@stage-labs/metro 0.1.0-beta.252 → 0.1.0-beta.254

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.252",
+  "version": "0.1.0-beta.254",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {
@@ -30,7 +30,7 @@
     "test": "tsc --noEmit && node scripts/stage-runtime.mjs && bun test test/"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.252",
+  "version": "0.1.0-beta.254",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/core/package.json

@@ -42,7 +42,7 @@
     "pino-pretty": "^13.1.3"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/node_modules/@metro-labs/daemon/package.json

@@ -41,7 +41,7 @@
     "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "@types/ws": "^8.18.0",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",

package/runtime/node_modules/@metro-labs/daemon/src/claude/api.ts

@@ -19,7 +19,9 @@ import {
   endClaudeLogin,
   startClaudeLogin,
   type LoginDeps,
+  type LoginTarget,
 } from './login.js';
+import { claudeLoginTarget, type ClaudeLoginDeps } from '../gateway/claude-logins.js';
 import {
   claudeSetupStatus,
   ensureClaudeSetup,
@@ -71,6 +73,7 @@ const PAGE_MAX = 500;
 export interface ClaudeApiDeps {
   dir?: () => string;
   login?: LoginDeps;
+  claudeLogins?: ClaudeLoginDeps;
   session?: SessionDeps;
   setup?: SetupDeps;
   version?: VersionDeps;
@@ -265,10 +268,15 @@ async function sessionAnswer(req: IncomingMessage, deps: ClaudeApiDeps): Promise
   return sessionCommand(body, session);
 }
 
+function loginTarget(req: IncomingMessage, deps: ClaudeApiDeps): LoginTarget | null {
+  const asked = new URL(req.url ?? '', 'http://metro').searchParams.get('connection');
+  return asked === null ? null : claudeLoginTarget(asked, deps.claudeLogins);
+}
+
 async function loginAnswer(req: IncomingMessage, id: string, deps: ClaudeApiDeps): Promise<unknown> {
   const method = req.method ?? 'GET';
   if (id === '') {
-    if (method === 'POST') return startClaudeLogin(deps.login);
+    if (method === 'POST') return startClaudeLogin(deps.login, Date.now(), loginTarget(req, deps));
     if (method === 'GET') return { available: claudeInstalled(), ...claudeAccount() };
     throw new ApiError('method not allowed', 405);
   }

package/runtime/node_modules/@metro-labs/daemon/src/claude/login.ts

@@ -26,12 +26,19 @@ export interface LoginView {
   error: string | null;
 }
 
+export interface LoginTarget {
+  key: string;
+  env: Record<string, string>;
+  settle: (ok: boolean) => Promise<string | null>;
+}
+
 interface Live {
   id: string;
   startedAt: number;
   state: LoginState;
   output: string;
   error: string | null;
+  target: LoginTarget | null;
   write: (text: string) => void;
   kill: () => void;
 }
@@ -102,27 +109,32 @@ export function claudeInstalled(): boolean {
   });
 }
 
-interface ClaudeAccount {
+export interface ClaudeAccount {
   signedIn: boolean;
   account: string | null;
+  plan: string | null;
 }
 
+const SIGNED_OUT: ClaudeAccount = { signedIn: false, account: null, plan: null };
+
 export function claudeAccount(): ClaudeAccount {
-  return remembered(checks.account, readAccount, (c) => {
+  return remembered(checks.account, () => claudeAccountIn({}), (c) => {
     checks.account = c;
   });
 }
 
-function readAccount(): ClaudeAccount {
-  const run = spawnSync(...asAgent(claudeBin(), STATUS_COMMAND), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
-  if (run.error !== undefined || typeof run.stdout !== 'string') return { signedIn: false, account: null };
+const textOf = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+export function claudeAccountIn(env: Record<string, string>): ClaudeAccount {
+  const run = spawnSync(...asAgent(claudeBin(), STATUS_COMMAND, env), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: { ...process.env, ...env } });
+  if (run.error !== undefined || typeof run.stdout !== 'string') return SIGNED_OUT;
   try {
     const parsed: unknown = JSON.parse(run.stdout);
-    if (!isRecord(parsed)) return { signedIn: false, account: null };
-    const account = typeof parsed.email === 'string' ? parsed.email : typeof parsed.organization === 'string' ? parsed.organization : null;
-    return { signedIn: parsed.authenticated === true || parsed.loggedIn === true || account !== null, account };
+    if (!isRecord(parsed)) return SIGNED_OUT;
+    const account = textOf(parsed.email) ?? textOf(parsed.organization) ?? textOf(parsed.orgName);
+    return { signedIn: parsed.authenticated === true || parsed.loggedIn === true || account !== null, account, plan: textOf(parsed.subscriptionType) };
   } catch {
-    return { signedIn: false, account: null };
+    return SIGNED_OUT;
   }
 }
 
@@ -131,16 +143,37 @@ function note(session: Live, chunk: string): void {
   session.output = next.length > OUTPUT_MAX ? next.slice(next.length - OUTPUT_MAX) : next;
 }
 
-export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now()): LoginView {
+async function verdict(session: Live, code: number): Promise<string | null> {
+  const problem = code === 0 ? null : `the login ended with status ${String(code)}`;
+  if (session.target === null) return problem;
+  try {
+    return (await session.target.settle(problem === null)) ?? problem;
+  } catch (err) {
+    return errMsg(err);
+  }
+}
+
+function runningFor(target: LoginTarget | null): Live | null {
+  if (live === null || live.state !== 'pending') return null;
+  if (live.target?.key === target?.key) return live;
+  live.kill();
+  live = null;
+  return null;
+}
+
+export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now(), target: LoginTarget | null = null): LoginView {
   sweep(now);
-  if (live !== null && live.state === 'pending') return view(live);
-  const command = deps.command ?? agentCommand([claudeBin(), ...LOGIN_ARGS], { TERM: 'xterm-256color' });
+  const running = runningFor(target);
+  if (running !== null) return view(running);
+  const env = { TERM: 'xterm-256color', ...target?.env };
+  const command = deps.command ?? agentCommand([claudeBin(), ...LOGIN_ARGS], env);
   const session: Live = {
     id: randomBytes(9).toString('base64url'),
     startedAt: now,
     state: 'pending',
     output: '',
     error: null,
+    target,
     write: () => undefined,
     kill: () => undefined,
   };
@@ -151,7 +184,7 @@ export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now()): LoginV
       note(session, Buffer.from(chunk).toString('utf8'));
     },
   });
-  const proc = Bun.spawn(command, { terminal, env: { ...process.env, TERM: 'xterm-256color' } });
+  const proc = Bun.spawn(command, { terminal, env: { ...process.env, ...env } });
   session.write = (text: string) => {
     terminal.write(Buffer.from(`${text}\r`, 'utf8'));
   };
@@ -160,13 +193,14 @@ export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now()): LoginV
     terminal.close();
   };
   proc.exited
-    .then((code) => {
-      session.state = code === 0 ? 'done' : 'failed';
-      if (code !== 0) session.error = `the login ended with status ${String(code)}`;
+    .then(async (code) => {
+      session.write = () => undefined;
       terminal.close();
       forgetClaudeChecks();
-      const onboarding = code === 0 ? markOnboardingDone() : 'skipped';
-      log.info({ state: session.state, onboarding }, 'claude-login: the official login finished');
+      session.error = await verdict(session, code);
+      session.state = session.error === null ? 'done' : 'failed';
+      const onboarding = session.error === null ? markOnboardingDone() : 'skipped';
+      log.info({ state: session.state, onboarding, own: session.target !== null }, 'claude-login: the official login finished');
     })
     .catch((err: unknown) => {
       session.state = 'failed';

package/runtime/node_modules/@metro-labs/daemon/src/claude/usage-probe.ts

@@ -35,11 +35,12 @@ const LINE_MAX = 1024 * 1024;
 export interface UsageProbeDeps {
   command?: string[];
   timeoutMs?: number;
+  env?: Record<string, string>;
 }
 
-export function usageProbeCommand(): string[] | null {
+export function usageProbeCommand(env: Record<string, string> = {}): string[] | null {
   if (runningAsRoot() || (agentUserExpected() && agentUser() === null)) return null;
-  return agentCommand([claudeBin(), ...ARGS], PROBE_ENV);
+  return agentCommand([claudeBin(), ...ARGS], { ...PROBE_ENV, ...env });
 }
 
 function answerOf(line: string): Record<string, unknown> | null {
@@ -67,11 +68,11 @@ export function usageIn(output: string): unknown {
 }
 
 export function readClaudeUsage(deps: UsageProbeDeps = {}): Promise<unknown> {
-  const command = deps.command ?? usageProbeCommand();
+  const command = deps.command ?? usageProbeCommand(deps.env);
   if (command === null) return Promise.reject(new Error('Claude Code runs only as the agent user, and this box has none'));
   const [file = '', ...args] = command;
   return new Promise((resolve, reject) => {
-    const child = spawn(file, args, { cwd: '/', stdio: ['pipe', 'pipe', 'ignore'], env: { ...process.env, ...PROBE_ENV } });
+    const child = spawn(file, args, { cwd: '/', stdio: ['pipe', 'pipe', 'ignore'], env: { ...process.env, ...PROBE_ENV, ...deps.env } });
     let carry = '';
     let settled = false;
     let hardKill: ReturnType<typeof setTimeout> | undefined;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/claude-logins.ts

@@ -0,0 +1,168 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ID_RE, newId } from '@metro-labs/core/ids';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { readFileSync } from '../agent-user/agent-fs.js';
+import { removeHome } from '../agent-user/home-fs.js';
+import { claudeHome } from '../agent-user/user.js';
+import { claudeAccountIn, type ClaudeAccount, type LoginTarget } from '../claude/login.js';
+import { readClaudeUsage } from '../claude/usage-probe.js';
+import { currentOf, reach, refreshed, type TokenSource, type TokenState } from './subscription.js';
+import { forgetReported } from './usage.js';
+import { addConnection, connectionOf, readModelConfig, setClaudeLogin, writeModelConfig, type ModelConfig } from './model-config.js';
+
+const CREDENTIALS = '.credentials.json';
+const RENEW_MARGIN_MS = 60_000;
+const NEW = 'new';
+const MISSING = 'this Claude login is no longer on the box: sign in again on the Model page';
+
+export interface ClaudeLoginDeps {
+  root?: string;
+  probe?: (env: Record<string, string>) => Promise<unknown>;
+  account?: (env: Record<string, string>) => ClaudeAccount;
+  read?: () => ModelConfig;
+  write?: (cfg: ModelConfig) => void;
+}
+
+interface ClaudeTokens {
+  accessToken: string;
+  expiresAt: number | null;
+  savedAt: string;
+}
+
+const state: TokenState<ClaudeTokens> = new Map();
+const seen = new Map<string, ClaudeTokens>();
+
+const claudeLoginsRoot = (): string => join(claudeHome() ?? homedir(), '.metro', 'claude-logins');
+
+const rootOf = (deps: ClaudeLoginDeps): string => deps.root ?? claudeLoginsRoot();
+
+function claudeLoginEnv(login: string, deps: ClaudeLoginDeps = {}): Record<string, string> {
+  if (!ID_RE.test(login)) throw new Error('not a Claude login id');
+  return { CLAUDE_CONFIG_DIR: join(rootOf(deps), login) };
+}
+
+export const probeClaudeLogin = (login: string, deps: ClaudeLoginDeps = {}): Promise<unknown> =>
+  (deps.probe ?? ((env) => readClaudeUsage({ env })))(claudeLoginEnv(login, deps));
+
+const stale = (tokens: ClaudeTokens, margin = RENEW_MARGIN_MS): boolean => tokens.expiresAt !== null && tokens.expiresAt - margin <= Date.now();
+
+function onDisk(login: string, deps: ClaudeLoginDeps): ClaudeTokens | null {
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(join(claudeLoginEnv(login, deps).CLAUDE_CONFIG_DIR ?? '', CREDENTIALS), 'utf8'));
+  } catch {
+    return null;
+  }
+  const oauth = isRecord(raw) && isRecord(raw.claudeAiOauth) ? raw.claudeAiOauth : {};
+  const accessToken = typeof oauth.accessToken === 'string' ? oauth.accessToken : '';
+  const expiresAt = typeof oauth.expiresAt === 'number' && Number.isFinite(oauth.expiresAt) ? oauth.expiresAt : null;
+  return accessToken === '' ? null : { accessToken, expiresAt, savedAt: new Date(expiresAt ?? 0).toISOString() };
+}
+
+function remembered(login: string, tokens: ClaudeTokens | null): ClaudeTokens | null {
+  if (tokens === null) seen.delete(login);
+  else seen.set(login, tokens);
+  return tokens;
+}
+
+function known(login: string, deps: ClaudeLoginDeps): ClaudeTokens | null {
+  const kept = seen.get(login);
+  if (kept !== undefined && !stale(kept)) return kept;
+  const read = onDisk(login, deps);
+  return read === null && kept !== undefined ? kept : remembered(login, read);
+}
+
+function sourceFor(login: string, deps: ClaudeLoginDeps): TokenSource<ClaudeTokens> {
+  return {
+    label: 'Claude',
+    stale: (tokens) => stale(tokens),
+    refresh: async () => {
+      try {
+        await probeClaudeLogin(login, deps);
+      } catch (err) {
+        log.warn({ err: errMsg(err) }, 'claude-logins: Claude Code stumbled while renewing a login, so its folder is read as it is');
+      }
+      const fresh = onDisk(login, deps);
+      if (fresh === null || stale(fresh, 0)) throw new Error('Claude Code could not renew this login');
+      return fresh;
+    },
+    save: (id, tokens) => {
+      remembered(id, tokens);
+    },
+  };
+}
+
+function again(login: string, failed: ClaudeTokens, deps: ClaudeLoginDeps, source: TokenSource<ClaudeTokens>): Promise<ClaudeTokens> {
+  const disk = onDisk(login, deps);
+  if (disk !== null && disk.accessToken !== failed.accessToken && !stale(disk)) return Promise.resolve(remembered(login, disk) ?? disk);
+  return refreshed(state, login, failed, source);
+}
+
+export function withClaudeLogin(login: string, deps: ClaudeLoginDeps, send: (token: string) => Promise<Response>): Promise<Response> {
+  const source = sourceFor(login, deps);
+  return reach(
+    () => currentOf(state, login, known(login, deps), source, MISSING),
+    (failed) => again(login, failed, deps, source),
+    (tokens) => send(tokens.accessToken),
+  );
+}
+
+function dropClaudeLogin(login: string, deps: ClaudeLoginDeps): void {
+  seen.delete(login);
+  state.delete(login);
+  try {
+    removeHome(claudeLoginEnv(login, deps).CLAUDE_CONFIG_DIR ?? '', true);
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'claude-logins: could not remove a Claude login that is no longer used');
+  }
+}
+
+export function dropUnusedClaudeLogins(before: ModelConfig, after: ModelConfig, deps: ClaudeLoginDeps = {}): void {
+  const kept = new Set(after.connections.flatMap((c) => (c.claude === null ? [] : [c.claude.id])));
+  for (const c of before.connections) if (c.claude !== null && !kept.has(c.claude.id)) dropClaudeLogin(c.claude.id, deps);
+}
+
+function keep(login: string, connection: string | null, account: ClaudeAccount, deps: ClaudeLoginDeps): string | null {
+  const before = (deps.read ?? readModelConfig)();
+  const cfg = connection === null ? addConnection(before, { provider: 'anthropic' }) : before;
+  const id = connection ?? cfg.connections.at(-1)?.id ?? '';
+  if (connectionOf(cfg, id)?.provider !== 'anthropic') return 'that connection was removed during the sign-in';
+  const next = setClaudeLogin(cfg, id, { id: login, email: account.account, plan: account.plan, savedAt: new Date().toISOString() });
+  (deps.write ?? writeModelConfig)(next);
+  dropUnusedClaudeLogins(before, next, deps);
+  forgetReported(id);
+  log.info({ connection: id, plan: account.plan, added: connection === null }, 'claude-logins: the Claude login was kept for its own connection');
+  return null;
+}
+
+function settle(ok: boolean, login: string, connection: string | null, deps: ClaudeLoginDeps): Promise<string | null> {
+  if (!ok) {
+    dropClaudeLogin(login, deps);
+    return Promise.resolve(null);
+  }
+  let problem: string | null;
+  try {
+    const account = (deps.account ?? claudeAccountIn)(claudeLoginEnv(login, deps));
+    problem = account.signedIn ? keep(login, connection, account, deps) : 'the sign-in finished but Claude Code holds no login; try again';
+  } catch (err) {
+    problem = errMsg(err);
+  }
+  if (problem !== null) dropClaudeLogin(login, deps);
+  return Promise.resolve(problem);
+}
+
+export function claudeLoginTarget(asked: string, deps: ClaudeLoginDeps = {}): LoginTarget {
+  const connection = asked === NEW ? null : asked;
+  if (connection !== null && connectionOf((deps.read ?? readModelConfig)(), connection)?.provider !== 'anthropic')
+    throw new ApiError('no such Anthropic connection', 404);
+  const login = newId();
+  return { key: asked, env: claudeLoginEnv(login, deps), settle: (ok) => settle(ok, login, connection, deps) };
+}
+
+export function forgetClaudeTokens(): void {
+  seen.clear();
+  state.clear();
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/effort.ts

@@ -38,16 +38,26 @@ export function requestKind(req: IncomingMessage, body: Body): RequestKind {
   return chore(body) ? 'other' : 'main';
 }
 
+const messagesOf = (body: Body): unknown[] => (Array.isArray(body.messages) ? body.messages : []);
+
+const askedEfforts = (body: Body): string[] => [body, ...messagesOf(body).map(record)].map(effortOf).filter((effort) => effort !== '');
+
 export function plannedEffort(req: IncomingMessage, body: Body): string | null {
-  const current = effortOf(body);
-  if (current === '') return null;
+  const asked = askedEfforts(body);
+  if (asked.length === 0) return null;
   const kind = requestKind(req, body);
   if (kind === 'other') return null;
   const wanted = kind === 'subagent' ? SUBAGENT_EFFORT : MAIN_EFFORT;
-  return wanted === current ? null : wanted;
+  return asked.every((effort) => effort === wanted) ? null : wanted;
 }
 
-export const withEffort = (body: Body, effort: string): Body => ({ ...body, output_config: { ...record(body.output_config), effort } });
+const withOwnEffort = (item: Body, effort: string): Body => (effortOf(item) === '' ? item : { ...item, output_config: { ...record(item.output_config), effort } });
+
+export function withEffort(body: Body, effort: string): Body {
+  const top = withOwnEffort(body, effort);
+  if (!Array.isArray(body.messages)) return top;
+  return { ...top, messages: body.messages.map((message: unknown) => (isRecord(message) ? withOwnEffort(message, effort) : message)) };
+}
 
 export function withoutEffort(body: Body): Body {
   const config = Object.fromEntries(Object.entries(record(body.output_config)).filter(([key]) => key !== 'effort'));

package/runtime/node_modules/@metro-labs/daemon/src/gateway/forward.ts

@@ -128,6 +128,15 @@ export function anthropicHeaders(req: IncomingMessage, apiKey: string): Record<s
   return headers;
 }
 
+export const OAUTH_BETA = 'oauth-2025-04-20';
+
+export function loginHeaders(req: IncomingMessage, token: string): Record<string, string> {
+  const headers = forwardedHeaders(req);
+  delete headers['x-api-key'];
+  headers.authorization = `Bearer ${token}`;
+  return addBeta(headers, OAUTH_BETA);
+}
+
 export function addBeta(headers: Record<string, string>, beta: string): Record<string, string> {
   const listed = (headers['anthropic-beta'] ?? '')
     .split(',')

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -1,4 +1,4 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { IncomingHttpHeaders, IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from '@metro-labs/core/log';
 import { cameThroughProxy } from '@metro-labs/http/api-http';
 import { agentIdForKey } from '../agents/keys.js';
@@ -10,7 +10,20 @@ import {
   freshAdaptations,
   type Adaptations,
 } from './bedrock.js';
-import { addBeta, anthropicHeaders, forwardedHeaders, GatewayError, holdLimitRefusal, parseJson, pipeResponse, readBody, sendError, upstreamMessage, watchUpstream } from './forward.js';
+import {
+  addBeta,
+  anthropicHeaders,
+  forwardedHeaders,
+  GatewayError,
+  holdLimitRefusal,
+  loginHeaders,
+  parseJson,
+  pipeResponse,
+  readBody,
+  sendError,
+  upstreamMessage,
+  watchUpstream,
+} from './forward.js';
 import { chainOf, forgetFallbackState, noteChoice, noteRefused, routesToTry } from './fallback.js';
 import {
   BINDING_BETA,
@@ -38,6 +51,7 @@ import { forgetUsage, noteUsageHeaders, UsageScanner } from './usage.js';
 import { fitToolSearch } from './tool-search.js';
 import { ANTHROPIC_API, refreshLoginModels } from './provider-models.js';
 import type { CodexTokens } from './codex-auth.js';
+import { forgetClaudeTokens, withClaudeLogin, type ClaudeLoginDeps } from './claude-logins.js';
 
 const GATEWAY_PREFIX = '/gateway';
 const MESSAGES = '/v1/messages';
@@ -53,6 +67,7 @@ export interface GatewayDeps {
   openrouterBase?: string;
   codex?: Partial<CodexDeps>;
   gemini?: Partial<GeminiDeps>;
+  claudeLogins?: ClaudeLoginDeps;
 }
 
 const learned: Adaptations = freshAdaptations();
@@ -66,6 +81,7 @@ export function resetGatewayState(): void {
   forgetLearnedThinking();
   sharedCodexState.clear();
   sharedGeminiState.clear();
+  forgetClaudeTokens();
 }
 
 const saveCodexTokens = (id: string, tokens: CodexTokens): void => {
@@ -90,7 +106,18 @@ function modelsBody(cfg: ModelConfig): Record<string, unknown> {
   return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
 }
 
-const PASSTHROUGH: Connection = { id: PASSTHROUGH_ID, provider: 'anthropic', label: 'Claude Code login', model: '', apiKey: '', region: '', zdr: false, codex: null, gemini: null };
+const PASSTHROUGH: Connection = {
+  id: PASSTHROUGH_ID,
+  provider: 'anthropic',
+  label: 'Claude Code login',
+  model: '',
+  apiKey: '',
+  region: '',
+  zdr: false,
+  codex: null,
+  gemini: null,
+  claude: null,
+};
 
 const passthrough = (body: Record<string, unknown>): Route => ({ connection: PASSTHROUGH, model: requestedModel(body) });
 
@@ -139,12 +166,27 @@ async function refusedThinkingOff(upstream: Response, shaped: Record<string, unk
   return true;
 }
 
-function listLoginModels(req: IncomingMessage, anthropicBase: string): void {
-  refreshLoginModels(req.headers, anthropicBase).catch((err: unknown) => {
+function listLoginModels(headers: IncomingHttpHeaders, anthropicBase: string): void {
+  refreshLoginModels(headers, anthropicBase).catch((err: unknown) => {
     log.warn({ err: errMsg(err) }, 'gateway: could not list the models of the Claude Code login');
   });
 }
 
+function sendAnthropic(req: IncomingMessage, conn: Connection, anthropicBase: string, attempt: (base: Record<string, string>) => Promise<Response>, deps: GatewayDeps): Promise<Response> {
+  if (conn.apiKey !== '') return attempt(anthropicHeaders(req, conn.apiKey));
+  if (conn.claude === null) return attempt(forwardedHeaders(req));
+  return withClaudeLogin(conn.claude.id, deps.claudeLogins ?? {}, (token) => {
+    listLoginModels({ authorization: `Bearer ${token}` }, anthropicBase);
+    return attempt(loginHeaders(req, token));
+  });
+}
+
+async function refusedLogin(conn: Connection, upstream: Response): Promise<void> {
+  if (conn.apiKey !== '' || conn.claude === null || upstream.status !== 401) return;
+  await upstream.body?.cancel();
+  throw new GatewayError(403, 'permission_error', `Anthropic refused the Claude login of ${conn.label}: sign in again on the Model page`);
+}
+
 async function toAnthropic(
   req: IncomingMessage,
   res: ServerResponse,
@@ -157,25 +199,28 @@ async function toAnthropic(
   const conn = route.connection;
   const anthropicBase = deps.anthropicBase ?? ANTHROPIC_API;
   const url = `${anthropicBase}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
-  const key = conn.apiKey;
-  if (key === '' && standsInFor(req))
+  const passthrough = conn.apiKey === '' && conn.claude === null;
+  if (passthrough && standsInFor(req))
     throw new GatewayError(
       403,
       'permission_error',
       'Claude Code on this machine has no Anthropic login of its own; choose Bedrock, OpenRouter, Codex or Gemini on the Model page, or sign in on the Claude tab',
     );
   const watch = watchUpstream(res);
-  if (key === '') listLoginModels(req, anthropicBase);
-  const base = key === '' ? forwardedHeaders(req) : anthropicHeaders(req, key);
+  if (passthrough) listLoginModels(req.headers, anthropicBase);
   const send = (payload: Buffer, headers: Record<string, string>): Promise<Response> =>
     fetch(url, { method: 'POST', headers, body: new Uint8Array(payload), signal: watch.signal, redirect: 'manual' });
-  const attempt = (): Promise<Response> => asAnthropicWants(send, base, anthropicPayloads(raw, sent, shaped, route.model), conn.label, route.model);
-  const first = await attempt();
-  const upstream = (await refusedThinkingOff(first, shaped, route.model)) ? await attempt() : first;
+  const attempt = async (base: Record<string, string>): Promise<Response> => {
+    const shape = (): Promise<Response> => asAnthropicWants(send, base, anthropicPayloads(raw, sent, shaped, route.model), conn.label, route.model);
+    const first = await shape();
+    return (await refusedThinkingOff(first, shaped, route.model)) ? shape() : first;
+  };
+  const upstream = await sendAnthropic(req, conn, anthropicBase, attempt, deps);
+  await refusedLogin(conn, upstream);
   noteRefusal(conn.label, route.model, upstream);
   noteUsageHeaders('anthropic', conn.id, upstream.headers);
   const scanner = new UsageScanner(conn.id);
-  await pipeResponse(upstream, res, watch, key === '' ? { scanner } : { ownCredential: true, scanner });
+  await pipeResponse(upstream, res, watch, passthrough ? { scanner } : { ownCredential: true, scanner });
 }
 
 async function toOpenRouter(

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-api.ts

@@ -20,7 +20,8 @@ import {
   writeModelConfig,
   type ModelConfig,
 } from './model-config.js';
-import { asApiError, BODY_MAX, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
+import { asApiError, BODY_MAX, claudeLoginDeps, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
+import { dropUnusedClaudeLogins } from './claude-logins.js';
 import { CODEX_ROUTES, codexDeviceRoute, GEMINI_ROUTES } from './model-signin.js';
 import { refreshUsage } from './usage-refresh.js';
 
@@ -89,14 +90,17 @@ async function change(req: IncomingMessage, deps: ModelApiDeps, store: Store, id
 }
 
 function drop(deps: ModelApiDeps, store: Store, id: string): unknown {
+  const before = store.read();
   let next: ModelConfig;
   try {
-    next = removeConnection(store.read(), id);
+    next = removeConnection(before, id);
   } catch (err) {
     asApiError(err);
   }
   forgetOne(id);
-  return kept(store, next, deps, 'model-api: connection removed', { connection: id });
+  const body = kept(store, next, deps, 'model-api: connection removed', { connection: id });
+  dropUnusedClaudeLogins(before, next, claudeLoginDeps(deps));
+  return body;
 }
 
 async function settingsWithUsage(deps: ModelApiDeps, store: Store): Promise<Record<string, unknown>> {
@@ -132,7 +136,11 @@ const named = (table: Record<string, Route>, name: string, method: string | unde
 async function restore(req: IncomingMessage, store: Store, deps: ModelApiDeps): Promise<unknown> {
   const body = await readJsonBody(req, RESTORE_MAX);
   if (!isRecord(body)) throw new ApiError('body must be a JSON object', 400);
-  return kept(store, parseModelConfig(body), deps, 'model-api: model setup restored from a file', {});
+  const before = store.read();
+  const next = parseModelConfig(body);
+  const answer = kept(store, next, deps, 'model-api: model setup restored from a file', {});
+  dropUnusedClaudeLogins(before, next, claudeLoginDeps(deps));
+  return answer;
 }
 
 function bundleRoute(path: string, method: string | undefined): Route | number {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-config.ts

@@ -1,5 +1,5 @@
 import { join } from 'node:path';
-import { newId } from '@metro-labs/core/ids';
+import { ID_RE, newId } from '@metro-labs/core/ids';
 import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
 import { agentsDir } from '../agents/files.js';
 import { isRecord } from '@metro-labs/core/is-record';
@@ -9,6 +9,13 @@ import { tokensFromDisk as geminiTokensFromDisk, type GeminiTokens } from './gem
 export const PROVIDERS = ['anthropic', 'bedrock', 'openrouter', 'codex', 'gemini'] as const;
 export type Provider = (typeof PROVIDERS)[number];
 
+export interface ClaudeLogin {
+  id: string;
+  email: string | null;
+  plan: string | null;
+  savedAt: string;
+}
+
 export interface Connection {
   id: string;
   provider: Provider;
@@ -19,6 +26,7 @@ export interface Connection {
   zdr: boolean;
   codex: CodexTokens | null;
   gemini: GeminiTokens | null;
+  claude: ClaudeLogin | null;
 }
 
 export interface Fallback {
@@ -73,8 +81,14 @@ const newConnection = (provider: Provider, label: string): Connection => ({
   zdr: false,
   codex: null,
   gemini: null,
+  claude: null,
 });
 
+function claudeFromDisk(raw: unknown): ClaudeLogin | null {
+  if (!isRecord(raw) || !ID_RE.test(text(raw.id))) return null;
+  return { id: text(raw.id), email: maybe(raw.email), plan: maybe(raw.plan), savedAt: text(raw.savedAt) };
+}
+
 function codexFromDisk(raw: unknown): CodexTokens | null {
   if (!isRecord(raw)) return null;
   const accessToken = text(raw.accessToken);
@@ -106,6 +120,7 @@ function connectionFromDisk(raw: unknown): Connection | null {
     zdr: raw.zdr === true,
     codex: codexFromDisk(raw.codex),
     gemini: geminiTokensFromDisk(raw.gemini),
+    claude: provider === 'anthropic' ? claudeFromDisk(raw.claude) : null,
   };
 }
 
@@ -219,6 +234,7 @@ export const routeLabel = (route: Route): string =>
 export const PASSTHROUGH_ID = 'passthrough';
 
 function signedInAs(c: Connection): { account: string | null; plan: string | null } {
+  if (c.claude !== null) return { account: c.claude.email, plan: c.claude.plan };
   if (c.codex === null) return { account: c.gemini?.email ?? null, plan: c.gemini?.tier ?? null };
   const claims = claimsOf(c.codex.idToken);
   return { account: c.codex.email ?? claims.email, plan: c.codex.plan ?? claims.plan };
@@ -233,7 +249,7 @@ function publicConnection(c: Connection): Record<string, unknown> {
     hasKey: c.apiKey !== '',
     region: c.region,
     zdr: c.zdr,
-    signedIn: c.codex !== null || c.gemini !== null,
+    signedIn: c.codex !== null || c.gemini !== null || c.claude !== null,
     ...signedInAs(c),
   };
 }
@@ -254,6 +270,9 @@ export const setCodexAuth = (cfg: ModelConfig, id: string, auth: CodexTokens | n
 export const setGeminiAuth = (cfg: ModelConfig, id: string, auth: GeminiTokens | null): ModelConfig =>
   withConnection(cfg, id, (c) => ({ ...c, gemini: auth }));
 
+export const setClaudeLogin = (cfg: ModelConfig, id: string, login: ClaudeLogin | null): ModelConfig =>
+  withConnection(cfg, id, (c) => ({ ...c, claude: login }));
+
 function field(patch: Record<string, unknown>, key: string, current: string, what: string, max = MAX_FIELD): string {
   if (!(key in patch)) return current;
   const value = patch[key];

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-signin.ts

@@ -42,6 +42,8 @@ const saved = (store: Store, cfg: ModelConfig, note: string, fields: { connectio
 
 function keepCodex(store: Store, req: IncomingMessage, tokens: CodexTokens | null, note: string): unknown {
   const { cfg, id } = connectionToFill(store, req, 'codex');
+  const twin = cfg.connections.find((c) => c.id !== id && tokens !== null && c.codex?.refreshToken === tokens.refreshToken);
+  if (twin !== undefined) throw new ApiError(`this ChatGPT login is already connected as ${twin.label}; sign in with ChatGPT to add another one`, 409);
   const next = setCodexAuth(cfg, id, tokens);
   return saved(store, next, note, { connection: id, plan: tokens?.plan ?? null });
 }

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-store.ts

@@ -8,6 +8,7 @@ import { usageSeen } from './usage.js';
 import { chainStatus } from './fallback.js';
 import { ModelConfigError, connectionOf, publicModelConfig, routedConnection, type Connection, type ModelConfig, type Provider } from './model-config.js';
 import type { SetupDeps } from '../claude/setup.js';
+import type { ClaudeLoginDeps } from './claude-logins.js';
 
 export interface ModelApiDeps {
   read?: () => ModelConfig;
@@ -25,10 +26,13 @@ export interface ModelApiDeps {
   bedrockControlBase?: string;
   setup?: SetupDeps;
   restartSession?: () => boolean;
-  claudeUsage?: () => Promise<unknown>;
+  claudeUsage?: (env?: Record<string, string>) => Promise<unknown>;
+  claudeLoginsRoot?: string;
   usageWaitMs?: number;
 }
 
+export const claudeLoginDeps = (deps: ModelApiDeps): ClaudeLoginDeps => ({ root: deps.claudeLoginsRoot, probe: deps.claudeUsage });
+
 export interface Store {
   read: () => ModelConfig;
   write: (cfg: ModelConfig) => void;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/provider-models.ts

@@ -1,6 +1,6 @@
 import type { IncomingHttpHeaders } from 'node:http';
 import { isRecord } from '@metro-labs/core/is-record';
-import { GatewayError } from './forward.js';
+import { GatewayError, OAUTH_BETA } from './forward.js';
 import type { Connection } from './model-config.js';
 import { fingerprint, listCache } from './model-lists.js';
 import { stringOf } from '@metro-labs/http/api-http';
@@ -9,7 +9,6 @@ export const ANTHROPIC_API = 'https://api.anthropic.com';
 const ANTHROPIC_VERSION = '2023-06-01';
 const LIST_MAX = 1000;
 const LIST_TIMEOUT_MS = 10_000;
-const OAUTH_BETA = 'oauth-2025-04-20';
 const BEARER = 'Bearer ';
 
 export interface ProviderModel {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage-refresh.ts

@@ -6,7 +6,8 @@ import { lastServed } from './served.js';
 import { claudeLoginUsage, geminiUsage, keepProbeAnswer, mayProbe, mergeUsage, noteUsage, openrouterUsage, probeAnswer, usageOf } from './usage.js';
 import { PASSTHROUGH_ID, readModelConfig, routedConnection, writeModelConfig, type Connection, type ModelConfig } from './model-config.js';
 import { codexDepsFor, geminiModelsOf } from './model-signin.js';
-import { CREDITS_TTL_MS, type ModelApiDeps, type Store } from './model-store.js';
+import { claudeLoginDeps, CREDITS_TTL_MS, type ModelApiDeps, type Store } from './model-store.js';
+import { probeClaudeLogin } from './claude-logins.js';
 
 const WAIT_MS = 4_000;
 const LOGIN_PROBE = 'claude-login';
@@ -62,17 +63,26 @@ async function refreshQuota(conn: Connection, deps: ModelApiDeps, store: Store,
 
 const loginIds = (cfg: ModelConfig): string[] => [
   ...(routedConnection(cfg) === null ? [PASSTHROUGH_ID] : []),
-  ...cfg.connections.filter((c) => c.provider === 'anthropic' && c.apiKey === '').map((c) => c.id),
+  ...cfg.connections.filter((c) => c.provider === 'anthropic' && c.apiKey === '' && c.claude === null).map((c) => c.id),
 ];
 
 const hasFallbacks = (cfg: ModelConfig): boolean => (cfg.fallbacks ?? []).length > 0;
 
+async function refreshOwnLogin(conn: Connection, cfg: ModelConfig, deps: ModelApiDeps, now: number): Promise<void> {
+  const login = conn.apiKey === '' ? conn.claude : null;
+  if (login === null || (fresh(conn.id, now) && !hasFallbacks(cfg)) || !mayProbe(conn.id, now, CREDITS_TTL_MS)) return;
+  await probe('usage of a Claude login', async () => {
+    const usage = claudeLoginUsage(await probeClaudeLogin(login.id, claudeLoginDeps(deps)), new Date(now));
+    if (usage !== null) mergeUsage(conn.id, usage);
+  });
+}
+
 async function refreshLogin(cfg: ModelConfig, deps: ModelApiDeps, now: number): Promise<void> {
   const ids = loginIds(cfg);
   if (!ids.some((id) => !fresh(id, now)) && !(hasFallbacks(cfg) && ids.length > 0)) return;
   if (mayProbe(LOGIN_PROBE, now, CREDITS_TTL_MS))
     await probe('usage of the Claude Code login', async () => {
-      const usage = claudeLoginUsage(await (deps.claudeUsage ?? readClaudeUsage)(), new Date(now));
+      const usage = claudeLoginUsage(await (deps.claudeUsage ?? (() => readClaudeUsage()))(), new Date(now));
       if (usage !== null) keepProbeAnswer(LOGIN_PROBE, usage);
     });
   const usage = probeAnswer(LOGIN_PROBE);
@@ -80,10 +90,11 @@ async function refreshLogin(cfg: ModelConfig, deps: ModelApiDeps, now: number):
   for (const id of ids) mergeUsage(id, usage);
 }
 
-function refreshOne(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
+function refreshOne(conn: Connection, cfg: ModelConfig, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
   if (conn.provider === 'openrouter') return refreshKey(conn, deps, now);
   if (conn.provider === 'codex') return refreshCodex(conn, deps, store, now);
   if (conn.provider === 'gemini') return refreshQuota(conn, deps, store, now);
+  if (conn.provider === 'anthropic') return refreshOwnLogin(conn, cfg, deps, now);
   return Promise.resolve();
 }
 
@@ -98,7 +109,7 @@ async function within(ms: number, work: Promise<unknown>): Promise<void> {
 
 export async function refreshUsage(deps: ModelApiDeps, store: Store, now = Date.now()): Promise<void> {
   const cfg = store.read();
-  const work = Promise.all([...cfg.connections.map((conn) => refreshOne(conn, deps, store, now)), refreshLogin(cfg, deps, now)]);
+  const work = Promise.all([...cfg.connections.map((conn) => refreshOne(conn, cfg, deps, store, now)), refreshLogin(cfg, deps, now)]);
   await within(deps.usageWaitMs ?? WAIT_MS, work);
 }
 

package/runtime/node_modules/@metro-labs/discord-bot/package.json

@@ -17,7 +17,7 @@
     "discord.js": "^14.26.4"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/node_modules/@metro-labs/gmail/package.json

@@ -16,7 +16,7 @@
     "@metro-labs/core": "workspace:*"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/node_modules/@metro-labs/http/package.json

@@ -21,7 +21,7 @@
     "@metro-labs/core": "workspace:*"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/node_modules/@metro-labs/http/src/return-to.ts

@@ -6,6 +6,10 @@ export function allowedWebHost(host: string): boolean {
   return PREVIEW.test(host);
 }
 
+export const APP_RETURN = 'metro://auth';
+
+export const isAppReturn = (returnTo: string): boolean => returnTo === APP_RETURN;
+
 export function validateReturnTo(returnTo: string): boolean {
   let url: URL;
   try {

package/runtime/node_modules/@metro-labs/outlook/package.json

@@ -16,7 +16,7 @@
     "@metro-labs/core": "workspace:*"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/node_modules/@metro-labs/telegram/package.json

@@ -17,7 +17,7 @@
     "@mtcute/bun": "0.30.1"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/node_modules/@metro-labs/telegram-bot/package.json

@@ -16,7 +16,7 @@
     "@metro-labs/core": "workspace:*"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/node_modules/@metro-labs/threema/package.json

@@ -17,7 +17,7 @@
     "tweetnacl": "^1.0.3"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/node_modules/@metro-labs/webhook/package.json

@@ -14,7 +14,7 @@
     "@metro-labs/core": "workspace:*"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/node_modules/@metro-labs/whatsapp/package.json

@@ -17,7 +17,7 @@
     "baileys": "7.0.0-rc14"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/node_modules/@metro-labs/xmtp/package.json

@@ -25,7 +25,7 @@
     "viem": "^2.52.2"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.252"
+  "version": "0.1.0-beta.254"
 }