Key renewal
A standard ark_… key lives 90 days, so most seats need no background task. Connect installs a
scheduler only when the organization issues short-lived keys, or when every tool on the seat is
among shell-env, OpenClaw, pi, and Codex (Codex can lose the config that starts its renewal).
A shell-env seat counts as covered once its shell profile carries the terminal trigger, which
Connect writes on macOS and Linux installs of the standalone binary.
Each tick, about every 30 minutes, proves the machine's identity and extends the same key in place.
Commands
| Command | What it does |
|---|---|
anyray-connect status | Lists the tools and the key |
anyray-connect doctor | Reports the scheduler under refreshScheduler |
anyray-connect --no-key-refresh | Removes the scheduler; tools keep their key until it expires, then run anyray-connect again |
anyray-connect --revert | Removes routing, enrollment, and the scheduler |
Where the scheduler lives
| Platform | Scheduler |
|---|---|
| macOS | ~/Library/LaunchAgents/ai.anyray.connect.refresh.plist |
| Linux | ~/.config/systemd/user/anyray-refresh.timer and anyray-refresh.service |
| Windows | Task Scheduler task \\AnyrayConnectKeyRefresh |
The task runs anyray-connect __anyray-refresh. MCP clients, the VS Code extension, remote
sessions, and new interactive terminals on a shell-env seat trigger the same throttled tick.
doctor reports the terminal trigger under refreshScheduler.shellTrigger: active, absent
(the profile lacks the line, so the scheduler stays), unread (the line is in ~/.profile, which
an interactive sh or dash skips, so the scheduler stays), or unsupported.
Endpoint security
The scheduler runs as the signed-in user, unprivileged. Outbound HTTPS only: your gateway, plus
github.com and release-assets.githubusercontent.com for binary updates (each asset SHA-256
verified against the release's SHA256SUMS). No port, no certificate authority, no DNS or network
changes.
anyray-connect doctor --security-review
anyray-connect doctor --security-review --json
--json gives a manifest for one fleet-wide exclusion.
If endpoint security removes the scheduler
anyray-connect doctor. Retired means the seat no longer needs a scheduler.anyray-connect --no-key-refresh and stop.anyray-connect doctor --security-review to the endpoint-security owner, then run anyray-connect --yes.Approve by path and service name, not hash: the binary changes every release.