@stage-labs/metro 0.1.0-beta.110 → 0.1.0-beta.111

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.110",
+  "version": "0.1.0-beta.111",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.110",
+  "version": "0.1.0-beta.111",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, the standing rules loaded at each session start, and a refresh skill for when the daemon could not keep the server list current. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/connectors/api.ts

@@ -93,6 +93,7 @@ function connectorPayload(
     transport: row.transport,
     auth: row.auth,
     header: row.header,
+    clientId: row.client?.clientId ?? null,
     signIn: row.signIn,
     verified: detail ? { ...summary, catalog } : summary,
   };
@@ -134,6 +135,8 @@ async function handleCreate(
       url: bodyField(body, 'url'),
       header: bodyField(body, 'header'),
       value: bodyField(body, 'value'),
+      clientId: bodyField(body, 'clientId'),
+      clientSecret: bodyField(body, 'clientSecret'),
     });
     log.info(
       { id: created.id, name: created.name, host: hostOf(created.url) },

package/runtime/node_modules/@metro-labs/daemon/src/connectors/config.ts

@@ -5,11 +5,14 @@ import type {
   VerifiedServer,
 } from './verify.js';
 import { readStoredTools } from './tools.js';
+import type { OAuthClient } from './oauth-client.js';
 import { isRecord } from '@metro-labs/core/is-record';
 
 const CONNECTOR_NAME_MAX = 64;
 const HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;
 const HEADER_VALUE_RE = /^[\x20-\x7e]{1,4096}$/;
+const CLIENT_ID_RE = /^[\x21-\x7e]{1,256}$/;
+const CLIENT_SECRET_RE = /^[\x21-\x7e]{1,1024}$/;
 const DEFAULT_HEADER = 'Authorization';
 
 export class ConnectorError extends ApiError {}
@@ -21,6 +24,7 @@ export interface ConnectorConfig {
   createdAt: string;
   verified: VerifiedRecord;
   oauth: boolean;
+  client: OAuthClient | null;
 }
 
 function text(value: unknown): string {
@@ -71,6 +75,30 @@ export function connectorAuth(
   return { kind: 'header', name, value };
 }
 
+export function connectorClient(
+  rawId: unknown,
+  rawSecret: unknown,
+): OAuthClient | null {
+  const clientId = text(rawId).trim();
+  const clientSecret = text(rawSecret).trim();
+  if (clientId === '' && clientSecret === '') return null;
+  if (clientId === '')
+    throw new ConnectorError('a client secret needs the client ID it belongs to', 400);
+  if (!CLIENT_ID_RE.test(clientId))
+    throw new ConnectorError('that is not a client ID Metro can send', 400);
+  if (clientSecret !== '' && !CLIENT_SECRET_RE.test(clientSecret))
+    throw new ConnectorError('that client secret is not sendable', 400);
+  return { clientId, ...(clientSecret === '' ? {} : { clientSecret }) };
+}
+
+function readClient(raw: unknown): OAuthClient | null {
+  if (!isRecord(raw)) return null;
+  const clientId = text(raw.clientId);
+  if (clientId === '') return null;
+  const clientSecret = text(raw.clientSecret);
+  return { clientId, ...(clientSecret === '' ? {} : { clientSecret }) };
+}
+
 function readOAuth(raw: Record<string, unknown>): ConnectorAuth {
   const accessToken = text(raw.accessToken);
   const clientId = text(raw.clientId);
@@ -79,6 +107,7 @@ function readOAuth(raw: Record<string, unknown>): ConnectorAuth {
     return { kind: 'none' };
   const refreshToken = text(raw.refreshToken);
   const clientSecret = text(raw.clientSecret);
+  const scope = text(raw.scope);
   return {
     kind: 'oauth',
     accessToken,
@@ -87,6 +116,7 @@ function readOAuth(raw: Record<string, unknown>): ConnectorAuth {
     issuer: text(raw.issuer),
     ...(refreshToken === '' ? {} : { refreshToken }),
     ...(clientSecret === '' ? {} : { clientSecret }),
+    ...(scope === '' ? {} : { scope }),
     ...(typeof raw.expiresAt === 'number' ? { expiresAt: raw.expiresAt } : {}),
   };
 }
@@ -123,6 +153,7 @@ export function readConfig(raw: unknown): ConnectorConfig {
     createdAt: text(record.createdAt),
     verified: readVerified(record.verified),
     oauth: record.oauth === true || auth.kind === 'oauth',
+    client: readClient(record.client),
   };
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/model.ts

@@ -1,4 +1,5 @@
 import type { ConnectorAuth, VerifiedRecord } from './verify.js';
+import type { OAuthClient } from './oauth-client.js';
 import { readConfig, signInState, type ConnectorSignIn } from './config.js';
 import type { ConnectorTransport } from '@metro-labs/core/station-names';
 
@@ -14,11 +15,17 @@ export interface Connector {
   expiresAt: number | null;
   signIn: ConnectorSignIn;
   verified: VerifiedRecord;
+  client: OAuthClient | null;
 }
 
-export interface ConnectorInput {
+export interface PendingConnectorInput {
   name: unknown;
   url: unknown;
+  clientId: unknown;
+  clientSecret: unknown;
+}
+
+export interface ConnectorInput extends PendingConnectorInput {
   header: unknown;
   value: unknown;
 }
@@ -55,6 +62,7 @@ export function connectorFromRow(row: ConnectorLike): Connector {
     expiresAt: auth.kind === 'oauth' ? (auth.expiresAt ?? null) : null,
     signIn: signInState(config),
     verified: config.verified,
+    client: config.client,
   };
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth-client.ts

@@ -32,7 +32,9 @@ export async function registerClient(
 ): Promise<OAuthClient> {
   if (server.registrationEndpoint === null)
     throw refused(
-      'That server requires OAuth but does not accept client registration, so Metro cannot sign in to it.',
+      'That server signs in with OAuth but registers no clients on its own. ' +
+        `Register an app with it yourself, with ${redirectUri} as its redirect URL, ` +
+        "and add the connector again with that app's client ID.",
     );
   let res: Response;
   try {
@@ -80,6 +82,8 @@ export function authorizeUrl(input: AuthorizeInput): string {
   url.searchParams.set('code_challenge', challengeOf(input.verifier));
   url.searchParams.set('code_challenge_method', 'S256');
   url.searchParams.set('resource', input.resource);
+  if (input.server.scopes.length > 0)
+    url.searchParams.set('scope', input.server.scopes.join(' '));
   return url.toString();
 }
 
@@ -150,10 +154,12 @@ export function refreshTokens(
   client: OAuthClient,
   refreshToken: string,
   resource: string,
+  scope?: string,
 ): Promise<OAuthTokens> {
   return postToken(server, client, {
     grant_type: 'refresh_token',
     refresh_token: refreshToken,
     resource,
+    ...(scope === undefined ? {} : { scope }),
   });
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth-discovery.ts

@@ -9,6 +9,12 @@ export interface OAuthServer {
   tokenEndpoint: string;
   registrationEndpoint: string | null;
   supportsS256: boolean;
+  scopes: string[];
+}
+
+interface ResourceMetadata {
+  issuer: URL;
+  scopes: string[];
 }
 
 function refused(message: string): ConnectorVerifyError {
@@ -65,18 +71,33 @@ export async function advertisesOAuth(resource: URL): Promise<boolean> {
   return false;
 }
 
-async function authServerFor(resource: URL): Promise<URL> {
+function scopesOf(body: Record<string, unknown> | null): string[] {
+  const raw: unknown = body?.scopes_supported;
+  if (!Array.isArray(raw)) return [];
+  const out: string[] = [];
+  for (const entry of raw) {
+    const scope = str(entry).trim();
+    if (scope !== '' && !/\s/.test(scope) && !out.includes(scope)) out.push(scope);
+  }
+  return out;
+}
+
+async function resourceMetadata(resource: URL): Promise<ResourceMetadata> {
   for (const candidate of resourceMetadataUrls(resource)) {
     const body = await getJson(candidate);
     const servers: unknown = body?.authorization_servers;
     const first: unknown = Array.isArray(servers) ? servers[0] : undefined;
     if (typeof first === 'string' && first !== '')
-      return parseConnectorUrl(first);
+      return { issuer: parseConnectorUrl(first), scopes: scopesOf(body) };
   }
-  return parseConnectorUrl(resource.origin);
+  return { issuer: parseConnectorUrl(resource.origin), scopes: [] };
 }
 
-function toServer(body: Record<string, unknown>, issuer: URL): OAuthServer {
+function toServer(
+  body: Record<string, unknown>,
+  issuer: URL,
+  scopes: string[],
+): OAuthServer {
   const authorizationEndpoint = str(body.authorization_endpoint);
   const tokenEndpoint = str(body.token_endpoint);
   if (authorizationEndpoint === '' || tokenEndpoint === '')
@@ -91,6 +112,7 @@ function toServer(body: Record<string, unknown>, issuer: URL): OAuthServer {
     tokenEndpoint,
     registrationEndpoint: registration === '' ? null : registration,
     supportsS256: Array.isArray(methods) ? methods.includes('S256') : false,
+    scopes,
   };
 }
 
@@ -106,10 +128,10 @@ export function authServerMetadataUrls(issuer: URL): URL[] {
 }
 
 export async function discoverOAuth(resource: URL): Promise<OAuthServer> {
-  const issuer = await authServerFor(resource);
+  const { issuer, scopes } = await resourceMetadata(resource);
   for (const candidate of authServerMetadataUrls(issuer)) {
     const body = await getJson(candidate);
-    if (body !== null) return toServer(body, issuer);
+    if (body !== null) return toServer(body, issuer, scopes);
   }
   throw refused(
     `${resource.hostname} needs authorization, but publishes no OAuth metadata Metro can use.`,

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth-routes.ts

@@ -4,12 +4,14 @@ import { bodyField, readJsonBody, sendJson, type ApiSession } from '@metro-labs/
 import {
   beginOAuth,
   completeOAuth,
+  prepareOAuth,
   takePending,
   type PendingAuth,
 } from './oauth.js';
+import { connectorClient } from './config.js';
 import { parseConnectorUrl } from './verify.js';
 import type { OAuthAuth } from './verify.js';
-import type { Connector } from './model.js';
+import type { Connector, PendingConnectorInput } from './model.js';
 
 const asText = (value: unknown): string =>
   typeof value === 'string' ? value : '';
@@ -26,7 +28,7 @@ export interface OAuthRouteDeps {
   createPendingConnector: (
     subject: string,
     project: string,
-    input: { name: unknown; url: unknown },
+    input: PendingConnectorInput,
   ) => Promise<Connector>;
   reconnectConnector: (
     subject: string,
@@ -46,15 +48,25 @@ export async function startOAuth(
   payload: (row: Connector) => Record<string, unknown>,
 ): Promise<void> {
   const url = parseConnectorUrl(bodyField(body, 'url'));
+  const returnTo = asText(bodyField(body, 'returnTo'));
+  const clientId = bodyField(body, 'clientId');
+  const clientSecret = bodyField(body, 'clientSecret');
+  const prepared = await prepareOAuth({
+    url,
+    client: connectorClient(clientId, clientSecret),
+    returnTo,
+  });
   const row = await deps.createPendingConnector(session.subject, project, {
     name: bodyField(body, 'name'),
     url: bodyField(body, 'url'),
+    clientId,
+    clientSecret,
   });
-  const authorize = await beginOAuth({
+  const authorize = beginOAuth(prepared, {
     subject: session.subject,
     name: row.name,
     url,
-    returnTo: asText(bodyField(body, 'returnTo')),
+    returnTo,
     connectorId: row.id,
   });
   log.info(
@@ -74,11 +86,13 @@ export async function handleConnect(
   const row = await deps.getConnector(session.subject, id);
   const url = parseConnectorUrl(row.url);
   const body = await readJsonBody(req);
-  const authorize = await beginOAuth({
+  const returnTo = asText(bodyField(body, 'returnTo'));
+  const prepared = await prepareOAuth({ url, client: row.client, returnTo });
+  const authorize = beginOAuth(prepared, {
     subject: session.subject,
     name: row.name,
     url,
-    returnTo: asText(bodyField(body, 'returnTo')),
+    returnTo,
     connectorId: row.id,
   });
   log.info(

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth.ts

@@ -11,8 +11,9 @@ import {
   newVerifier,
   refreshTokens,
   registerClient,
+  type OAuthClient,
 } from './oauth-client.js';
-import { discoverOAuth } from './oauth-discovery.js';
+import { discoverOAuth, type OAuthServer } from './oauth-discovery.js';
 import { startPending, takePending, type PendingAuth } from './oauth-pending.js';
 
 export { takePending, type PendingAuth };
@@ -30,20 +31,37 @@ function refused(message: string): ConnectorVerifyError {
 
 const resourceOf = (url: URL): string => url.toString();
 
-export interface BeginInput {
-  connectorId: string;
-  subject: string;
-  name: string;
+export interface PrepareInput {
   url: URL;
+  client: OAuthClient | null;
   returnTo: string;
 }
 
-export async function beginOAuth(input: BeginInput): Promise<string> {
+export interface PreparedOAuth {
+  server: OAuthServer;
+  client: OAuthClient;
+  redirectUri: string;
+}
+
+export async function prepareOAuth(input: PrepareInput): Promise<PreparedOAuth> {
   if (!validateReturnTo(input.returnTo))
     throw refused('that return address is not one Metro will send you back to');
   const server = await discoverOAuth(input.url);
   const redirectUri = callbackUri();
-  const client = await registerClient(server, redirectUri);
+  const client = input.client ?? (await registerClient(server, redirectUri));
+  return { server, client, redirectUri };
+}
+
+export interface BeginInput {
+  connectorId: string;
+  subject: string;
+  name: string;
+  url: URL;
+  returnTo: string;
+}
+
+export function beginOAuth(prepared: PreparedOAuth, input: BeginInput): string {
+  const { server, client, redirectUri } = prepared;
   const verifier = newVerifier();
   const resource = resourceOf(input.url);
   const state = startPending({
@@ -76,6 +94,9 @@ function authOf(pendingAuth: PendingAuth, tokens: OAuthTokens): OAuthAuth {
     ...(pendingAuth.client.clientSecret === undefined
       ? {}
       : { clientSecret: pendingAuth.client.clientSecret }),
+    ...(pendingAuth.server.scopes.length === 0
+      ? {}
+      : { scope: pendingAuth.server.scopes.join(' ') }),
     ...tokens,
   };
 }
@@ -109,6 +130,7 @@ export async function refreshOAuth(
     tokenEndpoint: auth.tokenEndpoint,
     registrationEndpoint: null,
     supportsS256: true,
+    scopes: [],
   };
   const client = {
     clientId: auth.clientId,
@@ -116,7 +138,13 @@ export async function refreshOAuth(
       ? {}
       : { clientSecret: auth.clientSecret }),
   };
-  const tokens = await refreshTokens(server, client, auth.refreshToken, resource);
+  const tokens = await refreshTokens(
+    server,
+    client,
+    auth.refreshToken,
+    resource,
+    auth.scope,
+  );
   return {
     ...auth,
     ...tokens,

package/runtime/node_modules/@metro-labs/daemon/src/connectors/store.ts

@@ -14,6 +14,7 @@ import { advertisesOAuth } from './oauth-discovery.js';
 import {
   ConnectorError,
   connectorAuth,
+  connectorClient,
   connectorName,
   readConfig,
   stamp,
@@ -32,6 +33,7 @@ import {
   type ConnectorCheck,
   type ConnectorInput,
   type DeletedConnector,
+  type PendingConnectorInput,
 } from './model.js';
 import { agentsDir } from '../agents/files.js';
 import { assertLocalOwner, LOCAL_PROJECT_ID } from '../agents/file-admin.js';
@@ -155,26 +157,29 @@ export async function localCreateConnector(
   const name = connectorName(input.name);
   const url = parseConnectorUrl(input.url);
   const auth = connectorAuth(input.header, input.value);
+  const client = connectorClient(input.clientId, input.clientSecret);
   const verified = stamp(await verifyRemoteMcp(url, auth));
   return insert(dir, name, url, {
     auth,
     createdAt: new Date().toISOString(),
     verified,
     oauth: await oauthCapable(url, auth),
+    client,
   });
 }
 
 export async function localCreatePendingConnector(
   subject: string,
   project: string,
-  input: { name: unknown; url: unknown },
+  input: PendingConnectorInput,
   dir = agentsDir(),
 ): Promise<Connector> {
   ownedRows(subject, project, dir);
   const name = connectorName(input.name);
   const url = parseConnectorUrl(input.url);
+  const client = connectorClient(input.clientId, input.clientSecret);
   return Promise.resolve(
-    insert(dir, name, url, { auth: { kind: 'none' }, createdAt: new Date().toISOString(), verified: UNVERIFIED, oauth: true }),
+    insert(dir, name, url, { auth: { kind: 'none' }, createdAt: new Date().toISOString(), verified: UNVERIFIED, oauth: true, client }),
   );
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/verify.ts

@@ -27,6 +27,7 @@ export interface OAuthAuth extends OAuthTokens {
   tokenEndpoint: string;
   clientId: string;
   clientSecret?: string;
+  scope?: string;
 }
 
 export type ConnectorAuth =

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.110"
+  "version": "0.1.0-beta.111"
 }