@stage-labs/metro 0.1.0-beta.142 → 0.1.0-beta.144

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.142",
+  "version": "0.1.0-beta.144",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.142",
+  "version": "0.1.0-beta.144",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/connectors/api.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { log } from '@metro-labs/core/log';
 import { healthOf } from './health.js';
+import type { RemoteTool } from './tools.js';
 import {
   apiFailure,
   apiSession,
@@ -40,6 +41,7 @@ export interface ConnectorApiDeps extends OAuthRouteDeps {
     input: ConnectorInput,
   ) => Promise<Connector>;
   verifyConnector: (subject: string, id: string) => Promise<ConnectorCheck>;
+  connectorTools: (subject: string, id: string) => Promise<RemoteTool[]>;
   disconnectConnector: (subject: string, id: string) => Promise<Connector>;
   renameConnector: (
     subject: string,
@@ -54,6 +56,7 @@ type Routable =
   | { kind: 'callback' }
   | { kind: 'connector'; id: string }
   | { kind: 'verify'; id: string }
+  | { kind: 'tools'; id: string }
   | { kind: 'connect'; id: string }
   | { kind: 'disconnect'; id: string }
   | { kind: 'rename'; id: string };
@@ -65,6 +68,7 @@ function subTarget(id: string, rest: string[]): Target {
   if (rest.length > 1) return { kind: 'unknown' };
   const head = rest[0];
   if (head === 'verify') return { kind: 'verify', id };
+  if (head === 'tools') return { kind: 'tools', id };
   if (head === 'connect') return { kind: 'connect', id };
   if (head === 'disconnect') return { kind: 'disconnect', id };
   if (head === 'rename') return { kind: 'rename', id };
@@ -237,6 +241,7 @@ async function route(
     if (tgt.kind === 'callback') return;
     if (tgt.kind === 'verify')
       await handleVerify(req, res, deps, session, tgt.id);
+    else if (tgt.kind === 'tools') sendJson(req, res, 200, { tools: await deps.connectorTools(session.subject, tgt.id) });
     else if (tgt.kind === 'connect')
       await handleConnect(req, res, deps, session, tgt.id);
     else if (tgt.kind === 'disconnect')
@@ -257,6 +262,7 @@ const ALLOWED: Record<Routable['kind'], string[]> = {
   callback: ['GET'],
   connector: ['GET', 'DELETE'],
   verify: ['POST'],
+  tools: ['GET'],
   connect: ['POST'],
   disconnect: ['POST'],
   rename: ['POST'],

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay.ts

@@ -9,6 +9,7 @@ import { errMsg, log } from '@metro-labs/core/log';
 export interface RelayApiDeps {
   target: (connectorId: string, force: boolean) => Promise<RelayTarget>;
   identify: (req: IncomingMessage) => AgentIdentity | null;
+  signedOut: (connectorId: string) => void;
 }
 
 const ID_PATH_RE = /^\/relay\/([A-Za-z0-9][A-Za-z0-9_-]{10})$/;
@@ -242,6 +243,7 @@ async function relayExchange(
   }
   if (out.kind === 'signin') {
     noteHealth(connectorId, false, 'the sign-in has expired, connect it again');
+    deps.signedOut(connectorId);
     signinAnswer(res, connectorId);
     return;
   }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/store.ts

@@ -1,5 +1,6 @@
 import { join } from 'node:path';
 import { syncPluginServers } from './plugin-sync.js';
+import { listRemoteTools, type RemoteTool } from './tools.js';
 import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
 import { errMsg, log } from '@metro-labs/core/log';
 import {
@@ -200,10 +201,19 @@ export async function localReconnectConnector(
   return replace(dir, { ...row, config: { ...row.config, auth, verified, oauth: true } });
 }
 
+const signedOut = (row: LocalConnectorRow): LocalConnectorRow => ({ ...row, config: { ...row.config, auth: { kind: 'none' }, oauth: true } });
+
 export async function localDisconnectConnector(subject: string, id: string, dir = agentsDir()): Promise<Connector> {
   const row = rowOrThrow(subject, id, dir);
   if (row.config.auth.kind !== 'oauth') throw new ConnectorError('that connector is not signed in', 400);
-  return Promise.resolve(replace(dir, { ...row, config: { ...row.config, auth: { kind: 'none' }, oauth: true } }));
+  return Promise.resolve(replace(dir, signedOut(row)));
+}
+
+export function localMarkSignedOut(id: string, dir = agentsDir()): void {
+  const row = readLocalConnectors(dir).find((r) => r.id === id);
+  if (row?.config.auth.kind !== 'oauth') return;
+  log.info({ id, name: row.name }, 'local relay: the vendor refused the token after a refresh; the connector is signed out');
+  replace(dir, signedOut(row));
 }
 
 async function freshAuth(auth: ConnectorAuth, resource: string): Promise<ConnectorAuth> {
@@ -226,6 +236,14 @@ export async function localVerifyConnector(subject: string, id: string, dir = ag
   }
 }
 
+export async function localConnectorTools(subject: string, id: string, dir = agentsDir()): Promise<RemoteTool[]> {
+  const row = rowOrThrow(subject, id, dir);
+  const url = parseConnectorUrl(row.url);
+  const auth = await freshAuth(row.config.auth, url.toString());
+  if (auth !== row.config.auth) replace(dir, { ...row, config: { ...row.config, auth } });
+  return listRemoteTools(url, auth);
+}
+
 export async function localRenameConnector(subject: string, id: string, raw: string, dir = agentsDir()): Promise<Connector> {
   const name = connectorName(raw);
   const row = rowOrThrow(subject, id, dir);

package/runtime/node_modules/@metro-labs/daemon/src/connectors/tools.ts

@@ -0,0 +1,108 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { whyUnreachable } from './reach.js';
+import { refused } from './url.js';
+import { authHeaders, type ConnectorAuth } from './verify.js';
+
+export interface RemoteTool {
+  name: string;
+  description: string;
+  readOnly: boolean;
+}
+
+const TIMEOUT_MS = 15_000;
+const MAX_PAGES = 10;
+const ACCEPT = 'application/json, text/event-stream';
+
+function dataOf(text: string, contentType: string): string {
+  if (!contentType.includes('text/event-stream')) return text;
+  for (const line of text.replace(/\r\n/g, '\n').split('\n')) if (line.startsWith('data:')) return line.slice(5).trim();
+  return '';
+}
+
+async function post(url: URL, auth: ConnectorAuth, session: Map<string, string>, body: unknown): Promise<Response> {
+  try {
+    return await fetch(url, {
+      method: 'POST',
+      redirect: 'manual',
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+      headers: { 'content-type': 'application/json', accept: ACCEPT, ...authHeaders(auth), ...Object.fromEntries(session) },
+      body: JSON.stringify(body),
+    });
+  } catch (err) {
+    throw refused(`Metro could not reach ${url.hostname}: ${whyUnreachable(err)}`);
+  }
+}
+
+function resultOf(text: string, contentType: string): Record<string, unknown> | null {
+  let parsed: unknown = null;
+  try {
+    parsed = JSON.parse(dataOf(text, contentType));
+  } catch {
+    return null;
+  }
+  return isRecord(parsed) && isRecord(parsed.result) ? parsed.result : null;
+}
+
+async function rpc(url: URL, auth: ConnectorAuth, session: Map<string, string>, body: unknown): Promise<Record<string, unknown> | null> {
+  const res = await post(url, auth, session, body);
+  const id = res.headers.get('mcp-session-id');
+  if (id !== null && id !== '') session.set('mcp-session-id', id);
+  const text = await res.text().catch(() => '');
+  if (res.status === 401 || res.status === 403) throw refused(`${url.hostname} rejected the credential; connect it again`);
+  if (!res.ok) throw refused(`${url.hostname} answered ${String(res.status)}`);
+  return resultOf(text, res.headers.get('content-type') ?? '');
+}
+
+function toTool(raw: unknown): RemoteTool | null {
+  if (!isRecord(raw) || typeof raw.name !== 'string') return null;
+  const annotations = isRecord(raw.annotations) ? raw.annotations : {};
+  const title = typeof raw.title === 'string' && raw.title !== '' ? raw.title : raw.name;
+  return { name: title, description: typeof raw.description === 'string' ? raw.description : '', readOnly: annotations.readOnlyHint === true };
+}
+
+async function endSession(url: URL, auth: ConnectorAuth, session: Map<string, string>): Promise<void> {
+  if (!session.has('mcp-session-id')) return;
+  try {
+    const res = await fetch(url, { method: 'DELETE', redirect: 'manual', signal: AbortSignal.timeout(TIMEOUT_MS), headers: { ...authHeaders(auth), ...Object.fromEntries(session) } });
+    await res.body?.cancel();
+  } catch (err) {
+    log.debug({ host: url.hostname, err: errMsg(err) }, 'connector-tools: the remote declined to end the session');
+  }
+}
+
+const toolsOf = (result: Record<string, unknown>): RemoteTool[] =>
+  Array.isArray(result.tools) ? result.tools.flatMap((raw: unknown) => toTool(raw) ?? []) : [];
+
+function nextCursor(result: Record<string, unknown>, current: string): string | null {
+  const next = result.nextCursor;
+  return typeof next !== 'string' || next === '' || next === current ? null : next;
+}
+
+async function walkTools(url: URL, auth: ConnectorAuth, session: Map<string, string>): Promise<RemoteTool[]> {
+  const tools: RemoteTool[] = [];
+  let cursor: string | null = '';
+  for (let page = 0; page < MAX_PAGES && cursor !== null; page += 1) {
+    const result = await rpc(url, auth, session, { jsonrpc: '2.0', id: 2 + page, method: 'tools/list', params: cursor === '' ? {} : { cursor } });
+    if (result === null) break;
+    tools.push(...toolsOf(result));
+    cursor = nextCursor(result, cursor);
+  }
+  return tools;
+}
+
+export async function listRemoteTools(url: URL, auth: ConnectorAuth): Promise<RemoteTool[]> {
+  const session = new Map<string, string>();
+  const init = await rpc(url, auth, session, {
+    jsonrpc: '2.0',
+    id: 1,
+    method: 'initialize',
+    params: { protocolVersion: '2025-11-25', capabilities: {}, clientInfo: { name: 'metro', version: '0.1.0' } },
+  });
+  if (init === null || typeof init.protocolVersion !== 'string') throw refused(`${url.hostname} answered, but it does not speak MCP.`);
+  session.set('mcp-protocol-version', init.protocolVersion);
+  await rpc(url, auth, session, { jsonrpc: '2.0', method: 'notifications/initialized' });
+  const tools = await walkTools(url, auth, session);
+  await endSession(url, auth, session);
+  return tools;
+}

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -27,6 +27,8 @@ import {
   localRelayTarget,
   localRenameConnector,
   localVerifyConnector,
+  localMarkSignedOut,
+  localConnectorTools,
 } from '../connectors/store.js';
 import {
   assertLocalOwner,
@@ -126,6 +128,7 @@ const connectorApi: ConnectorApiDeps = {
   },
   createConnector: localCreateConnector,
   verifyConnector: localVerifyConnector,
+  connectorTools: localConnectorTools,
   disconnectConnector: localDisconnectConnector,
   renameConnector: localRenameConnector,
   deleteConnector: localDeleteConnector,
@@ -140,6 +143,9 @@ const relayApi: RelayApiDeps = {
     const who = authenticate(req);
     return who?.kind === 'agent' ? { subject: 'agent-key', agentId: who.agentId } : null;
   },
+  signedOut: (id) => {
+    localMarkSignedOut(id);
+  },
 };
 
 

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.142"
+  "version": "0.1.0-beta.144"
 }