@stage-labs/metro 0.1.0-beta.123 → 0.1.0-beta.125

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.123",
+  "version": "0.1.0-beta.125",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.123",
+  "version": "0.1.0-beta.125",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, the standing rules loaded at each session start, and a refresh skill for when the daemon could not keep the server list current. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/claude/api.ts

@@ -31,6 +31,8 @@ import {
   stopSession,
   type SessionDeps,
 } from './session.js';
+import { claudeVersion, updateClaude, type VersionDeps } from './version.js';
+import { readSessionFile, SESSION_FILE_MAX, writeSessionFile } from './session-files.js';
 import {
   claudeDir,
   deleteClaudeSession,
@@ -44,6 +46,7 @@ import {
 
 const PREFIX = '/api/claude';
 const BODY_MAX = SETTINGS_MAX + 4096;
+const SESSION_BODY_MAX = SESSION_FILE_MAX + 4096;
 const WRITABLE = new Set(['GET', 'DELETE', 'PUT', 'POST']);
 const PAGE = 100;
 const PAGE_MAX = 500;
@@ -54,6 +57,7 @@ export interface ClaudeApiDeps {
   login?: LoginDeps;
   session?: SessionDeps;
   setup?: SetupDeps;
+  version?: VersionDeps;
 }
 
 function projectOf(query: URLSearchParams): string {
@@ -83,6 +87,7 @@ const COLLECTIONS: Record<string, Handler> = {
 
 const ITEMS: Record<string, Handler> = {
   sessions: (query, dir, id) => {
+    if (query.get('raw') === '1') return { id, text: readSessionFile(projectOf(query), id, dir) };
     const { offset, limit } = pageOf(query);
     return readTranscript(projectOf(query), id, offset, limit, dir);
   },
@@ -95,17 +100,21 @@ const parts = (path: string): string[] => path.slice(PREFIX.length + 1).split('/
 const seenIn = (body: Record<string, unknown>): string | null | undefined =>
   'seenAt' in body ? (typeof body.seenAt === 'string' ? body.seenAt : null) : undefined;
 
-const WRITE_HEADS = new Set(['settings', 'skills', 'memory']);
+const WRITE_HEADS = new Set(['settings', 'skills', 'memory', 'sessions']);
+
+function writeItem(head: string, item: string, text: string, seen: string | null | undefined, search: string, dir: string): unknown {
+  if (head === 'skills') return writeClaudeSkill(decodeURIComponent(item), text, seen, dir);
+  if (head === 'sessions') return writeSessionFile(projectOf(new URLSearchParams(search)), item, text, dir);
+  if (head === 'memory') return writeMemoryFile(projectOf(new URLSearchParams(search)), decodeURIComponent(item), text, dir);
+  return writeClaudeSettings(item, text, seen, dir);
+}
 
 async function writeAnswer(req: IncomingMessage, path: string, search: string, dir: string): Promise<unknown> {
   const [head = '', item = ''] = parts(path);
   if (!WRITE_HEADS.has(head) || item === '') throw new ApiError('method not allowed', 405);
-  const body = await readJsonBody(req, BODY_MAX);
+  const body = await readJsonBody(req, head === 'sessions' ? SESSION_BODY_MAX : BODY_MAX);
   if (!isRecord(body) || typeof body.text !== 'string') throw new ApiError('text is required', 400);
-  if (head === 'skills') return writeClaudeSkill(decodeURIComponent(item), body.text, seenIn(body), dir);
-  if (head === 'memory')
-    return writeMemoryFile(projectOf(new URLSearchParams(search)), decodeURIComponent(item), body.text, dir);
-  return writeClaudeSettings(item, body.text, seenIn(body), dir);
+  return writeItem(head, item, body.text, seenIn(body), search, dir);
 }
 
 async function created(req: IncomingMessage, path: string, dir: string): Promise<unknown> {
@@ -120,6 +129,7 @@ async function created(req: IncomingMessage, path: string, dir: string): Promise
 const LOGIN = 'login';
 const SESSION = 'session';
 const SETUP = 'setup';
+const VERSION = 'version';
 
 interface SetupChange {
   privacy?: boolean;
@@ -211,9 +221,18 @@ function answer(method: string, path: string, query: URLSearchParams, dir: strin
   return handler(query, dir, item);
 }
 
+function versionAnswer(req: IncomingMessage, deps: ClaudeApiDeps): Promise<unknown> {
+  const version: VersionDeps = { ...deps.version, session: deps.version?.session ?? deps.session };
+  const method = req.method ?? 'GET';
+  if (method === 'GET') return claudeVersion(version);
+  if (method !== 'POST') throw new ApiError('method not allowed', 405);
+  return updateClaude(version);
+}
+
 const SINGLETONS: Record<string, (req: IncomingMessage, deps: ClaudeApiDeps) => Promise<unknown>> = {
   [SESSION]: sessionAnswer,
   [SETUP]: setupAnswer,
+  [VERSION]: versionAnswer,
 };
 
 function routed(req: IncomingMessage, path: string, search: string, deps: ClaudeApiDeps): unknown {

package/runtime/node_modules/@metro-labs/daemon/src/claude/files.ts

@@ -17,8 +17,8 @@ import { createInterface } from 'node:readline';
 import { ApiError } from '@metro-labs/http/api-error';
 import { isRecord } from '@metro-labs/core/is-record';
 
-const PROJECT_RE = /^[A-Za-z0-9._-]{1,200}$/;
-const SESSION_RE = /^[A-Za-z0-9][A-Za-z0-9-]{7,63}$/;
+export const PROJECT_RE = /^[A-Za-z0-9._-]{1,200}$/;
+export const SESSION_RE = /^[A-Za-z0-9][A-Za-z0-9-]{7,63}$/;
 const MEMORY_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,119}\.md$/;
 const EDGE_BYTES = 64 * 1024;
 const TEXT_CAP = 20_000;
@@ -39,7 +39,7 @@ export function claudeDir(): string {
 
 const str = (v: unknown): string | null => (typeof v === 'string' && v !== '' ? v : null);
 
-function safeName(value: string, re: RegExp, what: string): string {
+export function safeName(value: string, re: RegExp, what: string): string {
   if (!re.test(value) || value === '.' || value === '..')
     throw new ApiError(`that is not a ${what}`, 400);
   return value;

package/runtime/node_modules/@metro-labs/daemon/src/claude/session-files.ts

@@ -0,0 +1,44 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ApiError } from '@metro-labs/http/api-error';
+import { isRecord } from '@metro-labs/core/is-record';
+import { claudeDir, PROJECT_RE, safeName, SESSION_RE } from './files.js';
+
+export const SESSION_FILE_MAX = 64 * 1024 * 1024;
+const FILE_MODE = 0o644;
+
+export interface SessionFile {
+  id: string;
+  bytes: number;
+}
+
+const transcriptPath = (project: string, session: string, dir: string): string =>
+  join(dir, 'projects', safeName(project, PROJECT_RE, 'Claude project id'), `${safeName(session, SESSION_RE, 'session id')}.jsonl`);
+
+export function readSessionFile(project: string, session: string, dir = claudeDir()): string {
+  const path = transcriptPath(project, session, dir);
+  if (!existsSync(path)) throw new ApiError('no such session', 404);
+  if (statSync(path).size > SESSION_FILE_MAX) throw new ApiError(`a session file is at most ${String(SESSION_FILE_MAX)} bytes`, 400);
+  return readFileSync(path, 'utf8');
+}
+
+function firstLineIsJson(text: string): boolean {
+  const first = text.split('\n').find((line) => line.trim() !== '');
+  if (first === undefined) return false;
+  try {
+    return isRecord(JSON.parse(first));
+  } catch {
+    return false;
+  }
+}
+
+export function writeSessionFile(project: string, session: string, text: string, dir = claudeDir()): SessionFile {
+  if (!firstLineIsJson(text)) throw new ApiError('a session file is JSON lines, one Claude Code entry per line', 400);
+  if (Buffer.byteLength(text, 'utf8') > SESSION_FILE_MAX) throw new ApiError(`a session file is at most ${String(SESSION_FILE_MAX)} bytes`, 400);
+  const path = transcriptPath(project, session, dir);
+  mkdirSync(join(path, '..'), { recursive: true });
+  const tmp = `${path}.metro-${String(process.pid)}`;
+  writeFileSync(tmp, text, { mode: FILE_MODE });
+  renameSync(tmp, path);
+  return { id: safeName(session, SESSION_RE, 'session id'), bytes: statSync(path).size };
+}

package/runtime/node_modules/@metro-labs/daemon/src/claude/version.ts

@@ -0,0 +1,109 @@
+import { spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ApiError } from '@metro-labs/http/api-error';
+import { errMsg, log } from '@metro-labs/core/log';
+import { isRecord } from '@metro-labs/core/is-record';
+import { sessionRunning, stopSession, type SessionDeps } from './session.js';
+
+const LATEST_URL = 'https://registry.npmjs.org/@anthropic-ai/claude-code/latest';
+const VERSION_RE = /(\d+)\.(\d+)\.(\d+)/;
+const CACHE_MS = 10 * 60_000;
+const INSTALL_TIMEOUT_MS = 5 * 60_000;
+const TAIL = 400;
+
+export interface VersionDeps {
+  claude?: string;
+  fetchImpl?: typeof fetch;
+  session?: SessionDeps;
+  now?: () => number;
+}
+
+export interface ClaudeVersion {
+  installed: string | null;
+  latest: string | null;
+  newer: boolean;
+}
+
+let cached: { latest: string | null; at: number } | null = null;
+
+const candidates = (deps: VersionDeps): string[] => (deps.claude === undefined ? ['claude', join(homedir(), '.local', 'bin', 'claude')] : [deps.claude]);
+
+const parse = (text: string): string | null => {
+  const m = VERSION_RE.exec(text);
+  return m === null ? null : `${m[1] ?? ''}.${m[2] ?? ''}.${m[3] ?? ''}`;
+};
+
+function probe(bin: string): string | null {
+  const run = spawnSync(bin, ['--version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  return run.error === undefined && run.status === 0 && typeof run.stdout === 'string' ? parse(run.stdout) : null;
+}
+
+function located(deps: VersionDeps): { bin: string; installed: string } | null {
+  for (const bin of candidates(deps)) {
+    const installed = probe(bin);
+    if (installed !== null) return { bin, installed };
+  }
+  return null;
+}
+
+export function newerThan(a: string, b: string): boolean {
+  const left = a.split('.').map(Number);
+  const right = b.split('.').map(Number);
+  for (let i = 0; i < 3; i += 1) {
+    const d = (left[i] ?? 0) - (right[i] ?? 0);
+    if (d !== 0) return d > 0;
+  }
+  return false;
+}
+
+export async function latestClaudeVersion(deps: VersionDeps = {}): Promise<string | null> {
+  const now = (deps.now ?? Date.now)();
+  if (cached !== null && now - cached.at < CACHE_MS) return cached.latest;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  let latest: string | null = null;
+  try {
+    const res = await fetchImpl(LATEST_URL, { headers: { accept: 'application/json' }, redirect: 'manual' });
+    const body: unknown = res.ok ? await res.json() : null;
+    latest = isRecord(body) && typeof body.version === 'string' ? parse(body.version) : null;
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'claude-version: could not read the latest version from npm');
+  }
+  cached = { latest, at: now };
+  return latest;
+}
+
+export function forgetClaudeVersion(): void {
+  cached = null;
+}
+
+export async function claudeVersion(deps: VersionDeps = {}): Promise<ClaudeVersion> {
+  const installed = located(deps)?.installed ?? null;
+  const latest = await latestClaudeVersion(deps);
+  return { installed, latest, newer: installed !== null && latest !== null && newerThan(latest, installed) };
+}
+
+function install(bin: string): void {
+  const run = spawnSync(bin, ['install', 'latest'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: INSTALL_TIMEOUT_MS });
+  if (run.error !== undefined) throw new ApiError(`claude install latest failed: ${errMsg(run.error)}`, 502);
+  if (run.status === 0) return;
+  const said = `${run.stderr ?? ''}${run.stdout ?? ''}`.trim().slice(-TAIL);
+  throw new ApiError(`claude install latest failed: ${said}`, 502);
+}
+
+function restartIfChanged(changed: boolean, session: SessionDeps): boolean {
+  if (!changed || !sessionRunning(session.tmux ?? 'tmux')) return false;
+  stopSession(session);
+  return true;
+}
+
+export async function updateClaude(deps: VersionDeps = {}): Promise<ClaudeVersion & { restarted: boolean }> {
+  const found = located(deps);
+  if (found === null) throw new ApiError('Claude Code is not installed on this machine', 404);
+  install(found.bin);
+  forgetClaudeVersion();
+  const after = await claudeVersion(deps);
+  const restarted = restartIfChanged(after.installed !== null && after.installed !== found.installed, deps.session ?? {});
+  log.info({ from: found.installed, to: after.installed, restarted }, 'claude-version: Claude Code updated');
+  return { ...after, restarted };
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-api.ts

@@ -16,6 +16,7 @@ import { GatewayError } from './forward.js';
 import {
   applyModelUpdate,
   ModelConfigError,
+  parseModelConfig,
   publicModelConfig,
   readModelConfig,
   setCodexAuth,
@@ -28,6 +29,9 @@ const CODEX = '/api/model/codex/';
 const OPENROUTER = '/api/model/openrouter/';
 const ANTHROPIC = '/api/model/anthropic/';
 const BEDROCK = '/api/model/bedrock/';
+const BUNDLE = '/api/model/bundle';
+const RESTORE = '/api/model/restore';
+const RESTORE_MAX = 64 * 1024;
 const BODY_MAX = 16 * 1024;
 const DEVICE_PREFIX = 'device/';
 const DEVICE_ID_RE = /^[A-Za-z0-9_-]{16,64}$/;
@@ -199,6 +203,21 @@ const named = (table: Record<string, Route>, name: string, method: string | unde
   return route.method === method ? route : 405;
 };
 
+async function restore(req: IncomingMessage, store: Store, deps: ModelApiDeps): Promise<unknown> {
+  const body = await readJsonBody(req, RESTORE_MAX);
+  if (!isRecord(body)) throw new ApiError('body must be a JSON object', 400);
+  const next = parseModelConfig(body);
+  store.write(next);
+  syncAvailableModelsQuietly(deps.setup ?? {}, next);
+  log.info({ provider: next.provider }, 'model-api: model setup restored from a file');
+  return settingsBody(next);
+}
+
+function bundleRoute(path: string, method: string | undefined): Route | number {
+  if (path === BUNDLE) return method === 'GET' ? { method: 'GET', run: (_req, _deps, store) => Promise.resolve(store.read()) } : 405;
+  return method === 'POST' ? { method: 'POST', run: (req, deps, store) => restore(req, store, deps) } : 405;
+}
+
 function settingsRoute(method: string | undefined): Route | number {
   if (method === 'GET') return { method: 'GET', run: (_req, deps, store) => settingsWithUsage(store.read(), deps) };
   if (method === 'PUT') return { method: 'POST', run: (req, deps, store) => update(req, store, deps) };
@@ -213,10 +232,11 @@ function codexRoute(rest: string, method: string | undefined): Route | number {
 }
 
 const mine = (path: string): boolean =>
-  path === PATH || path.startsWith(CODEX) || path.startsWith(OPENROUTER) || path.startsWith(ANTHROPIC) || path.startsWith(BEDROCK);
+  path === PATH || path === BUNDLE || path === RESTORE || path.startsWith(CODEX) || path.startsWith(OPENROUTER) || path.startsWith(ANTHROPIC) || path.startsWith(BEDROCK);
 
 function routeFor(path: string, method: string | undefined): Route | number {
   if (path === PATH) return settingsRoute(method);
+  if (path === BUNDLE || path === RESTORE) return bundleRoute(path, method);
   if (path.startsWith(OPENROUTER)) return named(OPENROUTER_ROUTES, path.slice(OPENROUTER.length), method);
   if (path.startsWith(ANTHROPIC)) return named(ANTHROPIC_ROUTES, path.slice(ANTHROPIC.length), method);
   if (path.startsWith(BEDROCK)) return named(BEDROCK_ROUTES, path.slice(BEDROCK.length), method);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-config.ts

@@ -82,7 +82,7 @@ function tokensFromDisk(raw: unknown): CodexTokens | null {
   };
 }
 
-function fromDisk(raw: unknown): ModelConfig {
+export function parseModelConfig(raw: unknown): ModelConfig {
   const base = empty();
   if (!isRecord(raw)) return base;
   const anthropic = isRecord(raw.anthropic) ? raw.anthropic : {};
@@ -100,7 +100,7 @@ function fromDisk(raw: unknown): ModelConfig {
 }
 
 export function readModelConfig(dir = agentsDir()): ModelConfig {
-  return fromDisk(readJson<unknown>(join(dir, MODEL_FILE), null, { warn: 'model-config: model.json is unreadable, so every request goes to Anthropic until it is fixed' }));
+  return parseModelConfig(readJson<unknown>(join(dir, MODEL_FILE), null, { warn: 'model-config: model.json is unreadable, so every request goes to Anthropic until it is fixed' }));
 }
 
 export function writeModelConfig(cfg: ModelConfig, dir = agentsDir()): void {

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.123"
+  "version": "0.1.0-beta.125"
 }