleMonitorRequest(req, res);

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -6,16 +6,12 @@ import { assertAttachOwner, finishGmailUpgrade, startGmailAttach } from './gmail
 import { detachWithGmailRevocation } from './gmail-detach.js';
 import { recentSenders } from '../agents/senders.js';
 import { forwardTrainCall } from '../stations/train-call.js';
-import { invalidateOrgConnectorSync, orgConnectorRelaySession, orgConnectorSyncStatus, setOrgConnectorSync } from '../connectors/org-sync-watch.js';
 import type { AgentApiDeps } from '../agents/api.js';
 import { ATTACHABLE, type AccountApiDeps } from '../agents/accounts-api.js';
 import type { SessionApis } from './session-apis.js';
 import type { ModeInfo } from '@metro-labs/http/mode-api';
 import { loadedAgentOf, type AgentBundle, type BundleApiDeps } from '../agents/bundle.js';
 import { METRO_VERSION } from '@metro-labs/core/version';
-import { authenticate } from '../mcp/request-identity.js';
-import type { RelayApiDeps } from '../connectors/relay.js';
-import { connectorGates } from '../connectors/gates.js';
 import {
   setLocalOwner,
   localAttachAccount,
@@ -78,7 +74,6 @@ function agentApi(deps: LocalModeDeps): AgentApiDeps {
     ...(deps.toolGroups === undefined ? {} : { toolGroups: deps.toolGroups }),
     attachable: ATTACHABLE.filter((s) => s !== 'webhook'),
     features: ['gmail-managed'],
-    connectorIds: connectorIdsOfLocalAgents,
     prepareAccount: deps.prepareAccount,
     attachAccount: localAttachAccount,
     detachAccount: detachWithGmailRevocation,
@@ -93,20 +88,6 @@ function agentApi(deps: LocalModeDeps): AgentApiDeps {
   };
 }
 
-function connectorIdsOfLocalAgents(ids: string[]): Promise<Map<string, string[]>> {
-  const all = connectorGates().map((gate) => gate.id);
-  return Promise.resolve(new Map(ids.map((id) => [id, all] as const)));
-}
-
-const relayApi: RelayApiDeps = {
-  open: orgConnectorRelaySession,
-  identify: (req) => {
-    const who = authenticate(req);
-    return who?.kind === 'agent' ? { subject: 'agent-key', agentId: who.agentId } : null;
-  },
-};
-
-
 function bundleApi(deps: LocalModeDeps): BundleApiDeps {
   return {
     bundle: (agentId) => {
@@ -155,17 +136,11 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
   return {
     agentApi: agentApi(deps),
     bundleApi: bundleApi(deps),
-    connectorSyncApi: { status: orgConnectorSyncStatus, set: setOrgConnectorSync },
-    enrollApi: { owner: () => localOwner(), invalidate: invalidateOrgConnectorSync },
-    relayApi,
+    enrollApi: { owner: () => localOwner() },
     claudeApi: { liveEvents: deps.liveEvents },
     updateApi: { restart: deps.restart },
     controlApi: { restart: deps.restart, stop: deps.stop },
-    ownerApi: { setOwner: (owner) => {
-      const saved = setLocalOwner(owner);
-      invalidateOrgConnectorSync();
-      return saved;
-    } },
+    ownerApi: { setOwner: setLocalOwner },
     machineApi: {},
     modelApi: { switchModel: deps.switchModel, owner: localOwner },
     gateway: { config: readModelConfig },

package/runtime/node_modules/@metro-labs/daemon/src/routes/session-apis.ts

@@ -2,8 +2,6 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import { handleSessionApiRequest } from './session.js';
 import { handleApprovalsRequest } from '../approvals/api.js';
 import { handleAgentApiRequest, type AgentApiDeps } from '../agents/api.js';
-import type { RelayApiDeps } from '../connectors/relay.js';
-import { handleConnectorSyncRequest, type ConnectorSyncApiDeps } from '../connectors/org-sync-api.js';
 import { handleEnrollRequest, type EnrollApiDeps } from '../connectors/enroll-api.js';
 import { handleClaudeRequest, type ClaudeApiDeps } from '../claude/api.js';
 import type { ModeInfo } from '@metro-labs/http/mode-api';
@@ -33,8 +31,6 @@ export interface SessionApis {
   terminalApi?: TerminalApiDeps;
   claudeApi?: ClaudeApiDeps;
   enrollApi?: EnrollApiDeps;
-  connectorSyncApi?: ConnectorSyncApiDeps;
-  relayApi?: RelayApiDeps;
   mode?: () => ModeInfo;
 }
 
@@ -51,7 +47,6 @@ export function handleSessionApis(
     () => handleRunEventsRequest(req, res),
     () => handleApprovalsRequest(req, res),
     ...when(apis.enrollApi, (d) => handleEnrollRequest(req, res, d)),
-    ...when(apis.connectorSyncApi, (d) => handleConnectorSyncRequest(req, res, d)),
     ...when(apis.bundleApi, (d) => handleBundleRequest(req, res, d)),
     ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),
     ...when(apis.controlApi, (d) => handleControlRequest(req, res, d)),

package/runtime/node_modules/@metro-labs/http/package.json

@@ -22,9 +22,9 @@
     "./connector-discovery": "./src/connector-discovery.ts",
     "./connector-oauth": "./src/connector-oauth.ts",
     "./connector-input": "./src/connector-input.ts",
-    "./connector-delivery": "./src/connector-delivery.ts",
-    "./connector-migration": "./src/connector-migration.ts",
-    "./connector-grant": "./src/connector-grant.ts"
+    "./connector-policy": "./src/connector-policy.ts",
+    "./connector-grant": "./src/connector-grant.ts",
+    "./mcp-server-protocol": "./src/mcp-server-protocol.ts"
   },
   "scripts": {
     "build": "tsc",