@stage-labs/metro 0.1.0-beta.35 → 0.1.0-beta.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.35",
+  "version": "0.1.0-beta.37",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/agent-api.ts

@@ -1,3 +1,4 @@
+import { webhookPort } from './tunnel.js';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from './log.js';
 import { publicBaseOrDefault } from './attach-serve.js';
@@ -89,10 +90,10 @@ export function mcpEndpoint(): string {
   return `${publicBaseOrDefault()}/mcp`;
 }
 
-const LOCAL_MCP_ENDPOINT = 'http://127.0.0.1:8420/mcp';
+const localMcpEndpoint = (): string => `http://127.0.0.1:${String(webhookPort())}/mcp`;
 
 export function mcpAddCommand(key: string): string {
-  const url = `${LOCAL_MCP_ENDPOINT}?token=${key}`;
+  const url = `${localMcpEndpoint()}?token=${key}`;
   return `claude mcp add --transport http ${SERVER_NAME} "${url}"`;
 }
 
@@ -105,7 +106,7 @@ interface KeyPayload {
 function credentials(key: string): KeyPayload {
   return {
     key,
-    endpoint: `${LOCAL_MCP_ENDPOINT}?token=${key}`,
+    endpoint: `${localMcpEndpoint()}?token=${key}`,
     command: mcpAddCommand(key),
   };
 }

package/runtime/node_modules/@metro-labs/mcp/src/db/file-admin.ts

@@ -23,6 +23,7 @@ import {
 import type { AccountRef } from './account-attach.js';
 import {
   AGENT_FILE,
+  AgentFileError,
   agentsDir,
   listAgentFiles,
   parseAgentFile,
@@ -224,17 +225,7 @@ export async function localImportAgent(
       409,
     );
   assertUnclaimed(storedAgents(dir), agent);
-  const file = parseAgentFile(
-    JSON.stringify({
-      version: 1,
-      id: agent.id,
-      name: agent.name,
-      key: agent.key,
-      owner: localOwner(dir),
-      stations: agent.accounts.map((a) => ({ ...a, allowlist: a.allowlist ?? ['*'] })),
-    }),
-    path,
-  );
+  const file = fileFor(agent, localOwner(dir), path);
   ensureSecureDir(folder);
   save({ path, file });
   registerKey(agent.key, agent.id);
@@ -246,6 +237,26 @@ export async function localImportAgent(
   });
 }
 
+function fileFor(agent: LoadedAgent, owner: string | null, path: string): AgentFile {
+  try {
+    return parseAgentFile(
+      JSON.stringify({
+        version: 1,
+        id: agent.id,
+        name: agent.name,
+        key: agent.key,
+        owner,
+        stations: agent.accounts.map((a) => ({ ...a, allowlist: a.allowlist ?? ['*'] })),
+      }),
+      path,
+    );
+  } catch (err) {
+    if (err instanceof AgentFileError)
+      throw new AgentAdminError(`metro's copy of this agent cannot be written here: ${err.message}`, 400);
+    throw err;
+  }
+}
+
 function removeIfEmpty(folder: string): void {
   try {
     rmdirSync(folder);

package/runtime/node_modules/@metro-labs/mcp/src/db/file-source.ts

@@ -7,7 +7,7 @@ import type { LoadedAccount, LoadedAgent, StationSource } from './materialize.js
 
 export const AGENT_FILE = 'agent.json';
 
-const KEY_RE = /^mk_[A-Za-z0-9_-]{43}$/;
+const KEY_RE = /^mk_[A-Za-z0-9_-]{16,128}$/;
 const ADDRESS_RE = /^0x[0-9a-f]{40}$/;
 const STATION_NAMES = new Set<string>(STATIONS);
 

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.35"
+  "version": "0.1.0-beta.37"
 }