@stage-labs/metro 0.1.0-beta.36 → 0.1.0-beta.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.36",
+  "version": "0.1.0-beta.37",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/db/file-admin.ts

@@ -23,6 +23,7 @@ import {
 import type { AccountRef } from './account-attach.js';
 import {
   AGENT_FILE,
+  AgentFileError,
   agentsDir,
   listAgentFiles,
   parseAgentFile,
@@ -224,17 +225,7 @@ export async function localImportAgent(
       409,
     );
   assertUnclaimed(storedAgents(dir), agent);
-  const file = parseAgentFile(
-    JSON.stringify({
-      version: 1,
-      id: agent.id,
-      name: agent.name,
-      key: agent.key,
-      owner: localOwner(dir),
-      stations: agent.accounts.map((a) => ({ ...a, allowlist: a.allowlist ?? ['*'] })),
-    }),
-    path,
-  );
+  const file = fileFor(agent, localOwner(dir), path);
   ensureSecureDir(folder);
   save({ path, file });
   registerKey(agent.key, agent.id);
@@ -246,6 +237,26 @@ export async function localImportAgent(
   });
 }
 
+function fileFor(agent: LoadedAgent, owner: string | null, path: string): AgentFile {
+  try {
+    return parseAgentFile(
+      JSON.stringify({
+        version: 1,
+        id: agent.id,
+        name: agent.name,
+        key: agent.key,
+        owner,
+        stations: agent.accounts.map((a) => ({ ...a, allowlist: a.allowlist ?? ['*'] })),
+      }),
+      path,
+    );
+  } catch (err) {
+    if (err instanceof AgentFileError)
+      throw new AgentAdminError(`metro's copy of this agent cannot be written here: ${err.message}`, 400);
+    throw err;
+  }
+}
+
 function removeIfEmpty(folder: string): void {
   try {
     rmdirSync(folder);

package/runtime/node_modules/@metro-labs/mcp/src/db/file-source.ts

@@ -7,7 +7,7 @@ import type { LoadedAccount, LoadedAgent, StationSource } from './materialize.js
 
 export const AGENT_FILE = 'agent.json';
 
-const KEY_RE = /^mk_[A-Za-z0-9_-]{43}$/;
+const KEY_RE = /^mk_[A-Za-z0-9_-]{16,128}$/;
 const ADDRESS_RE = /^0x[0-9a-f]{40}$/;
 const STATION_NAMES = new Set<string>(STATIONS);
 

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.36"
+  "version": "0.1.0-beta.37"
 }