@stage-labs/metro 0.1.0-beta.26 → 0.1.0-beta.27

package/dist/prompt.js

@@ -35,7 +35,7 @@ export function askSecret(question) {
     stdin.resume();
     stdin.setEncoding('utf8');
     return new Promise((resolve, reject) => {
-        let value = '\u0003';
+        let value = '';
         const finish = () => {
             stdin.setRawMode(false);
             stdin.pause();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.26",
+  "version": "0.1.0-beta.27",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/cli-pair-api.ts

@@ -40,11 +40,16 @@ async function handleClaim(
     sendJson(req, res, 503, { error: 'sign-in is not configured' });
     return;
   }
-  const code = bodyField(await readJsonBody(req), 'code');
-  const taken =
-    typeof code === 'string' && CLI_CODE_RE.test(code)
-      ? takeCliCode(code)
-      : undefined;
+  const raw = bodyField(await readJsonBody(req), 'code');
+  const code = typeof raw === 'string' ? raw.trim() : '';
+  if (!CLI_CODE_RE.test(code)) {
+    sendJson(req, res, 400, {
+      error:
+        'that does not look like a collection code — metro login wants the mc_… code from metro.box/#/authorize',
+    });
+    return;
+  }
+  const taken = takeCliCode(code);
   if (taken === undefined) {
     sendJson(req, res, 400, {
       error: 'that code has expired or was already used',

package/runtime/node_modules/@metro-labs/mcp/src/daemon/run-api.ts

@@ -51,11 +51,16 @@ async function handleClaim(
     return;
   }
   const body = await readJsonBody(req);
-  const code = bodyField(body, 'code');
-  const taken =
-    typeof code === 'string' && RUN_CODE_RE.test(code)
-      ? takeRunCode(code)
-      : undefined;
+  const raw = bodyField(body, 'code');
+  const code = typeof raw === 'string' ? raw.trim() : '';
+  if (!RUN_CODE_RE.test(code)) {
+    sendJson(req, res, 400, {
+      error:
+        'that does not look like a runtime code — metro start wants the mr_… code from the agent page',
+    });
+    return;
+  }
+  const taken = takeRunCode(code);
   if (taken === undefined) {
     sendJson(req, res, 400, {
       error: 'that code has expired or was already used',

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.26"
+  "version": "0.1.0-beta.27"
 }