@stage-labs/metro 0.1.0-beta.126 → 0.1.0-beta.127

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.126",
+  "version": "0.1.0-beta.127",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.126",
+  "version": "0.1.0-beta.127",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, the standing rules loaded at each session start, and a refresh skill for when the daemon could not keep the server list current. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/claude/api.ts

@@ -32,7 +32,9 @@ import {
   type SessionDeps,
 } from './session.js';
 import { claudeVersion, updateClaude, type VersionDeps } from './version.js';
-import { readSessionFile, SESSION_FILE_MAX, writeSessionFile } from './session-files.js';
+import { readSessionFile, receiveSessionFile, SESSION_FILE_MAX, sessionFilePath, writeSessionFile } from './session-files.js';
+import { createReadStream } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
 import {
   claudeDir,
   deleteClaudeSession,
@@ -246,6 +248,27 @@ function routed(req: IncomingMessage, path: string, search: string, deps: Claude
   return answer(req.method ?? 'GET', path, new URLSearchParams(search), dir);
 }
 
+const TEXT = 'text/plain; charset=utf-8';
+
+async function streamed(req: IncomingMessage, res: ServerResponse, path: string, search: string, dir: string): Promise<boolean> {
+  const [head = '', item = ''] = parts(path);
+  if (head !== 'sessions' || item === '') return false;
+  const query = new URLSearchParams(search);
+  if (req.method === 'GET' && query.get('raw') === '1') {
+    const file = sessionFilePath(projectOf(query), item, dir);
+    res.writeHead(200, { 'content-type': TEXT, 'cache-control': 'no-store', ...cors(req) });
+    await pipeline(createReadStream(file), res).catch(() => {
+      res.destroy();
+    });
+    return true;
+  }
+  if (req.method === 'PUT' && !(req.headers['content-type'] ?? '').includes('json')) {
+    sendJson(req, res, 200, await receiveSessionFile(projectOf(query), item, req, dir));
+    return true;
+  }
+  return false;
+}
+
 export function handleClaudeRequest(
   req: IncomingMessage,
   res: ServerResponse,
@@ -262,13 +285,11 @@ export function handleClaudeRequest(
     return true;
   }
   apiSession(req)
-    .then((session) => {
+    .then(async (session) => {
       if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
-      return routed(req, path, search, deps);
-    })
-    .then((body) => {
-      sendJson(req, res, 200, body);
+      if (await streamed(req, res, path, search, (deps.dir ?? claudeDir)())) return;
+      sendJson(req, res, 200, await routed(req, path, search, deps));
     })
     .catch((err: unknown) => {
       if (err instanceof ApiError) apiFailure(req, res, err, 'claude-api');

package/runtime/node_modules/@metro-labs/daemon/src/claude/session-files.ts

@@ -1,4 +1,5 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { createWriteStream, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import type { Readable } from 'node:stream';
 import { join } from 'node:path';
 import { ApiError } from '@metro-labs/http/api-error';
 import { isRecord } from '@metro-labs/core/is-record';
@@ -15,11 +16,56 @@ export interface SessionFile {
 const transcriptPath = (project: string, session: string, dir: string): string =>
   join(dir, 'projects', safeName(project, PROJECT_RE, 'Claude project id'), `${safeName(session, SESSION_RE, 'session id')}.jsonl`);
 
-export function readSessionFile(project: string, session: string, dir = claudeDir()): string {
+export function sessionFilePath(project: string, session: string, dir = claudeDir()): string {
   const path = transcriptPath(project, session, dir);
   if (!existsSync(path)) throw new ApiError('no such session', 404);
   if (statSync(path).size > SESSION_FILE_MAX) throw new ApiError(`a session file is at most ${String(SESSION_FILE_MAX)} bytes`, 400);
-  return readFileSync(path, 'utf8');
+  return path;
+}
+
+export function readSessionFile(project: string, session: string, dir = claudeDir()): string {
+  return readFileSync(sessionFilePath(project, session, dir), 'utf8');
+}
+
+const HEAD_BYTES = 64 * 1024;
+
+async function spool(body: Readable, tmp: string): Promise<string> {
+  const out = createWriteStream(tmp, { mode: FILE_MODE });
+  const head: Buffer[] = [];
+  let total = 0;
+  let kept = 0;
+  for await (const chunk of body) {
+    const buf = chunk as Buffer;
+    total += buf.length;
+    if (total > SESSION_FILE_MAX) {
+      out.destroy();
+      rmSync(tmp, { force: true });
+      throw new ApiError(`a session file is at most ${String(SESSION_FILE_MAX)} bytes`, 413);
+    }
+    if (kept < HEAD_BYTES) {
+      head.push(buf.subarray(0, HEAD_BYTES - kept));
+      kept += buf.length;
+    }
+    if (!out.write(buf)) await new Promise<void>((r) => out.once('drain', r));
+  }
+  await new Promise<void>((resolve, reject) => {
+    out.once('error', reject);
+    out.end(resolve);
+  });
+  return Buffer.concat(head).toString('utf8');
+}
+
+export async function receiveSessionFile(project: string, session: string, body: Readable, dir = claudeDir()): Promise<SessionFile> {
+  const path = transcriptPath(project, session, dir);
+  mkdirSync(join(path, '..'), { recursive: true });
+  const tmp = `${path}.metro-${String(process.pid)}`;
+  const head = await spool(body, tmp);
+  if (!firstLineIsJson(head)) {
+    rmSync(tmp, { force: true });
+    throw new ApiError('a session file is JSON lines, one Claude Code entry per line', 400);
+  }
+  renameSync(tmp, path);
+  return { id: safeName(session, SESSION_RE, 'session id'), bytes: statSync(path).size };
 }
 
 function firstLineIsJson(text: string): boolean {

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.126"
+  "version": "0.1.0-beta.127"
 }