@stage-labs/metro 0.1.0-beta.31 → 0.1.0-beta.33

package/runtime/node_modules/@metro-labs/mcp/src/daemon/boot.ts

@@ -4,15 +4,27 @@ import { type Server } from 'node:http';
 import { selfLine, userSelf } from './events.js';
 import { setTrainCallBackend } from './train-call.js';
 import { errMsg, log, logFatalSync } from './log.js';
-import { acquireLock, loadMetroEnv, STATE_DIR } from './paths.js';
+import {
+  acquireLock,
+  isLocalMode,
+  loadMetroEnv,
+  STATE_DIR,
+  trainsDir,
+} from './paths.js';
 import { installCrashGuard, markDaemonReady } from './crash-guard.js';
 import {
   loadTunnelConfig,
   Tunnel,
+  tunnelConfigFromEnv,
   warnOnLegacyWebhooks,
   webhookPort,
 } from './tunnel.js';
-import { TrainSupervisor, TRAINS_DIR } from './supervisor.js';
+import {
+  localConnectHint,
+  publicConnectHint,
+  tunnelPendingHint,
+} from './connect-hint.js';
+import { TrainSupervisor } from './supervisor.js';
 import {
   makeEmit,
   startWebhookServer,
@@ -27,10 +39,15 @@ import {
 } from '../db/runtimes.js';
 import {
   blockedStationsFor,
-  mintAgentCodeForEmail,
-  releaseRuntimeForEmail,
+  mintAgentCodeForUser,
+  releaseRuntimeForUser,
 } from '../db/runtime-admin.js';
 import { loadAgentForRuntime, localAgentKey } from '../db/materialize.js';
+import { fileSource } from '../db/file-source.js';
+import { ensureLocalSessionSecret } from './local-secret.js';
+import { localSessionApis } from './local-mode.js';
+import type { ModeInfo } from './mode-api.js';
+import type { SessionApis } from './session-apis.js';
 import {
   agentLiveness,
   closeAgentSession,
@@ -48,45 +65,46 @@ import {
   materializeFromDb,
   reloadAccountsFromDb,
   reloadFrom,
+  type ReloadedStations,
 } from '../db/materialize.js';
 import {
   httpSource,
   runtimeConfigFromEnv,
   startRuntimePoller,
 } from './runtime-source.js';
-import {  createAgentForEmail,  deleteAgentForEmail,  listAgentsForEmail,  ownedAgentOrThrow,  resetAgentKeyForEmail,    type ResetAgentKey,} from '../db/agent-admin.js';
+import {  createAgentForUser,  deleteAgentForUser,  listAgentsForUser,  ownedAgentOrThrow,  resetAgentKeyForUser,    type ResetAgentKey,} from '../db/agent-admin.js';
 import {
   attachAccountToAgent,
   detachAccountFromAgent,
 } from '../db/account-attach.js';
 import {
-  createConnectorForEmail,
-  createPendingConnectorForEmail,
-  deleteConnectorForEmail,
-  disconnectConnectorForEmail,
+  createConnectorForUser,
+  createPendingConnectorForUser,
+  deleteConnectorForUser,
+  disconnectConnectorForUser,
   connectorNamesByIds,
-  getConnectorForEmail,
-  listConnectorsForEmail,
-  renameConnectorForEmail,
-  reconnectConnectorForEmail,
-  verifyConnectorForEmail,
+  getConnectorForUser,
+  listConnectorsForUser,
+  renameConnectorForUser,
+  reconnectConnectorForUser,
+  verifyConnectorForUser,
 } from '../db/connectors.js';
 import { relayTarget } from '../db/connector-relay.js';
 import {
-  addMemberForEmail,
-  createProjectForEmail,
-  deleteProjectForEmail,
-  listMembersForEmail,
-  listProjectsForEmail,
-  removeMemberForEmail,
-  renameProjectForEmail,
-  setMemberRoleForEmail,
+  addMemberForUser,
+  createProjectForUser,
+  deleteProjectForUser,
+  listMembersForUser,
+  listProjectsForUser,
+  removeMemberForUser,
+  renameProjectForUser,
+  setMemberRoleForUser,
 } from '../db/projects.js';
 import {
-  addConnectorToAgentForEmail,
-  agentConnectorsForEmail,
+  addConnectorToAgentForUser,
+  agentConnectorsForUser,
   connectorIdsByAgent,
-  removeConnectorFromAgentForEmail,
+  removeConnectorFromAgentForUser,
 } from '../db/agent-connectors.js';
 import type { AgentConnectorApiDeps } from './agent-connector-api.js';
 import type { StationName } from '../db/schema.js';
@@ -116,20 +134,30 @@ supervisor.onTrainEvent((env, train) => {
 });
 
 let webhookServer: Server | null = null;
-const tunnelCfg = loadTunnelConfig();
-const tunnel = tunnelCfg ? new Tunnel(tunnelCfg, webhookPort()) : null;
+const tunnelCfg = loadTunnelConfig() ?? tunnelConfigFromEnv();
+const tunnel = tunnelCfg ? new Tunnel(tunnelCfg, webhookPort(), announcePublic) : null;
+
+function announcePublic(url: string): void {
+  process.stderr.write(`\n${publicConnectHint(url)}`);
+}
 
 setTrainCallBackend((train, action, args) =>
   supervisor.call(train, action, args),
 );
 
 const runtime = runtimeConfigFromEnv();
-const localSource = runtime === null ? null : httpSource(runtime);
+const linkedSource = runtime === null ? null : httpSource(runtime);
+const localSource = linkedSource ?? (isLocalMode() ? fileSource : null);
 
 function announceLocalEndpoint(): void {
+  if (isLocalMode())
+    process.stderr.write(
+      `\n${tunnel === null ? localConnectHint(webhookPort()) : tunnelPendingHint()}`,
+    );
   const key = localAgentKey();
   if (key === null) {
-    log.warn('this agent has no key — reset it in the web UI to connect an agent');
+    if (isLocalMode()) log.info('no agent on this machine yet');
+    else log.warn('this agent has no key — reset it in the web UI to connect an agent');
     return;
   }
   const url = `http://127.0.0.1:${String(webhookPort())}/mcp?token=${key}`;
@@ -153,8 +181,11 @@ async function stopLocalStations(): Promise<void> {
   for (const station of supervisor.running()) await supervisor.stopTrain(station);
 }
 
+const reloadStations = (): Promise<ReloadedStations> =>
+  localSource === null ? reloadAccountsFromDb() : reloadFrom(localSource);
+
 async function syncStations(station: StationName): Promise<void> {
-  const { removed } = await reloadAccountsFromDb();
+  const { removed } = await reloadStations();
   if (stationByName(station)?.hasTrain === false) return;
   if (removed.includes(station)) await supervisor.stopTrain(station);
   else supervisor.requestReload(station);
@@ -162,11 +193,11 @@ async function syncStations(station: StationName): Promise<void> {
 
 const attachSessions = new AttachSessions({
   authorize: async (owner) => {
-    await ownedAgentOrThrow(owner.email, owner.agentId);
+    await ownedAgentOrThrow(owner.subject, owner.agentId);
   },
   complete: async (owner, station, config) => {
     const ref = await attachAccountToAgent(
-      owner.email,
+      owner.subject,
       owner.agentId,
       station,
       config,
@@ -186,10 +217,10 @@ const attachSessions = new AttachSessions({
 });
 
 async function resetAgentKey(
-  email: string,
+  subject: string,
   id: string,
 ): Promise<ResetAgentKey> {
-  const reset = await resetAgentKeyForEmail(email, id);
+  const reset = await resetAgentKeyForUser(subject, id);
   const closed = await closeAgentSession(id);
   log.info(
     { agent: reset.name, id: reset.id, sessionClosed: closed },
@@ -200,14 +231,14 @@ async function resetAgentKey(
 
 const agentApi: AgentApiDeps = {
   attachSessions,
-  listAgents: listAgentsForEmail,
-  createAgent: createAgentForEmail,
-  deleteAgent: deleteAgentForEmail,
+  listAgents: listAgentsForUser,
+  createAgent: createAgentForUser,
+  deleteAgent: deleteAgentForUser,
   resetKey: resetAgentKey,
   gatherAccounts: gatherAccountsForAgents,
   capabilities: accountStationCapabilities,
   liveness: agentLiveness,
-  releaseRuntime: releaseRuntimeForEmail,
+  releaseRuntime: releaseRuntimeForUser,
   connectorIds: connectorIdsByAgent,
   runtimes: runtimeLabels,
   prepareAccount,
@@ -225,66 +256,86 @@ const runApi: RunApiDeps = {
 };
 
 const agentConnectorApi: AgentConnectorApiDeps = {
-  agentConnectors: agentConnectorsForEmail,
-  addConnector: addConnectorToAgentForEmail,
-  removeConnector: removeConnectorFromAgentForEmail,
-  mintCode: mintAgentCodeForEmail,
+  agentConnectors: agentConnectorsForUser,
+  addConnector: addConnectorToAgentForUser,
+  removeConnector: removeConnectorFromAgentForUser,
+  mintCode: mintAgentCodeForUser,
 };
 
 const projectApi: ProjectApiDeps = {
-  listProjects: listProjectsForEmail,
-  createProject: createProjectForEmail,
-  renameProject: renameProjectForEmail,
-  deleteProject: deleteProjectForEmail,
-  listMembers: listMembersForEmail,
-  addMember: addMemberForEmail,
-  setMemberRole: setMemberRoleForEmail,
-  removeMember: removeMemberForEmail,
+  listProjects: listProjectsForUser,
+  createProject: createProjectForUser,
+  renameProject: renameProjectForUser,
+  deleteProject: deleteProjectForUser,
+  listMembers: listMembersForUser,
+  addMember: addMemberForUser,
+  setMemberRole: setMemberRoleForUser,
+  removeMember: removeMemberForUser,
 };
 
 const connectorApi: ConnectorApiDeps = {
-  listConnectors: listConnectorsForEmail,
+  listConnectors: listConnectorsForUser,
   connectorNamesByIds,
-  agentConnectors: agentConnectorsForEmail,
+  agentConnectors: agentConnectorsForUser,
   fenceRuntime,
-  renameConnector: renameConnectorForEmail,
-  createConnector: createConnectorForEmail,
-  createPendingConnector: createPendingConnectorForEmail,
-  reconnectConnector: reconnectConnectorForEmail,
-  getConnector: getConnectorForEmail,
-  verifyConnector: verifyConnectorForEmail,
-  disconnectConnector: disconnectConnectorForEmail,
-  deleteConnector: deleteConnectorForEmail,
+  renameConnector: renameConnectorForUser,
+  createConnector: createConnectorForUser,
+  createPendingConnector: createPendingConnectorForUser,
+  reconnectConnector: reconnectConnectorForUser,
+  getConnector: getConnectorForUser,
+  verifyConnector: verifyConnectorForUser,
+  disconnectConnector: disconnectConnectorForUser,
+  deleteConnector: deleteConnectorForUser,
 };
 
+const hostedMode = (): ModeInfo => ({
+  mode: linkedSource === null ? 'hosted' : 'linked',
+  owner: null,
+  project: null,
+});
+
+function sessionApis(): SessionApis {
+  if (isLocalMode())
+    return localSessionApis({
+      syncStations,
+      closeAgentSession,
+      gatherAccounts: gatherAccountsForAgents,
+      capabilities: accountStationCapabilities,
+      liveness: agentLiveness,
+      prepareAccount,
+    });
+  return {
+    agentApi,
+    agentConnectorApi,
+    connectorApi,
+    projectApi,
+    runApi,
+    relayApi: { target: relayTarget, fence: fenceRuntime },
+    mode: hostedMode,
+  };
+}
+
 async function main(): Promise<void> {
+  if (isLocalMode()) ensureLocalSessionSecret();
   if (localSource === null) await materializeFromDb();
-  else await materializeFrom(localSource);
+  else await materializeFrom(localSource, { allowEmpty: linkedSource === null });
   warnOnLegacyWebhooks();
   supervisor.start();
   const metroMcp = await createMetroMcp();
   webhookServer = await startWebhookServer(
     emit,
-    {
-      agentApi,
-      agentConnectorApi,
-      connectorApi,
-      projectApi,
-      runApi,
-      relayApi: { target: relayTarget, fence: fenceRuntime },
-    },
+    sessionApis(),
     metroMcp.httpHandler,
     metroCall,
   );
   metroMcp.startInbound();
   startUploadReaper();
-  if (localSource !== null) {
+  if (linkedSource !== null)
     startRuntimePoller({ sync: syncLocal, stopAll: stopLocalStations });
-    announceLocalEndpoint();
-  }
+  if (localSource !== null) announceLocalEndpoint();
   tunnel?.start();
   log.info(
-    { tunnel: !!tunnel, trainsDir: TRAINS_DIR, mcp: '/' },
+    { tunnel: !!tunnel, trainsDir: trainsDir(), mcp: '/' },
     'dispatcher ready',
   );
   markDaemonReady();

package/runtime/node_modules/@metro-labs/mcp/src/daemon/cli-pair-api.ts

@@ -13,7 +13,7 @@ import { extractToken } from '../mcp/request-identity.js';
 import { publicBaseOrDefault } from './attach-serve.js';
 import { AGENT_CODE_RE, takeAgentCode } from './agent-pair.js';
 import { relayServersJson } from './connector-json.js';
-import { sessionTtlFromEnv } from './google-oauth.js';
+import { sessionTtlFromEnv } from './session-config.js';
 import { signAgentToken } from './session.js';
 import type { ConnectorApiDeps } from './connector-api.js';
 
@@ -58,14 +58,19 @@ async function handleClaim(
     });
     return;
   }
-  const agent = await deps.agentConnectors(taken.email, taken.agentId);
+  const agent = await deps.agentConnectors(taken.subject, taken.agentId);
   const token = signAgentToken(
-    { email: taken.email, agentId: agent.id },
+    { subject: taken.subject, agentId: agent.id },
     secret,
     { ttlSec: sessionTtlFromEnv() },
   );
-  log.info({ email: taken.email, agent: agent.id }, 'cli: code claimed');
-  sendJson(req, res, 200, { token, email: taken.email, agent: agent.name });
+  log.info({ subject: taken.subject, agent: agent.id }, 'cli: code claimed');
+  sendJson(req, res, 200, {
+    token,
+    email: taken.subject,
+    subject: taken.subject,
+    agent: agent.name,
+  });
 }
 
 async function handleRead(
@@ -80,9 +85,13 @@ async function handleRead(
     return;
   }
   await assertLease(who, deps.fenceRuntime);
-  const agent = await deps.agentConnectors(who.email, who.agentId);
+  const agent = await deps.agentConnectors(who.subject, who.agentId);
   if (path === SESSION_PATH) {
-    sendJson(req, res, 200, { email: who.email, agent: agent.name });
+    sendJson(req, res, 200, {
+      email: who.subject,
+      subject: who.subject,
+      agent: agent.name,
+    });
     return;
   }
   const entries = await deps.connectorNamesByIds(agent.connectorIds);

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connect-hint.ts

@@ -0,0 +1,33 @@
+import { hostname } from 'node:os';
+
+const uiBase = (): string => process.env.METRO_UI_URL ?? 'https://metro.box';
+
+export const connectLink = (base: string): string =>
+  `${uiBase()}/#/connect/${encodeURIComponent(base)}`;
+
+export function localConnectHint(port: number): string {
+  const here = `http://127.0.0.1:${String(port)}`;
+  const forward = `ssh -L ${String(port)}:127.0.0.1:${String(port)} ${hostname()}`;
+  return [
+    'Manage this machine from the web UI:',
+    '',
+    `  ${connectLink(here)}`,
+    '',
+    `From another computer, forward the port first:  ${forward}`,
+    '',
+  ].join('\n');
+}
+
+export function publicConnectHint(url: string): string {
+  return [
+    'Manage this machine from the web UI, from anywhere:',
+    '',
+    `  ${connectLink(url)}`,
+    '',
+    'Sign in right away: the first wallet to sign in owns this machine.',
+    '',
+  ].join('\n');
+}
+
+export const tunnelPendingHint = (): string =>
+  'Bringing up a public address through a Cloudflare quick tunnel…\n';

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-api.ts

@@ -35,23 +35,23 @@ const asText = (value: unknown): string =>
   typeof value === 'string' ? value : '';
 
 export interface ConnectorApiDeps extends OAuthRouteDeps {
-  listConnectors: (email: string, project: string) => Promise<Connector[]>;
+  listConnectors: (subject: string, project: string) => Promise<Connector[]>;
   connectorNamesByIds: (ids: string[]) => Promise<RelayServerEntry[]>;
-  agentConnectors: (email: string, agentId: string) => Promise<AgentConnectors>;
+  agentConnectors: (subject: string, agentId: string) => Promise<AgentConnectors>;
   fenceRuntime: Fence;
   createConnector: (
-    email: string,
+    subject: string,
     project: string,
     input: ConnectorInput,
   ) => Promise<Connector>;
-  verifyConnector: (email: string, id: string) => Promise<ConnectorCheck>;
-  disconnectConnector: (email: string, id: string) => Promise<Connector>;
+  verifyConnector: (subject: string, id: string) => Promise<ConnectorCheck>;
+  disconnectConnector: (subject: string, id: string) => Promise<Connector>;
   renameConnector: (
-    email: string,
+    subject: string,
     id: string,
     name: string,
   ) => Promise<Connector>;
-  deleteConnector: (email: string, id: string) => Promise<DeletedConnector>;
+  deleteConnector: (subject: string, id: string) => Promise<DeletedConnector>;
 }
 
 type Routable =
@@ -115,7 +115,7 @@ async function handleList(
     sendJson(req, res, 400, { error: 'a project is required' });
     return;
   }
-  const rows = await deps.listConnectors(session.email, project);
+  const rows = await deps.listConnectors(session.subject, project);
   sendJson(req, res, 200, {
     connectors: rows.map((row) => connectorPayload(row)),
   });
@@ -135,7 +135,7 @@ async function handleCreate(
   }
   const offered = asText(bodyField(body, 'value')).trim() !== '';
   try {
-    const created = await deps.createConnector(session.email, project, {
+    const created = await deps.createConnector(session.subject, project, {
       name: bodyField(body, 'name'),
       url: bodyField(body, 'url'),
       header: bodyField(body, 'header'),
@@ -161,7 +161,7 @@ async function handleVerify(
   session: ApiSession,
   id: string,
 ): Promise<void> {
-  const check = await deps.verifyConnector(session.email, id);
+  const check = await deps.verifyConnector(session.subject, id);
   log.info(
     { id: check.id, name: check.name, ok: check.ok },
     'connector-api: re-verified connector',
@@ -176,7 +176,7 @@ async function handleDisconnect(
   session: ApiSession,
   id: string,
 ): Promise<void> {
-  const row = await deps.disconnectConnector(session.email, id);
+  const row = await deps.disconnectConnector(session.subject, id);
   log.info(
     { id: row.id, name: row.name },
     'connector-api: signed the connector out',
@@ -191,7 +191,7 @@ async function handleDelete(
   session: ApiSession,
   id: string,
 ): Promise<void> {
-  const gone = await deps.deleteConnector(session.email, id);
+  const gone = await deps.deleteConnector(session.subject, id);
   log.info(
     { id: gone.id, name: gone.name },
     'connector-api: deleted connector',
@@ -210,7 +210,7 @@ async function handleConnector(
     await handleDelete(req, res, deps, session, id);
     return;
   }
-  const row = await deps.getConnector(session.email, id);
+  const row = await deps.getConnector(session.subject, id);
   sendJson(req, res, 200, connectorPayload(row, true));
 }
 
@@ -226,7 +226,7 @@ async function handleRename(
     sendJson(req, res, 400, { error: 'name is required' });
     return;
   }
-  const row = await deps.renameConnector(session.email, id, name);
+  const row = await deps.renameConnector(session.subject, id, name);
   log.info({ id: row.id, name: row.name }, 'connector-api: renamed connector');
   sendJson(req, res, 200, connectorPayload(row));
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-oauth-routes.ts

@@ -24,16 +24,16 @@ export function hostOf(url: string): string {
 
 export interface OAuthRouteDeps {
   createPendingConnector: (
-    email: string,
+    subject: string,
     project: string,
     input: { name: unknown; url: unknown },
   ) => Promise<Connector>;
   reconnectConnector: (
-    email: string,
+    subject: string,
     id: string,
     auth: OAuthAuth,
   ) => Promise<Connector>;
-  getConnector: (email: string, id: string) => Promise<Connector>;
+  getConnector: (subject: string, id: string) => Promise<Connector>;
 }
 
 export async function startOAuth(
@@ -46,12 +46,12 @@ export async function startOAuth(
   payload: (row: Connector) => Record<string, unknown>,
 ): Promise<void> {
   const url = parseConnectorUrl(bodyField(body, 'url'));
-  const row = await deps.createPendingConnector(session.email, project, {
+  const row = await deps.createPendingConnector(session.subject, project, {
     name: bodyField(body, 'name'),
     url: bodyField(body, 'url'),
   });
   const authorize = await beginOAuth({
-    email: session.email,
+    subject: session.subject,
     name: row.name,
     url,
     returnTo: asText(bodyField(body, 'returnTo')),
@@ -71,11 +71,11 @@ export async function handleConnect(
   session: ApiSession,
   id: string,
 ): Promise<void> {
-  const row = await deps.getConnector(session.email, id);
+  const row = await deps.getConnector(session.subject, id);
   const url = parseConnectorUrl(row.url);
   const body = await readJsonBody(req);
   const authorize = await beginOAuth({
-    email: session.email,
+    subject: session.subject,
     name: row.name,
     url,
     returnTo: asText(bodyField(body, 'returnTo')),
@@ -110,7 +110,7 @@ async function saveOAuth(
   entry: PendingAuth,
   auth: OAuthAuth,
 ): Promise<Connector> {
-  return deps.reconnectConnector(entry.email, entry.connectorId, auth);
+  return deps.reconnectConnector(entry.subject, entry.connectorId, auth);
 }
 
 async function settleCallback(

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-oauth.ts

@@ -4,7 +4,7 @@ import {
   type OAuthAuth,
   type OAuthTokens,
 } from './connector-verify.js';
-import { validateReturnTo } from './google-oauth.js';
+import { validateReturnTo } from './session-config.js';
 import {
   authorizeUrl,
   exchangeCode,
@@ -32,7 +32,7 @@ const resourceOf = (url: URL): string => url.toString();
 
 export interface BeginInput {
   connectorId: string;
-  email: string;
+  subject: string;
   name: string;
   url: URL;
   returnTo: string;
@@ -47,7 +47,7 @@ export async function beginOAuth(input: BeginInput): Promise<string> {
   const verifier = newVerifier();
   const resource = resourceOf(input.url);
   const state = startPending({
-    email: input.email,
+    subject: input.subject,
     name: input.name,
     url: input.url.toString(),
     resource,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/http.ts

@@ -27,7 +27,8 @@ import {
 } from './tunnel.js';
 import { attachmentEventUrl, handleAttachRequest } from './attach-serve.js';
 import { webhookEntry } from '@metro-labs/webhook';
-import { handleGoogleAuthRequest } from './google-oauth.js';
+import { handleSiweAuthRequest } from './siwe-routes.js';
+import { handleModeRequest } from './mode-api.js';
 import { handleUploadRequest } from './upload-api.js';
 import {
   handleMonitorRequest,
@@ -323,6 +324,15 @@ async function handleWebhookRoute(
   return true;
 }
 
+function handleSignInRoutes(
+  req: IncomingMessage,
+  res: ServerResponse,
+  apis: SessionApis,
+): boolean {
+  if (handleSiweAuthRequest(req, res, apis.siwe)) return true;
+  return apis.mode !== undefined && handleModeRequest(req, res, apis.mode);
+}
+
 async function handlePreMcpRoutes(
   req: IncomingMessage,
   res: ServerResponse,
@@ -331,7 +341,7 @@ async function handlePreMcpRoutes(
   monitorCall?: MonitorCall,
 ): Promise<boolean> {
   if (handleHealth(req, res)) return true;
-  if (await handleGoogleAuthRequest(req, res)) return true;
+  if (handleSignInRoutes(req, res, apis)) return true;
   if (handleSessionApis(req, res, apis)) return true;
   if (handleUploadRequest(req, res)) return true;
   if (handleAttachRequest(req, res)) return true;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/identity.ts

@@ -71,9 +71,16 @@ export function daemonSelf(): Line {
 }
 
 export function selfLine(): Line | null {
-  if (process.env.CLAUDECODE) {
-    const s = claudeSessionId();
-    return s ? Line.claude(claudeUserId(), s) : null;
+  if (!process.env.CLAUDECODE) return null;
+  const s = claudeSessionId();
+  if (!s) return null;
+  try {
+    return Line.claude(claudeUserId(), s);
+  } catch (e) {
+    log.warn(
+      { reason: errMsg(e) },
+      'could not resolve a Claude account id; relaying with no self line',
+    );
+    return null;
   }
-  return null;
 }