@stage-labs/metro 0.1.0-beta.16 → 0.1.0-beta.17

package/dist/api.js

@@ -23,8 +23,8 @@ function tokenOrThrow() {
         throw new NotSignedIn('not signed in — run `metro login` first');
     return token;
 }
-async function get(path, presented) {
-    const auth = presented ?? tokenOrThrow();
+async function get(path) {
+    const auth = tokenOrThrow();
     let res;
     try {
         res = await fetch(`${metroUrl()}${path}`, {
@@ -44,14 +44,43 @@ async function get(path, presented) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+async function post(path, body) {
+    if (!carriesSecretsSafely(metroUrl()))
+        throw new Error(`refusing to send your code to ${metroUrl()} in the clear — use https, or a loopback address`);
+    let res;
+    try {
+        res = await fetch(`${metroUrl()}${path}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch {
+        throw new Error(`could not reach ${metroUrl()}`);
+    }
+    const parsed = await res.json().catch(() => null);
+    if (res.ok)
+        return parsed;
+    const detail = isRecord(parsed) ? parsed.error : undefined;
+    throw new Error(typeof detail === 'string' ? detail : `metro answered ${String(res.status)}`);
+}
+export async function claimCode(code) {
+    const body = await post('/api/cli/claim', { code });
+    if (!isRecord(body) ||
+        typeof body.session !== 'string' ||
+        typeof body.email !== 'string')
+        throw new Error('metro returned an unexpected response');
+    return { session: body.session, email: body.email };
+}
 export async function mcpServers() {
     const body = await get('/api/connectors');
     if (!isRecord(body) || typeof body.json !== 'string')
         throw new Error('metro returned an unexpected response');
     return body.json;
 }
-export async function sessionEmail(presented) {
-    const body = await get('/api/session', presented);
+export async function sessionEmail() {
+    const body = await get('/api/session');
     if (!isRecord(body) || typeof body.email !== 'string')
         throw new Error('metro returned an unexpected response');
     return body.email;

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { mcpServers, NotSignedIn, sessionEmail } from './api.js';
-import { signIn } from './login.js';
-import { clearToken, credentialsPath, metroUrl, writeToken } from './store.js';
+import { claimCode, mcpServers, NotSignedIn, sessionEmail } from './api.js';
+import { askLine } from './prompt.js';
+import { clearToken, credentialsPath, metroUrl, metroWebUrl, writeToken, } from './store.js';
 import { update } from './update.js';
 import { currentVersion } from './version.js';
 const USAGE = `metro — the command line for your MCP connectors
 
-  metro login     sign in to metro in your browser
+  metro login     sign in with a code from the metro web UI
   metro logout    forget this machine's sign-in
   metro whoami    print the account this machine is signed in as
   metro mcp       print an mcpServers block for every connector
@@ -19,12 +19,13 @@ Start Claude Code with all of them, without writing them to disk:
 
   METRO_URL     the metro to talk to (default https://mcp.metro.box)
   METRO_TOKEN   use this session instead of the stored one
+  METRO_UI_URL  where the web UI lives (default https://metro.box)
 `;
 async function login() {
-    const token = await signIn();
-    const email = await sessionEmail(token).catch(() => '');
-    writeToken(token);
-    process.stderr.write(`Signed in${email === '' ? '' : ` as ${email}`}. Stored in ${credentialsPath()}\n`);
+    process.stderr.write(`Get a code from ${metroWebUrl()}/#/settings\n`);
+    const { session, email } = await claimCode(await askLine('Paste it here: '));
+    writeToken(session);
+    process.stderr.write(`Signed in as ${email}. Stored in ${credentialsPath()}\n`);
 }
 async function whoami() {
     process.stdout.write(`${await sessionEmail()} on ${metroUrl()}\n`);

package/dist/prompt.js

@@ -0,0 +1,10 @@
+import { createInterface } from 'node:readline';
+export function askLine(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}

package/dist/store.js

@@ -2,9 +2,16 @@ import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 const DEFAULT_BASE = 'https://mcp.metro.box';
+const DEFAULT_WEB = 'https://metro.box';
+function fromEnv(name, fallback) {
+    const raw = process.env[name]?.trim();
+    return raw === undefined || raw === '' ? fallback : raw.replace(/\/+$/, '');
+}
 export function metroUrl() {
-    const raw = process.env.METRO_URL?.trim();
-    return raw === undefined || raw === '' ? DEFAULT_BASE : raw.replace(/\/+$/, '');
+    return fromEnv('METRO_URL', DEFAULT_BASE);
+}
+export function metroWebUrl() {
+    return fromEnv('METRO_UI_URL', DEFAULT_WEB);
 }
 function configDir() {
     const xdg = process.env.XDG_CONFIG_HOME?.trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.16",
+  "version": "0.1.0-beta.17",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/dist/login.js

@@ -1,102 +0,0 @@
-import { createServer } from 'node:http';
-import { randomBytes } from 'node:crypto';
-import { spawn } from 'node:child_process';
-import { metroUrl } from './store.js';
-const TIMEOUT_MS = 5 * 60_000;
-const MAX_BODY = 16 * 1024;
-const PAGE = `<!doctype html><meta charset="utf-8"><title>Metro</title>
-<body style="font:16px system-ui;padding:3rem;color:#222">
-<p id="m">Finishing sign-in…</p>
-<script>
-const nonce = new URLSearchParams(location.search).get('s') || '';
-const body = new URLSearchParams(location.hash.replace(/^#/, ''));
-body.set('s', nonce);
-fetch('/token', { method: 'POST', body }).then(
-  () => { document.getElementById('m').textContent = 'Signed in. You can close this tab.'; },
-  () => { document.getElementById('m').textContent = 'Could not reach the metro CLI.'; },
-);
-</script>`;
-function browserCommand(url) {
-    if (process.platform === 'darwin')
-        return { cmd: 'open', args: [url] };
-    if (process.platform === 'win32')
-        return { cmd: 'cmd', args: ['/c', 'start', '', url] };
-    return { cmd: 'xdg-open', args: [url] };
-}
-function openBrowser(url) {
-    if (process.env.METRO_NO_BROWSER === '1')
-        return;
-    const { cmd, args } = browserCommand(url);
-    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
-    child.on('error', () => undefined);
-    child.unref();
-}
-async function readBody(req) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of req) {
-        const buf = chunk;
-        size += buf.length;
-        if (size > MAX_BODY)
-            throw new Error('sign-in body too large');
-        chunks.push(buf);
-    }
-    return Buffer.concat(chunks).toString('utf8');
-}
-export function sessionFrom(body, nonce) {
-    const params = new URLSearchParams(body);
-    if (params.get('s') !== nonce)
-        return '';
-    return params.get('session') ?? '';
-}
-export function signIn() {
-    const nonce = randomBytes(16).toString('base64url');
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        const finish = (err, token) => {
-            if (settled)
-                return;
-            settled = true;
-            server.close();
-            clearTimeout(timer);
-            if (err !== null)
-                reject(err);
-            else
-                resolve(token ?? '');
-        };
-        const accept = (res, body) => {
-            const session = sessionFrom(body, nonce);
-            if (session === '') {
-                res.writeHead(400).end();
-                return;
-            }
-            res.writeHead(204).end();
-            finish(null, session);
-        };
-        const server = createServer((req, res) => {
-            if (req.method !== 'POST' || !(req.url ?? '').startsWith('/token')) {
-                res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }).end(PAGE);
-                return;
-            }
-            readBody(req).then((body) => {
-                accept(res, body);
-            }, () => {
-                res.writeHead(400).end();
-            });
-        });
-        const timer = setTimeout(() => {
-            finish(new Error('sign-in timed out'));
-        }, TIMEOUT_MS);
-        timer.unref();
-        server.on('error', (err) => {
-            finish(err);
-        });
-        server.listen(0, '127.0.0.1', () => {
-            const { port } = server.address();
-            const returnTo = `http://127.0.0.1:${String(port)}/callback?s=${nonce}`;
-            const url = `${metroUrl()}/auth/google/start?return_to=${encodeURIComponent(returnTo)}`;
-            process.stderr.write(`Opening ${url}\n`);
-            openBrowser(url);
-        });
-    });
-}