@stage-labs/metro 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/cli.js

@@ -6,6 +6,7 @@ import { clearToken, credentialsPath, metroUrl, metroWebUrl, writeToken, } from
 import { detach, lockedBy, probe, runningPid, stopAll, tail } from './control.js';
 import { tailEvents } from './tail.js';
 import { assertAgentId, daemonPlan, localUrl, readRunToken, runDaemon, runtimeDir, writeRunToken, } from './runtime.js';
+import { installPlugin, syncPluginServers } from './plugin.js';
 import { update } from './update.js';
 import { currentVersion } from './version.js';
 const USAGE = `metro — the command line for your MCP connectors
@@ -24,6 +25,7 @@ const USAGE = `metro — the command line for your MCP connectors
   metro logout    forget this machine's sign-in
   metro whoami    print the account and collection this machine may read
   metro mcp       print the mcpServers block for the authorized collection
+  metro plugin    set up the Claude Code plugin (connector servers + /metro:login)
   metro update    update to the newest published version
   metro version   print this CLI's version
 
@@ -102,6 +104,9 @@ async function login() {
     const { token, email, collection } = await claimCode(await askSecret('Paste the code here (input is hidden): '));
     writeToken(token);
     process.stderr.write(`Authorized '${collection}' for ${email}. Stored in ${credentialsPath()}\n`);
+    if (syncPluginServers())
+        process.stderr.write('Claude Code plugin refreshed — new sessions have the connectors; ' +
+            'run /reload-plugins in any session already open.\n');
 }
 async function whoami() {
     const { email, collection } = await whoisAuthorized();
@@ -131,6 +136,7 @@ const COMMANDS = {
         process.stdout.write(`${await mcpServers()}\n`);
         return 0;
     },
+    plugin: installPlugin,
     update,
     version: async () => {
         process.stdout.write(`${currentVersion()}\n`);

package/dist/plugin.js

@@ -0,0 +1,82 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { readToken } from './store.js';
+const MARKETPLACE_REPO = 'bonustrack/metro';
+const PLUGIN_SPEC = 'metro@metro';
+export function installPathFrom(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return null;
+    const plugins = parsed.plugins;
+    if (typeof plugins !== 'object' || plugins === null)
+        return null;
+    const entries = plugins[PLUGIN_SPEC];
+    if (!Array.isArray(entries))
+        return null;
+    const first = entries[0];
+    return typeof first?.installPath === 'string' ? first.installPath : null;
+}
+export function pluginInstallPath() {
+    const registry = join(homedir(), '.claude', 'plugins', 'installed_plugins.json');
+    let raw;
+    try {
+        raw = readFileSync(registry, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const path = installPathFrom(raw);
+    if (path === null)
+        return null;
+    return existsSync(join(path, 'bin', 'metro-plugin.mjs')) ? path : null;
+}
+function runClaude(args) {
+    const res = spawnSync('claude', args, { encoding: 'utf8' });
+    if (res.error !== undefined)
+        throw new Error('the `claude` command is not on PATH — install Claude Code first');
+    const output = `${res.stdout ?? ''}${res.stderr ?? ''}`;
+    return { ok: res.status === 0, output };
+}
+const tolerable = (output) => /already|exists|latest version/i.test(output);
+export function syncPluginServers() {
+    const path = pluginInstallPath();
+    if (path === null || readToken() === null)
+        return false;
+    const script = join(path, 'bin', 'metro-plugin.mjs');
+    const refreshed = spawnSync(process.execPath, [script, 'refresh'], {
+        stdio: ['ignore', 'inherit', 'inherit'],
+    });
+    if (refreshed.status !== 0)
+        return false;
+    runClaude(['plugin', 'update', PLUGIN_SPEC]);
+    return true;
+}
+export async function installPlugin() {
+    const added = runClaude(['plugin', 'marketplace', 'add', MARKETPLACE_REPO]);
+    if (!added.ok && !tolerable(added.output)) {
+        process.stderr.write(added.output);
+        return 1;
+    }
+    const installed = runClaude(['plugin', 'install', PLUGIN_SPEC]);
+    if (!installed.ok && !tolerable(installed.output)) {
+        process.stderr.write(installed.output);
+        return 1;
+    }
+    process.stderr.write('Claude Code plugin installed.\n');
+    if (syncPluginServers()) {
+        process.stderr.write('Connector servers loaded — new Claude sessions have them; ' +
+            'run /reload-plugins in any session already open.\n');
+        return 0;
+    }
+    process.stderr.write('Now sign in: metro login (get a code at https://metro.box/#/authorize), ' +
+        'or run /metro:login <code> inside Claude Code.\n');
+    return Promise.resolve(0);
+}

package/dist/prompt.js

@@ -35,7 +35,7 @@ export function askSecret(question) {
     stdin.resume();
     stdin.setEncoding('utf8');
     return new Promise((resolve, reject) => {
-        let value = '\u0003';
+        let value = '';
         const finish = () => {
             stdin.setRawMode(false);
             stdin.pause();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.25",
+  "version": "0.1.0-beta.27",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/boot.ts

@@ -63,13 +63,14 @@ import {
   createPendingConnectorForEmail,
   deleteConnectorForEmail,
   disconnectConnectorForEmail,
+  connectorNamesByIds,
   getConnectorForEmail,
   listConnectorsForEmail,
-  listFreshConnectorsByIds,
   renameConnectorForEmail,
   reconnectConnectorForEmail,
   verifyConnectorForEmail,
 } from '../db/connectors.js';
+import { relayTarget } from '../db/connector-relay.js';
 import {
   addMemberForEmail,
   createProjectForEmail,
@@ -236,7 +237,7 @@ const projectApi: ProjectApiDeps = {
 
 const connectorApi: ConnectorApiDeps = {
   listConnectors: listConnectorsForEmail,
-  freshConnectorsByIds: listFreshConnectorsByIds,
+  connectorNamesByIds,
   listCollections: listCollectionsForEmail,
   getCollection: getCollectionForEmail,
   createCollection: createCollectionForEmail,
@@ -262,7 +263,7 @@ async function main(): Promise<void> {
   const metroMcp = await createMetroMcp();
   webhookServer = await startWebhookServer(
     emit,
-    { agentApi, connectorApi, projectApi, runApi },
+    { agentApi, connectorApi, projectApi, runApi, relayApi: { target: relayTarget } },
     metroMcp.httpHandler,
     metroCall,
   );

package/runtime/node_modules/@metro-labs/mcp/src/daemon/cli-pair-api.ts

@@ -7,8 +7,10 @@ import {
   readJsonBody,
   sendJson,
 } from './api-http.js';
+import { extractToken } from '../mcp/request-identity.js';
+import { publicBaseOrDefault } from './attach-serve.js';
 import { CLI_CODE_RE, takeCliCode } from './cli-pair.js';
-import { mcpServersJson } from './connector-json.js';
+import { relayServersJson } from './connector-json.js';
 import { sessionTtlFromEnv } from './google-oauth.js';
 import { signCliToken } from './session.js';
 import type { ConnectorApiDeps } from './connector-api.js';
@@ -38,11 +40,16 @@ async function handleClaim(
     sendJson(req, res, 503, { error: 'sign-in is not configured' });
     return;
   }
-  const code = bodyField(await readJsonBody(req), 'code');
-  const taken =
-    typeof code === 'string' && CLI_CODE_RE.test(code)
-      ? takeCliCode(code)
-      : undefined;
+  const raw = bodyField(await readJsonBody(req), 'code');
+  const code = typeof raw === 'string' ? raw.trim() : '';
+  if (!CLI_CODE_RE.test(code)) {
+    sendJson(req, res, 400, {
+      error:
+        'that does not look like a collection code — metro login wants the mc_… code from metro.box/#/authorize',
+    });
+    return;
+  }
+  const taken = takeCliCode(code);
   if (taken === undefined) {
     sendJson(req, res, 400, {
       error: 'that code has expired or was already used',
@@ -75,8 +82,13 @@ async function handleRead(
     sendJson(req, res, 200, { email: who.email, collection: collection.name });
     return;
   }
-  const rows = await deps.freshConnectorsByIds(collection.connectorIds);
-  sendJson(req, res, 200, { json: mcpServersJson(rows), collection: collection.name });
+  const entries = await deps.connectorNamesByIds(collection.connectorIds);
+  const json = relayServersJson(
+    entries,
+    publicBaseOrDefault(),
+    extractToken(req) ?? '',
+  );
+  sendJson(req, res, 200, { json, collection: collection.name });
 }
 
 export function handleCliPairRequest(

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-api.ts

@@ -12,6 +12,7 @@ import {
 } from './api-http.js';
 import { parseId } from '../db/ids.js';
 import type { ConnectorCollectionRow } from '../db/connector-collections.js';
+import type { RelayServerEntry } from './connector-json.js';
 import {
   handleCallback,
   handleConnect,
@@ -34,7 +35,7 @@ const asText = (value: unknown): string =>
 
 export interface ConnectorApiDeps extends OAuthRouteDeps {
   listConnectors: (email: string, project: string) => Promise<Connector[]>;
-  freshConnectorsByIds: (ids: string[]) => Promise<Connector[]>;
+  connectorNamesByIds: (ids: string[]) => Promise<RelayServerEntry[]>;
   listCollections: (
     email: string,
     project: string,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-json.ts

@@ -1,31 +1,21 @@
-import type { ConnectorTransport } from '../db/schema.js';
-
-export interface ConnectorEntry {
+export interface RelayServerEntry {
+  id: string;
   name: string;
-  url: string;
-  transport: ConnectorTransport;
-  header: string | null;
-  secret: string | null;
-  bearer: string | null;
-}
-
-function headersOf(entry: ConnectorEntry): Record<string, string> | null {
-  const { header, secret, bearer } = entry;
-  if (typeof header === 'string' && typeof secret === 'string')
-    return { [header]: secret };
-  if (typeof bearer === 'string' && bearer !== '')
-    return { Authorization: `Bearer ${bearer}` };
-  return null;
 }
 
-function serverOf(entry: ConnectorEntry): Record<string, unknown> {
-  const base = { type: entry.transport, url: entry.url };
-  const headers = headersOf(entry);
-  return headers === null ? base : { ...base, headers };
-}
+export const NAME_PREFIX = 'metro.box ';
 
-export function mcpServersJson(entries: ConnectorEntry[]): string {
+export function relayServersJson(
+  entries: RelayServerEntry[],
+  base: string,
+  cliToken: string,
+): string {
   const mcpServers: Record<string, unknown> = {};
-  for (const entry of entries) mcpServers[entry.name] = serverOf(entry);
+  for (const entry of entries)
+    mcpServers[`${NAME_PREFIX}${entry.name}`] = {
+      type: 'http',
+      url: `${base}/relay/${entry.id}`,
+      headers: { Authorization: `Bearer ${cliToken}` },
+    };
   return JSON.stringify({ mcpServers }, null, 2);
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-oauth.ts

@@ -17,7 +17,7 @@ import { startPending, takePending, type PendingAuth } from './oauth-pending.js'
 
 export { takePending, type PendingAuth };
 
-const REFRESH_SKEW_MS = 60_000;
+const REFRESH_SKEW_MS = 300_000;
 
 export const CALLBACK_PATH = '/api/connectors/callback';
 

package/runtime/node_modules/@metro-labs/mcp/src/daemon/http.ts

@@ -1,4 +1,5 @@
 import { handleSessionApis, type SessionApis } from './session-apis.js';
+import { handleRelayRequest } from './relay.js';
 import {
   createServer,
   type IncomingMessage,
@@ -334,6 +335,7 @@ async function handlePreMcpRoutes(
   if (handleSessionApis(req, res, apis)) return true;
   if (handleUploadRequest(req, res)) return true;
   if (handleAttachRequest(req, res)) return true;
+  if (apis.relayApi && handleRelayRequest(req, res, apis.relayApi)) return true;
   if (await handleWebhookRoute(req, res, emit)) return true;
   return Boolean(monitorCall && handleMonitorRequest(req, res, monitorCall));
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/relay.ts

@@ -0,0 +1,302 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RelayTarget } from '../db/connector-relay.js';
+import { cliIdentity } from './api-http.js';
+import { ApiError } from './api-error.js';
+import { errMsg, log } from './log.js';
+
+export interface RelayApiDeps {
+  target: (
+    collectionId: string,
+    connectorId: string,
+    force: boolean,
+  ) => Promise<RelayTarget>;
+}
+
+const ID_PATH_RE = /^\/relay\/([A-Za-z0-9][A-Za-z0-9_-]{10})$/;
+const METHODS = new Set(['POST', 'GET', 'DELETE']);
+const RELAY_BODY_MAX = 8 * 1024 * 1024;
+const FIRST_BYTE_MS = 120_000;
+const PASS_REQ = [
+  'accept',
+  'content-type',
+  'mcp-session-id',
+  'mcp-protocol-version',
+  'last-event-id',
+] as const;
+const PASS_RES = [
+  'content-type',
+  'mcp-session-id',
+  'mcp-protocol-version',
+  'cache-control',
+] as const;
+
+const keepaliveMs = (): number =>
+  Number(process.env.METRO_RELAY_KEEPALIVE_MS) || 25_000;
+
+const reconnectUrl = (id: string): string =>
+  `https://metro.box/#/connector/${id}`;
+
+function answer(
+  res: ServerResponse,
+  status: number,
+  body: Record<string, unknown>,
+): void {
+  if (res.headersSent) return;
+  res.writeHead(status, { 'content-type': 'application/json' });
+  res.end(JSON.stringify(body));
+}
+
+const signinAnswer = (res: ServerResponse, id: string): void => {
+  answer(res, 424, {
+    error: 'this connector needs signing in again',
+    reconnect: reconnectUrl(id),
+  });
+};
+
+function closeIfBodyUnread(req: IncomingMessage, res: ServerResponse): void {
+  if (req.readableEnded) return;
+  const drop = (): void => {
+    req.socket?.destroy();
+  };
+  if (res.writableFinished) drop();
+  else res.once('finish', drop);
+}
+
+async function readCapped(req: IncomingMessage): Promise<Uint8Array<ArrayBuffer>> {
+  const declared = Number(req.headers['content-length']);
+  if (Number.isFinite(declared) && declared > RELAY_BODY_MAX)
+    throw new ApiError('relay body exceeds 8 MiB', 413);
+  const chunks: Buffer[] = [];
+  let total = 0;
+  for await (const chunk of req) {
+    const buf = chunk as Buffer;
+    total += buf.length;
+    if (total > RELAY_BODY_MAX)
+      throw new ApiError('relay body exceeds 8 MiB', 413);
+    chunks.push(buf);
+  }
+  const merged = Buffer.concat(chunks);
+  const out = new Uint8Array(new ArrayBuffer(merged.byteLength));
+  out.set(merged);
+  return out;
+}
+
+function upstreamHeaders(
+  req: IncomingMessage,
+  injected: Record<string, string>,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const name of PASS_REQ) {
+    const value = req.headers[name];
+    if (typeof value === 'string') out[name] = value;
+  }
+  return { ...out, ...injected };
+}
+
+async function forward(
+  req: IncomingMessage,
+  target: { url: string; headers: Record<string, string> },
+  body: Uint8Array<ArrayBuffer> | null,
+  signal: AbortSignal,
+): Promise<Response> {
+  const firstByte = setTimeout(() => {
+    log.warn({ url: target.url }, 'relay: upstream sent no response in time');
+  }, FIRST_BYTE_MS);
+  firstByte.unref?.();
+  try {
+    return await fetch(target.url, {
+      method: req.method,
+      headers: upstreamHeaders(req, target.headers),
+      ...(body === null ? {} : { body }),
+      signal,
+      redirect: 'manual',
+    });
+  } finally {
+    clearTimeout(firstByte);
+  }
+}
+
+interface Keepalive {
+  touch: () => void;
+  stop: () => void;
+}
+
+function startKeepalive(res: ServerResponse): Keepalive {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const arm = (): void => {
+    timer = setTimeout(() => {
+      try {
+        res.write(': keepalive\n\n');
+      } catch {
+        log.debug('relay: keepalive write failed');
+      }
+      arm();
+    }, keepaliveMs());
+    timer.unref?.();
+  };
+  arm();
+  return {
+    touch: (): void => {
+      if (timer) clearTimeout(timer);
+      arm();
+    },
+    stop: (): void => {
+      if (timer) clearTimeout(timer);
+    },
+  };
+}
+
+async function pumpBody(
+  res: ServerResponse,
+  body: ReadableStream<Uint8Array>,
+  touch: () => void,
+): Promise<void> {
+  const reader = body.getReader();
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) return;
+    touch();
+    const ok = res.write(value);
+    if (!ok)
+      await new Promise((resolve) => {
+        res.once('drain', resolve);
+      });
+  }
+}
+
+async function pipe(res: ServerResponse, upstream: Response): Promise<void> {
+  const headers: Record<string, string> = {};
+  for (const name of PASS_RES) {
+    const value = upstream.headers.get(name);
+    if (value !== null) headers[name] = value;
+  }
+  const sse = (headers['content-type'] ?? '').includes('text/event-stream');
+  if (sse) headers['x-accel-buffering'] = 'no';
+  res.writeHead(upstream.status, headers);
+  if (upstream.body === null) {
+    res.end();
+    return;
+  }
+  const keepalive = sse ? startKeepalive(res) : null;
+  try {
+    await pumpBody(res, upstream.body, () => keepalive?.touch());
+  } finally {
+    keepalive?.stop();
+  }
+  res.end();
+}
+
+const authFailed = (status: number): boolean =>
+  status === 401 || status === 403;
+
+type Exchanged =
+  | { kind: 'response'; upstream: Response }
+  | { kind: 'missing' }
+  | { kind: 'signin' };
+
+async function exchange(
+  req: IncomingMessage,
+  collectionId: string,
+  connectorId: string,
+  deps: RelayApiDeps,
+  body: Uint8Array<ArrayBuffer> | null,
+  signal: AbortSignal,
+): Promise<Exchanged> {
+  const target = await deps.target(collectionId, connectorId, false);
+  if (target.kind !== 'ok') return { kind: target.kind };
+  let upstream = await forward(req, target, body, signal);
+  if (!authFailed(upstream.status)) return { kind: 'response', upstream };
+  await upstream.body?.cancel();
+  const fresh = await deps.target(collectionId, connectorId, true);
+  if (fresh.kind !== 'ok') return { kind: 'signin' };
+  upstream = await forward(req, fresh, body, signal);
+  if (!authFailed(upstream.status)) return { kind: 'response', upstream };
+  await upstream.body?.cancel();
+  return { kind: 'signin' };
+}
+
+async function relayExchange(
+  req: IncomingMessage,
+  res: ServerResponse,
+  collectionId: string,
+  connectorId: string,
+  deps: RelayApiDeps,
+): Promise<void> {
+  const control = new AbortController();
+  const bail = (): void => {
+    if (!res.writableEnded) control.abort();
+  };
+  res.once('close', bail);
+  res.socket?.once('close', bail);
+  res.once('finish', () => {
+    res.socket?.removeListener('close', bail);
+  });
+  const body = req.method === 'POST' ? await readCapped(req) : null;
+  const out = await exchange(
+    req,
+    collectionId,
+    connectorId,
+    deps,
+    body,
+    control.signal,
+  );
+  if (out.kind === 'missing') {
+    answer(res, 404, { error: 'no such connector' });
+    return;
+  }
+  if (out.kind === 'signin') {
+    signinAnswer(res, connectorId);
+    return;
+  }
+  if (out.upstream.status >= 300 && out.upstream.status < 400) {
+    await out.upstream.body?.cancel();
+    answer(res, 502, { error: 'the connector redirected; metro does not follow' });
+    return;
+  }
+  await pipe(res, out.upstream);
+}
+
+function dispatch(
+  req: IncomingMessage,
+  res: ServerResponse,
+  connectorId: string,
+  deps: RelayApiDeps,
+): void {
+  const who = cliIdentity(req);
+  if (who === null) {
+    answer(res, 401, { error: 'unauthorized' });
+    return;
+  }
+  relayExchange(req, res, who.collectionId, connectorId, deps).catch(
+    (err: unknown) => {
+      if (err instanceof ApiError) {
+        answer(res, err.status, { error: err.message });
+      } else {
+        log.warn({ err: errMsg(err), connector: connectorId }, 'relay: failed');
+        answer(res, 502, { error: 'metro could not reach the connector' });
+        if (!res.writableEnded) res.end();
+      }
+      closeIfBodyUnread(req, res);
+    },
+  );
+}
+
+export function handleRelayRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: RelayApiDeps,
+): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== '/relay' && !path.startsWith('/relay/')) return false;
+  const match = ID_PATH_RE.exec(path);
+  if (match?.[1] === undefined) {
+    answer(res, 404, { error: 'no such connector' });
+    return true;
+  }
+  if (!METHODS.has(req.method ?? '')) {
+    answer(res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  dispatch(req, res, match[1], deps);
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/run-api.ts

@@ -51,11 +51,16 @@ async function handleClaim(
     return;
   }
   const body = await readJsonBody(req);
-  const code = bodyField(body, 'code');
-  const taken =
-    typeof code === 'string' && RUN_CODE_RE.test(code)
-      ? takeRunCode(code)
-      : undefined;
+  const raw = bodyField(body, 'code');
+  const code = typeof raw === 'string' ? raw.trim() : '';
+  if (!RUN_CODE_RE.test(code)) {
+    sendJson(req, res, 400, {
+      error:
+        'that does not look like a runtime code — metro start wants the mr_… code from the agent page',
+    });
+    return;
+  }
+  const taken = takeRunCode(code);
   if (taken === undefined) {
     sendJson(req, res, 400, {
       error: 'that code has expired or was already used',

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-apis.ts

@@ -8,6 +8,7 @@ import {
 import { handleCollectionApiRequest } from './collection-api.js';
 import { handleCliPairRequest } from './cli-pair-api.js';
 import { handleRunApiRequest, type RunApiDeps } from './run-api.js';
+import type { RelayApiDeps } from './relay.js';
 import {
   handleProjectApiRequest,
   type ProjectApiDeps,
@@ -18,6 +19,7 @@ export interface SessionApis {
   connectorApi?: ConnectorApiDeps;
   projectApi?: ProjectApiDeps;
   runApi?: RunApiDeps;
+  relayApi?: RelayApiDeps;
 }
 
 export function handleSessionApis(

package/runtime/node_modules/@metro-labs/mcp/src/db/connector-relay.ts

@@ -0,0 +1,126 @@
+import { and, eq } from 'drizzle-orm';
+import { oauthExpired, refreshOAuth } from '../daemon/connector-oauth.js';
+import {
+  parseConnectorUrl,
+  type ConnectorAuth,
+  type OAuthAuth,
+} from '../daemon/connector-verify.js';
+import { errMsg, log } from '../daemon/log.js';
+import { readConfig, type ConnectorConfig } from './connector-config.js';
+import { getDb } from './client.js';
+import { collectionItems, connectors } from './schema.js';
+
+export type RelayTarget =
+  | { kind: 'ok'; url: string; headers: Record<string, string> }
+  | { kind: 'missing' }
+  | { kind: 'signin' };
+
+type ConnectorRow = typeof connectors.$inferSelect;
+
+export const bearerHeaders = (token: string): Record<string, string> => ({
+  Authorization: `Bearer ${token}`,
+});
+
+export function staleUsable(auth: OAuthAuth, now = Date.now()): boolean {
+  return auth.expiresAt === undefined || auth.expiresAt > now;
+}
+
+export function headerAuthHeaders(
+  auth: ConnectorAuth,
+): Record<string, string> | null {
+  return auth.kind === 'header' ? { [auth.name]: auth.value } : null;
+}
+
+async function memberRow(
+  collectionId: string,
+  connectorId: string,
+): Promise<ConnectorRow | undefined> {
+  const rows = await getDb()
+    .select({ connector: connectors })
+    .from(collectionItems)
+    .innerJoin(connectors, eq(collectionItems.connectorId, connectors.id))
+    .where(
+      and(
+        eq(collectionItems.collectionId, collectionId),
+        eq(collectionItems.connectorId, connectorId),
+      ),
+    );
+  return rows[0]?.connector;
+}
+
+const inflight = new Map<string, Promise<OAuthAuth>>();
+
+function refreshOnce(
+  row: ConnectorRow,
+  config: ConnectorConfig,
+  auth: OAuthAuth,
+): Promise<OAuthAuth> {
+  const running = inflight.get(row.id);
+  if (running !== undefined) return running;
+  const resource = parseConnectorUrl(row.url).toString();
+  const job = refreshOAuth(auth, resource)
+    .then(async (fresh) => {
+      await getDb()
+        .update(connectors)
+        .set({ config: { ...config, auth: fresh } })
+        .where(eq(connectors.id, row.id));
+      return fresh;
+    })
+    .finally(() => {
+      inflight.delete(row.id);
+    });
+  inflight.set(row.id, job);
+  return job;
+}
+
+export function unrefreshedTarget(
+  url: string,
+  auth: OAuthAuth,
+  force: boolean,
+  now = Date.now(),
+): RelayTarget {
+  if (force) return { kind: 'signin' };
+  if (staleUsable(auth, now))
+    return { kind: 'ok', url, headers: bearerHeaders(auth.accessToken) };
+  return { kind: 'ok', url, headers: {} };
+}
+
+async function oauthTarget(
+  row: ConnectorRow,
+  config: ConnectorConfig,
+  auth: OAuthAuth,
+  force: boolean,
+): Promise<RelayTarget> {
+  if (!force && !oauthExpired(auth))
+    return { kind: 'ok', url: row.url, headers: bearerHeaders(auth.accessToken) };
+  try {
+    const fresh = await refreshOnce(row, config, auth);
+    return { kind: 'ok', url: row.url, headers: bearerHeaders(fresh.accessToken) };
+  } catch (err) {
+    log.warn({ id: row.id, err: errMsg(err) }, 'relay: token refresh failed');
+    return unrefreshedTarget(row.url, auth, force);
+  }
+}
+
+export function fixedTarget(
+  url: string,
+  auth: Exclude<ConnectorAuth, OAuthAuth>,
+  force: boolean,
+): RelayTarget {
+  if (force) return { kind: 'signin' };
+  return { kind: 'ok', url, headers: headerAuthHeaders(auth) ?? {} };
+}
+
+export async function relayTarget(
+  collectionId: string,
+  connectorId: string,
+  force: boolean,
+): Promise<RelayTarget> {
+  const row = await memberRow(collectionId, connectorId);
+  if (row === undefined) return { kind: 'missing' };
+  parseConnectorUrl(row.url);
+  const config = readConfig(row.config);
+  const auth = config.auth;
+  if (auth.kind === 'oauth') return oauthTarget(row, config, auth, force);
+  return fixedTarget(row.url, auth, force);
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/connectors.ts

@@ -22,7 +22,6 @@ import {
   type ConnectorConfig,
   type ConnectorSignIn,
 } from './connector-config.js';
-import { errMsg, log } from '../daemon/log.js';
 import { newId } from './ids.js';
 import { getDb } from './client.js';
 import { connectors, type ConnectorTransport } from './schema.js';
@@ -131,15 +130,6 @@ export async function listConnectorsForEmail(
   return (await connectorRowsFor(email, project)).map(toConnector);
 }
 
-async function withFreshToken(row: ConnectorRow): Promise<Connector> {
-  const config = readConfig(row.config);
-  if (config.auth.kind !== 'oauth' || !oauthExpired(config.auth))
-    return toConnector(row);
-  const url = parseConnectorUrl(row.url);
-  const auth = await refreshOAuth(config.auth, url.toString());
-  return saveConfig(row, { ...config, auth });
-}
-
 async function rowsByIds(ids: string[]): Promise<ConnectorRow[]> {
   if (ids.length === 0) return [];
   return getDb()
@@ -149,21 +139,10 @@ async function rowsByIds(ids: string[]): Promise<ConnectorRow[]> {
     .orderBy(asc(connectors.id));
 }
 
-export async function listFreshConnectorsByIds(
+export async function connectorNamesByIds(
   ids: string[],
-): Promise<Connector[]> {
-  const rows = await rowsByIds(ids);
-  return Promise.all(
-    rows.map(async (row) =>
-      withFreshToken(row).catch((err: unknown) => {
-        log.warn(
-          { id: row.id, err: errMsg(err) },
-          'connectors: could not refresh the access token',
-        );
-        return toConnector(row);
-      }),
-    ),
-  );
+): Promise<{ id: string; name: string }[]> {
+  return (await rowsByIds(ids)).map((row) => ({ id: row.id, name: row.name }));
 }
 
 export async function getConnectorForEmail(

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.25"
+  "version": "0.1.0-beta.27"
 }