@stage-labs/metro 0.1.0-beta.137 → 0.1.0-beta.139

package/dist/serve.js

@@ -64,9 +64,9 @@ export function requireOwner(owner, dir = agentsDir()) {
     if (owner !== null || existsSync(join(dir, '.owner')))
         return;
     throw new Error('no owner is set for this machine, so nobody could sign in.\n' +
-        'Pass the organization (or wallet) that owns it once; it is remembered in ' +
+        'Pass the organization that owns it once; it is remembered in ' +
         join(dir, '.owner') +
-        ':\n  metro serve --owner <org_… or address>');
+        ':\n  metro serve --owner <org_…>');
 }
 export function readOwner(dir = agentsDir()) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.137",
+  "version": "0.1.0-beta.139",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.137",
+  "version": "0.1.0-beta.139",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, the standing rules loaded at each session start, and a refresh skill for when the daemon could not keep the server list current. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/package.json

@@ -33,7 +33,6 @@
     "@metro-labs/whatsapp": "workspace:*",
     "@metro-labs/xmtp": "workspace:*",
     "@modelcontextprotocol/sdk": "^1.12.0",
-    "viem": "2.52.2",
     "ws": "^8.18.0",
     "zod": "^3.23.8"
   },

package/runtime/node_modules/@metro-labs/daemon/src/agents/files.ts

@@ -10,7 +10,6 @@ import { isRecord } from '@metro-labs/core/is-record';
 export const AGENT_FILE = 'agent.json';
 
 const KEY_RE = /^[A-Za-z0-9_-]{16,128}$/;
-const ADDRESS_RE = /^0x[0-9a-f]{40}$/;
 const STATION_NAMES = new Set<string>(STATIONS);
 
 export class AgentFileError extends Error {}
@@ -34,6 +33,8 @@ export function agentsDir(): string {
     : join(homedir(), '.metro', 'agents');
 }
 
+const OWNER_RE = /^(0x[0-9a-f]{40}|org_[A-Za-z0-9]{10,64})$/;
+
 function fail(path: string, reason: string): never {
   throw new AgentFileError(`${path}: ${reason}`);
 }
@@ -98,9 +99,9 @@ export function parseAgentFile(raw: string, path: string): AgentFile {
   const key = optionalMatch(parsed.key, KEY_RE, path, 'key is not an agent key');
   const owner = optionalMatch(
     parsed.owner,
-    ADDRESS_RE,
+    OWNER_RE,
     path,
-    'owner is not a lowercase Ethereum address',
+    'owner is neither an organization id nor a lowercase Ethereum address',
   );
   if (!Array.isArray(stations)) fail(path, 'stations is not a list');
   return {

package/runtime/node_modules/@metro-labs/daemon/src/boot/local-owner.ts

@@ -1,14 +1,30 @@
 import { localOwner, setLocalOwner } from '../agents/file-admin.js';
+import { isOrganizationId } from '@metro-labs/http/workos-token';
 import { log } from '@metro-labs/core/log';
 
+const NO_ONE = 'nobody can sign in; restart with metro serve --owner <organization id>';
+
+const WALLET = `the owner is a wallet address, and wallets cannot sign in any more; ${NO_ONE}`;
+
+function keepsOrganization(wanted: string, stored: string | null): stored is string {
+  return wanted !== '' && stored !== null && isOrganizationId(stored) && !isOrganizationId(wanted);
+}
+
+function announce(owner: string | null): string | null {
+  if (owner === null) log.warn(`local daemon: no owner set, so ${NO_ONE}`);
+  else if (!isOrganizationId(owner)) log.warn(`local daemon: ${WALLET}`);
+  return owner;
+}
+
 export function applyLocalOwner(): string | null {
   const wanted = process.env.METRO_OWNER?.trim() ?? '';
-  if (wanted !== '') {
-    const address = setLocalOwner(wanted);
-    log.info({ owner: address }, 'local daemon: owner set from METRO_OWNER');
-    return address;
-  }
   const stored = localOwner();
-  if (stored === null) log.warn('local daemon: no owner set, so nobody can sign in; restart with metro serve --owner <organization id or address>');
-  return stored;
+  if (keepsOrganization(wanted, stored)) {
+    log.info({ owner: stored, ignored: wanted }, 'local daemon: this machine belongs to an organization, so the wallet in --owner is ignored');
+    return stored;
+  }
+  if (wanted === '') return announce(stored);
+  const owner = setLocalOwner(wanted);
+  log.info({ owner }, 'local daemon: owner set from METRO_OWNER');
+  return announce(owner);
 }

package/runtime/node_modules/@metro-labs/daemon/src/routes/http.ts

@@ -32,8 +32,6 @@ import {
 } from '../net/tunnel.js';
 import { attachmentEventUrl, handleAttachRequest } from '../files/attach-serve.js';
 import { webhookEntry } from '@metro-labs/webhook';
-import { handleIdentityRequest } from './identity.js';
-import { handleOwnerRequest } from './owner.js';
 import { attachTerminalSockets } from '../terminal/socket.js';
 import { tmuxCommand } from '../terminal/api.js';
 import { handleModeRequest } from '@metro-labs/http/mode-api';
@@ -327,8 +325,6 @@ function handleSignInRoutes(
   res: ServerResponse,
   apis: SessionApis,
 ): boolean {
-  if (apis.identity !== undefined && handleIdentityRequest(req, res, apis.identity)) return true;
-  if (apis.owner !== undefined && handleOwnerRequest(req, res, apis.owner)) return true;
   return apis.mode !== undefined && handleModeRequest(req, res, apis.mode);
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -31,6 +31,7 @@ import {
 } from '../connectors/store.js';
 import {
   assertLocalOwner,
+  setLocalOwner,
   LOCAL_PROJECT_ID,
   localAttachAccount,
   localDeleteAgent,
@@ -43,7 +44,6 @@ import {
   localOwner,
   localResetAgentKey,
   readLocalAgentFile,
-  setLocalOwner,
 } from '../agents/file-admin.js';
 import { listAgentFiles, readAgentFile } from '../agents/files.js';
 import { readModelConfig } from '../gateway/model-config.js';
@@ -214,12 +214,11 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
     claudeApi: { authorize: (subject) => { assertLocalOwner(subject); } },
     updateApi: { authorize: (subject) => { assertLocalOwner(subject); }, restart: deps.restart },
     controlApi: { authorize: (subject) => { assertLocalOwner(subject); }, restart: deps.restart, stop: deps.stop },
+    ownerApi: { authorize: (subject) => { assertLocalOwner(subject); }, setOwner: (owner) => setLocalOwner(owner) },
     machineApi: { authorize: (subject) => { assertLocalOwner(subject); } },
     modelApi: { authorize: (subject) => { assertLocalOwner(subject); } },
     gateway: { config: readModelConfig },
     terminalApi: { authorize: (subject) => { assertLocalOwner(subject); } },
-    identity: { owner: localOwner },
-    owner: { owner: localOwner, setOwner: setLocalOwner },
     mode: localModeInfo,
   };
 }

package/runtime/node_modules/@metro-labs/daemon/src/routes/session-apis.ts

@@ -6,14 +6,13 @@ import {
   type ConnectorApiDeps,
 } from '../connectors/api.js';
 import type { RelayApiDeps } from '../connectors/relay.js';
-import type { IdentityRouteDeps } from './identity.js';
-import type { OwnerRouteDeps } from './owner.js';
 import { handleLocalCliRequest, type LocalCliDeps } from '../connectors/cli-api.js';
 import { handleClaudeRequest, type ClaudeApiDeps } from '../claude/api.js';
 import type { ModeInfo } from '@metro-labs/http/mode-api';
 import { handleBundleRequest, type BundleApiDeps } from '../agents/bundle.js';
 import { handleUpdateRequest, type UpdateApiDeps } from '../server/update.js';
 import { handleControlRequest, type ControlApiDeps } from '../server/control.js';
+import { handleOwnerRequest, type OwnerApiDeps } from '../server/owner.js';
 import { handleMachineRequest, type MachineApiDeps } from '../server/machine.js';
 import { handleModelRequest, type ModelApiDeps } from '../gateway/model-api.js';
 import type { GatewayDeps } from '../gateway/gateway.js';
@@ -24,6 +23,7 @@ export interface SessionApis {
   bundleApi?: BundleApiDeps;
   updateApi?: UpdateApiDeps;
   controlApi?: ControlApiDeps;
+  ownerApi?: OwnerApiDeps;
   machineApi?: MachineApiDeps;
   modelApi?: ModelApiDeps;
   gateway?: GatewayDeps;
@@ -32,8 +32,6 @@ export interface SessionApis {
   claudeApi?: ClaudeApiDeps;
   connectorApi?: ConnectorApiDeps;
   relayApi?: RelayApiDeps;
-  identity?: IdentityRouteDeps;
-  owner?: OwnerRouteDeps;
   mode?: () => ModeInfo;
 }
 
@@ -52,6 +50,7 @@ export function handleSessionApis(
     ...when(apis.bundleApi, (d) => handleBundleRequest(req, res, d)),
     ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),
     ...when(apis.controlApi, (d) => handleControlRequest(req, res, d)),
+    ...when(apis.ownerApi, (d) => handleOwnerRequest(req, res, d)),
     ...when(apis.machineApi, (d) => handleMachineRequest(req, res, d)),
     ...when(apis.modelApi, (d) => handleModelRequest(req, res, d)),
     ...when(apis.terminalApi, (d) => handleTerminalRequest(req, res, d)),

package/runtime/node_modules/@metro-labs/daemon/src/server/owner.ts

@@ -0,0 +1,48 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { apiFailure, apiSession, cors, readJsonBody, requireAdmin, sendJson } from '@metro-labs/http/api-http';
+import { isOrganizationId } from '@metro-labs/http/workos-token';
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+
+const PATH = '/api/owner';
+
+export interface OwnerApiDeps {
+  authorize: (subject: string) => void;
+  setOwner: (owner: string) => string;
+}
+
+async function move(req: IncomingMessage, deps: OwnerApiDeps): Promise<{ owner: string }> {
+  const session = await apiSession(req);
+  if (!session) throw new ApiError('unauthorized', 401);
+  deps.authorize(session.subject);
+  requireAdmin(session);
+  const body = await readJsonBody(req);
+  const owner = isRecord(body) && typeof body.owner === 'string' ? body.owner.trim() : '';
+  if (!isOrganizationId(owner)) throw new ApiError('owner must be an organization id', 400);
+  if (owner === session.subject) throw new ApiError('this machine already belongs to that organization', 409);
+  const saved = deps.setOwner(owner);
+  log.info({ from: session.subject, to: saved }, 'owner: this machine moved to another organization');
+  return { owner: saved };
+}
+
+export function handleOwnerRequest(req: IncomingMessage, res: ServerResponse, deps: OwnerApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'POST') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  move(req, deps)
+    .then((body) => {
+      sendJson(req, res, 200, body);
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'owner-api');
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/http/package.json

@@ -8,9 +8,6 @@
     "./cors": "./src/cors.ts",
     "./api-http": "./src/api-http.ts",
     "./api-error": "./src/api-error.ts",
-    "./signed-identity": "./src/signed-identity.ts",
-    "./identity-key": "./src/identity-key.ts",
-    "./identity-registry": "./src/identity-registry.ts",
     "./return-to": "./src/return-to.ts",
     "./mode-api": "./src/mode-api.ts",
     "./workos-token": "./src/workos-token.ts"
@@ -20,9 +17,7 @@
     "test": "tsc --noEmit && bun test test/"
   },
   "dependencies": {
-    "@metro-labs/core": "workspace:*",
-    "@noble/curves": "^1.9.7",
-    "viem": "2.52.2"
+    "@metro-labs/core": "workspace:*"
   },
   "devDependencies": {
     "@stage-labs/config": "0.1.0-beta.2",

package/runtime/node_modules/@metro-labs/http/src/api-http.ts

@@ -1,8 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { ApiError } from './api-error.js';
 import { errMsg, log } from '@metro-labs/core/log';
-import { signedIdentity } from './signed-identity.js';
-import { identitySubject } from './identity-registry.js';
 
 const BODY_MAX = 4 * 1024;
 
@@ -29,7 +27,7 @@ export function cors(req: IncomingMessage): Record<string, string> {
   return {
     'access-control-allow-origin': req.headers.origin ?? '*',
     'access-control-allow-methods': 'GET, POST, PUT, DELETE, OPTIONS',
-    'access-control-allow-headers': 'Authorization, Content-Type, X-Metro-Wallet',
+    'access-control-allow-headers': 'Authorization, Content-Type',
     'access-control-allow-private-network': 'true',
     'access-control-max-age': '86400',
     vary: 'Origin',
@@ -50,13 +48,8 @@ export function sendJson(
   res.end(JSON.stringify(body));
 }
 
-export async function apiSession(req: IncomingMessage): Promise<ApiSession | null> {
-  const address = await signedIdentity(req);
-  if (address !== null) {
-    const subject = identitySubject(address);
-    return subject === undefined ? null : { subject, role: 'admin' };
-  }
-  return bearerSessions === null ? null : bearerSessions(req);
+export function apiSession(req: IncomingMessage): Promise<ApiSession | null> {
+  return bearerSessions === null ? Promise.resolve(null) : bearerSessions(req);
 }
 
 export interface AgentIdentity {

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.137"
+  "version": "0.1.0-beta.139"
 }

package/runtime/stations.json

@@ -1,10 +1,8 @@
 {
   "core": {
     "@modelcontextprotocol/sdk": "^1.12.0",
-    "@noble/curves": "^1.9.7",
     "pino": "^9.5.0",
     "pino-pretty": "^13.1.3",
-    "viem": "2.52.2",
     "ws": "^8.18.0",
     "zod": "^3.23.8"
   },

package/runtime/node_modules/@metro-labs/daemon/src/routes/identity.ts

@@ -1,54 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { verifyTypedData } from 'viem';
-import { log } from '@metro-labs/core/log';
-import { ApiError } from '@metro-labs/http/api-error';
-import { apiFailure, bodyField, cors, readJsonBody, sendJson } from '@metro-labs/http/api-http';
-import { ENCRYPTION_KEY_TYPED_DATA, deriveIdentityAddress } from '@metro-labs/http/identity-key';
-import { authorizeIdentity } from '@metro-labs/http/identity-registry';
-
-const PATH = '/auth/identity';
-const SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
-
-export interface IdentityRouteDeps {
-  owner: () => string | null;
-}
-
-async function register(req: IncomingMessage, deps: IdentityRouteDeps): Promise<{ address: string; owner: string }> {
-  const signature = bodyField(await readJsonBody(req), 'signature');
-  if (typeof signature !== 'string' || !SIGNATURE_RE.test(signature))
-    throw new ApiError('signature is required: the EncryptionKey signature of the owner wallet', 400);
-  const owner = deps.owner();
-  if (owner === null)
-    throw new ApiError('this machine has no owner yet: start it with metro serve --owner <address>', 403);
-  const ok = await verifyTypedData({
-    ...ENCRYPTION_KEY_TYPED_DATA,
-    address: owner as `0x${string}`,
-    signature: signature as `0x${string}`,
-  }).catch(() => false);
-  if (!ok) throw new ApiError('this machine belongs to another wallet', 403);
-  const address = deriveIdentityAddress(signature as `0x${string}`);
-  authorizeIdentity(address, owner);
-  log.info({ owner, identity: address }, 'identity: owner signed in');
-  return { address, owner };
-}
-
-export function handleIdentityRequest(req: IncomingMessage, res: ServerResponse, deps: IdentityRouteDeps): boolean {
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  if (path !== PATH) return false;
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (req.method !== 'POST') {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  register(req, deps)
-    .then((body) => {
-      sendJson(req, res, 200, body);
-    })
-    .catch((err: unknown) => {
-      apiFailure(req, res, err, 'identity');
-    });
-  return true;
-}

package/runtime/node_modules/@metro-labs/daemon/src/routes/owner.ts

@@ -1,49 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { log } from '@metro-labs/core/log';
-import { ApiError } from '@metro-labs/http/api-error';
-import { apiFailure, apiSession, bodyField, cors, readJsonBody, sendJson } from '@metro-labs/http/api-http';
-import { resetIdentities } from '@metro-labs/http/identity-registry';
-import { isOrganizationId } from '@metro-labs/http/workos-token';
-
-const PATH = '/api/owner';
-
-export interface OwnerRouteDeps {
-  owner: () => string | null;
-  setOwner: (owner: string) => string;
-}
-
-async function claim(req: IncomingMessage, deps: OwnerRouteDeps): Promise<{ owner: string; previous: string }> {
-  const session = await apiSession(req);
-  if (session === null) throw new ApiError('unauthorized', 401);
-  const previous = deps.owner();
-  if (previous === null) throw new ApiError('this machine has no owner yet', 403);
-  if (isOrganizationId(previous)) throw new ApiError('this machine already belongs to an organization', 409);
-  if (session.subject !== previous) throw new ApiError('only the wallet that owns this machine can hand it to an organization', 403);
-  const wanted = bodyField(await readJsonBody(req), 'owner');
-  if (typeof wanted !== 'string' || !isOrganizationId(wanted.trim())) throw new ApiError('owner must be an organization id (org_…)', 400);
-  const owner = deps.setOwner(wanted.trim());
-  resetIdentities();
-  log.info({ previous, owner }, 'owner: this machine now belongs to an organization; the wallet is no longer accepted');
-  return { owner, previous };
-}
-
-export function handleOwnerRequest(req: IncomingMessage, res: ServerResponse, deps: OwnerRouteDeps): boolean {
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  if (path !== PATH) return false;
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (req.method !== 'POST') {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  claim(req, deps)
-    .then((body) => {
-      sendJson(req, res, 200, body);
-    })
-    .catch((err: unknown) => {
-      apiFailure(req, res, err, 'owner');
-    });
-  return true;
-}

package/runtime/node_modules/@metro-labs/http/src/identity-key.ts

@@ -1,33 +0,0 @@
-import { hkdfSync } from 'node:crypto';
-import { secp256k1 } from '@noble/curves/secp256k1';
-import { mapHashToField } from '@noble/curves/abstract/modular';
-import { privateKeyToAccount } from 'viem/accounts';
-
-export const ENCRYPTION_KEY_TYPED_DATA = {
-  domain: { name: 'metro', version: '1' },
-  types: {
-    EncryptionKey: [
-      { name: 'purpose', type: 'string' },
-      { name: 'keyVersion', type: 'uint256' },
-    ],
-  },
-  primaryType: 'EncryptionKey',
-  message: { purpose: 'encryption-key', keyVersion: 1n },
-} as const;
-
-const KEY_SALT = 'metro';
-const IDENTITY_INFO = 'vault-secp256k1';
-const KEY_HASH_BYTES = 48;
-
-const toHex = (bytes: Uint8Array): `0x${string}` =>
-  `0x${[...bytes].map((b) => b.toString(16).padStart(2, '0')).join('')}`;
-
-export function deriveIdentityKey(signature: `0x${string}`): `0x${string}` {
-  const ikm = Buffer.from(signature.slice(2), 'hex');
-  const hash = new Uint8Array(hkdfSync('sha256', ikm, KEY_SALT, IDENTITY_INFO, KEY_HASH_BYTES));
-  return toHex(mapHashToField(hash, secp256k1.CURVE.n));
-}
-
-export function deriveIdentityAddress(signature: `0x${string}`): string {
-  return privateKeyToAccount(deriveIdentityKey(signature)).address.toLowerCase();
-}

package/runtime/node_modules/@metro-labs/http/src/identity-registry.ts

@@ -1,13 +0,0 @@
-const subjects = new Map<string, string>();
-
-export function authorizeIdentity(address: string, subject: string): void {
-  subjects.set(address.toLowerCase(), subject.toLowerCase());
-}
-
-export function identitySubject(address: string): string | undefined {
-  return subjects.get(address.toLowerCase());
-}
-
-export function resetIdentities(): void {
-  subjects.clear();
-}

package/runtime/node_modules/@metro-labs/http/src/signed-identity.ts

@@ -1,36 +0,0 @@
-import type { IncomingMessage } from 'node:http';
-import { verifyMessage } from 'viem';
-import { normalizeAddress } from '@metro-labs/core/address';
-
-export const AUTH_SCHEME = 'Metro';
-const SKEW_MS = 5 * 60_000;
-const SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
-
-export const identityChallenge = (method: string, path: string, at: number): string =>
-  `metro-auth\n${method} ${path}\n${String(at)}`;
-
-export interface SignedHeader {
-  address: string;
-  at: number;
-  signature: `0x${string}`;
-}
-
-export function parseIdentityHeader(header: string): SignedHeader | null {
-  const [scheme, rawAddress, rawAt, signature] = header.trim().split(/\s+/);
-  if (scheme !== AUTH_SCHEME || rawAddress === undefined || rawAt === undefined || signature === undefined) return null;
-  const address = normalizeAddress(rawAddress);
-  const at = Number(rawAt);
-  if (address === null || !Number.isFinite(at) || !SIGNATURE_RE.test(signature)) return null;
-  return { address, at, signature: signature as `0x${string}` };
-}
-
-export async function signedIdentity(req: IncomingMessage, now = Date.now()): Promise<string | null> {
-  const proof = parseIdentityHeader(req.headers.authorization ?? '');
-  if (proof === null || Math.abs(now - proof.at) > SKEW_MS) return null;
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  const message = identityChallenge(req.method ?? '', path, proof.at);
-  const ok = await verifyMessage({ address: proof.address as `0x${string}`, message, signature: proof.signature }).catch(
-    () => false,
-  );
-  return ok ? proof.address : null;
-}