@stage-labs/metro 0.1.0-beta.306 → 0.1.0-beta.307

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.306",
+  "version": "0.1.0-beta.307",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -25,6 +25,7 @@ import { stopMcpServer, watchMcpServer } from '../mcp-server/link.js';
 import { refreshConnectorTools, watchConnectorTools } from '../mcp-server/connector-tools.js';
 import { setAnnouncedFile } from '../mcp-server/announced.js';
 import { holdServerApproval } from '../mcp/server-approvals.js';
+import { removeConnectorLeftovers } from '../connectors/leftovers.js';
 import { removeMetroPlugin } from '../claude/plugin-cleanup.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
 import { provisionAgentUser } from '../agent-user/provision.js';
@@ -139,6 +140,7 @@ function sessionApis(setLiveEvents: (on: boolean) => void, switchModel: (model:
 
 
 async function main(): Promise<void> {
+  removeConnectorLeftovers();
   applyLocalOwner();
 installBearerSessions(agentsDir(), localOwner);
   watchPolicySnapshot();

package/runtime/node_modules/@metro-labs/daemon/src/connectors/agent-key.ts

@@ -21,19 +21,17 @@ export interface Enrollment {
 export interface AgentKey {
   keyId: string;
   signingKey: string;
-  sealingKey: string;
   signing: KeyObject;
-  sealing: KeyObject;
   enrollment: Enrollment | null;
 }
 
 const pathOf = (dir: string): string => join(dir, FILE);
 
-function privateKeyOf(raw: unknown, type: 'ed25519' | 'x25519'): KeyObject | null {
+function privateSigningKey(raw: unknown): KeyObject | null {
   if (typeof raw !== 'string' || raw === '') return null;
   try {
     const key = createPrivateKey({ key: Buffer.from(raw, 'base64'), format: 'der', type: 'pkcs8' });
-    return key.asymmetricKeyType === type ? key : null;
+    return key.asymmetricKeyType === 'ed25519' ? key : null;
   } catch {
     return null;
   }
@@ -45,9 +43,9 @@ function enrollmentOf(raw: unknown): Enrollment | null {
   return server !== null && isOrganizationId(raw.organization) ? { server, organization: raw.organization, at: raw.at } : null;
 }
 
-function agentKeyOf(signing: KeyObject, sealing: KeyObject, enrollment: Enrollment | null): AgentKey {
+function agentKeyOf(signing: KeyObject, enrollment: Enrollment | null): AgentKey {
   const signingKey = rawPublicKey(createPublicKey(signing));
-  return { keyId: agentKeyId(signingKey), signingKey, sealingKey: rawPublicKey(createPublicKey(sealing)), signing, sealing, enrollment };
+  return { keyId: agentKeyId(signingKey), signingKey, signing, enrollment };
 }
 
 const unreadable = (): null => {
@@ -67,10 +65,9 @@ function storedOf(path: string): Record<string, unknown> | null {
 
 function keyOf(stored: Record<string, unknown> | null): AgentKey | null {
   if (stored === null) return null;
-  const signing = privateKeyOf(stored.signing, 'ed25519');
-  const sealing = privateKeyOf(stored.sealing, 'x25519');
-  if (stored.version !== 1 || signing === null || sealing === null) return unreadable();
-  return agentKeyOf(signing, sealing, enrollmentOf(stored.enrollment));
+  const signing = privateSigningKey(stored.signing);
+  if (stored.version !== 1 || signing === null) return unreadable();
+  return agentKeyOf(signing, enrollmentOf(stored.enrollment));
 }
 
 export function readAgentKey(dir = agentsDir()): AgentKey | null {
@@ -132,12 +129,12 @@ export function clearPendingAgentKey(dir: string): void {
 }
 
 export function newAgentKey(): AgentKey {
-  return agentKeyOf(generateKeyPairSync('ed25519').privateKey, generateKeyPairSync('x25519').privateKey, null);
+  return agentKeyOf(generateKeyPairSync('ed25519').privateKey, null);
 }
 
 const exported = (key: KeyObject): string => key.export({ format: 'der', type: 'pkcs8' }).toString('base64');
 
-const privateKeys = (key: AgentKey): Record<string, unknown> => ({ version: 1, signing: exported(key.signing), sealing: exported(key.sealing) });
+const privateKeys = (key: AgentKey): Record<string, unknown> => ({ version: 1, signing: exported(key.signing) });
 
 export function savePendingAgentKey(key: AgentKey, owner: string, ticketHash: string, dir: string, expectedServer?: string): void {
   writeKey(pendingPath(dir), { ...privateKeys(key), owner, ticketHash, ...(expectedServer === undefined ? {} : { expectedServer }) });

package/runtime/node_modules/@metro-labs/daemon/src/connectors/enroll-api.ts

@@ -66,7 +66,7 @@ async function exchange(ticket: string, owner: string, dir: string, deps: Enroll
   if (finished !== null) return finished;
   const key = pending?.ticketHash === ticketHash ? pending : newAgentKey();
   if (key !== pending) savePendingAgentKey(key, owner, ticketHash, dir);
-  const enrolled = enrolledOf(await agentCall(api, key, '/api/agents/enroll', { ticket, organization: owner, signingKey: key.signingKey, sealingKey: key.sealingKey }), key, owner);
+  const enrolled = enrolledOf(await agentCall(api, key, '/api/agents/enroll', { ticket, organization: owner, signingKey: key.signingKey }), key, owner);
   sameOwner(deps, owner);
   savePendingAgentKey(key, owner, ticketHash, dir, enrolled.server);
   const confirmed = enrolledOf(await agentCall(api, key, '/api/agents/session'), key, owner);

package/runtime/node_modules/@metro-labs/daemon/src/connectors/leftovers.ts

@@ -0,0 +1,59 @@
+import { lstatSync, readdirSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { errMsg, log } from '@metro-labs/core/log';
+import { agentsDir } from '../agents/files.js';
+
+const WRITTEN = new Set([
+  'connectors.json',
+  'connector-migrations.json',
+  'connector-migrations.initialized',
+  'connector-server-keys.json',
+  'connector-server-keys.initialized',
+  'org-connector-sync.json',
+]);
+
+const OPERATIONS = 'connector-migration-operations-[A-Za-z0-9][A-Za-z0-9_-]{10}\\.json';
+
+const PATTERNS = [
+  new RegExp(`^${OPERATIONS}(?:\\.initialized)?$`),
+  new RegExp(`^(?:connectors\\.json|connector-server-keys\\.json|connector-server-keys\\.initialized|org-connector-sync\\.json|${OPERATIONS})\\.tmp-[0-9]+$`),
+  /^connector-migrations\.json\.[0-9a-f]{24}\.tmp$/,
+];
+
+const isConnectorLeftover =(name: string): boolean => WRITTEN.has(name) || PATTERNS.some((pattern) => pattern.test(name));
+
+const codeOf = (err: unknown): unknown => (err instanceof Error && 'code' in err ? err.code : undefined);
+
+function namesIn(dir: string): string[] {
+  try {
+    return readdirSync(dir).filter(isConnectorLeftover);
+  } catch (err) {
+    if (codeOf(err) !== 'ENOENT') log.warn({ err: errMsg(err), dir }, 'connectors: could not list the old connector files');
+    return [];
+  }
+}
+
+function removeOne(path: string): boolean {
+  try {
+    if (!lstatSync(path).isFile()) {
+      log.warn({ path }, 'connectors: left an old connector file alone, it is not a regular file');
+      return false;
+    }
+    unlinkSync(path);
+    return true;
+  } catch (err) {
+    if (codeOf(err) !== 'ENOENT') log.warn({ err: errMsg(err), path }, 'connectors: could not remove an old connector file');
+    return false;
+  }
+}
+
+export function removeConnectorLeftovers(dir = agentsDir()): number {
+  try {
+    const removed = namesIn(dir).filter((name) => removeOne(join(dir, name))).length;
+    log.info({ removed }, 'connectors: removed the files of the old connector path');
+    return removed;
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'connectors: could not remove the files of the old connector path');
+    return 0;
+  }
+}

package/runtime/node_modules/@metro-labs/http/src/agent-signature.ts

@@ -1,4 +1,4 @@
-import { createHash, createPublicKey, diffieHellman, generateKeyPairSync, randomBytes, sign, verify, type KeyObject } from 'node:crypto';
+import { createHash, createPublicKey, randomBytes, sign, verify, type KeyObject } from 'node:crypto';
 import { strongEd25519 } from './ed25519.js';
 
 export const AGENT_SCHEME = 'MetroAgent';
@@ -25,40 +25,25 @@ export interface AgentProof {
   signature: string;
 }
 
-type Curve = 'Ed25519' | 'X25519';
-
 const digest = (bytes: Uint8Array): string => createHash('sha256').update(bytes).digest('base64url');
 
 export const agentKeyId = (signingKey: string): string => digest(Buffer.from(signingKey, 'base64url'));
 
-function publicKeyOf(raw: string, curve: Curve): KeyObject | null {
+function publicKeyOf(raw: string): KeyObject | null {
   if (!RAW_KEY_RE.test(raw) || Buffer.from(raw, 'base64url').toString('base64url') !== raw) return null;
   try {
-    const key = createPublicKey({ key: { kty: 'OKP', crv: curve, x: raw }, format: 'jwk' });
-    return key.asymmetricKeyType === curve.toLowerCase() ? key : null;
+    const key = createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: raw }, format: 'jwk' });
+    return key.asymmetricKeyType === 'ed25519' ? key : null;
   } catch {
     return null;
   }
 }
 
 export function signingKeyOf(raw: string): KeyObject | null {
-  const key = publicKeyOf(raw, 'Ed25519');
+  const key = publicKeyOf(raw);
   return key !== null && strongEd25519(Buffer.from(raw, 'base64url')) ? key : null;
 }
 
-function contributes(key: KeyObject): boolean {
-  try {
-    return diffieHellman({ privateKey: generateKeyPairSync('x25519').privateKey, publicKey: key }).some((byte) => byte !== 0);
-  } catch {
-    return false;
-  }
-}
-
-export function sealingKeyOf(raw: string): KeyObject | null {
-  const key = publicKeyOf(raw, 'X25519');
-  return key !== null && contributes(key) ? key : null;
-}
-
 export function rawPublicKey(key: KeyObject): string {
   const { x } = key.export({ format: 'jwk' });
   if (typeof x !== 'string') throw new Error('not an OKP public key');

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.306"
+  "version": "0.1.0-beta.307"
 }

package/runtime/sdk-runner/runner.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-beta.306",
+  "version": "0.1.0-beta.307",
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.287",
     "@modelcontextprotocol/sdk": "^1.29.0",