@stage-labs/metro 0.1.0-beta.41 → 0.1.0-beta.43

package/dist/api.js

@@ -1,4 +1,6 @@
 import { metroUrl, readRunTokens, readToken } from './store.js';
+import { localAgents, localDaemonUp, localMcpServers, pickLocalAgent } from './local.js';
+import { localUrl } from './runtime.js';
 export class NotSignedIn extends Error {
 }
 const TIMEOUT_MS = 20_000;
@@ -115,13 +117,28 @@ export async function claimRuntime(code, label) {
         throw new Error('metro returned an unexpected response');
     return { token: body.token, agent: body.agent, label: body.label };
 }
-export async function mcpServers() {
+export async function mcpServers(wanted) {
+    if (await localDaemonUp()) {
+        const agents = localAgents();
+        if (agents.length > 0)
+            return localMcpServers(pickLocalAgent(agents, wanted));
+    }
     const body = await get('/api/cli/mcp');
     if (!isRecord(body) || typeof body.json !== 'string')
         throw new Error('metro returned an unexpected response');
     return body.json;
 }
-export async function whoisAuthorized() {
+export async function whoisAuthorized(wanted) {
+    if (await localDaemonUp()) {
+        const agents = localAgents();
+        if (agents.length > 0) {
+            const agent = pickLocalAgent(agents, wanted);
+            return { email: 'this machine', agent: agent.name, where: `${localUrl()} (local)` };
+        }
+    }
+    return { ...(await hostedIdentity()), where: metroUrl() };
+}
+async function hostedIdentity() {
     const body = await get('/api/cli/session');
     if (!isRecord(body) ||
         typeof body.email !== 'string' ||

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { hostname } from 'node:os';
 import { claimCode, claimRuntime, mcpServers, NotSignedIn, whoisAuthorized, } from './api.js';
 import { askSecret } from './prompt.js';
-import { clearToken, credentialsPath, metroUrl, metroWebUrl, writeToken, } from './store.js';
+import { clearToken, credentialsPath, metroWebUrl, writeToken, } from './store.js';
 import { detach, lockedBy, probe, runningPid, stopAll, tail } from './control.js';
 import { tailEvents } from './tail.js';
 import { assertAgentId, daemonPlan, localUrl, readRunToken, runDaemon, runtimeDir, runTokenState, writeRunToken, } from './runtime.js';
@@ -32,8 +32,11 @@ const USAGE = `metro — the command line for your MCP connectors
   metro login [code]
                   authorize this machine for one agent with a code from its page
   metro logout    forget this machine's sign-in
-  metro whoami    print the account and agent this machine may read
-  metro mcp       print the mcpServers block of the authorized agent's connectors
+  metro whoami [agent]
+                  print the account and agent this machine may read
+  metro mcp [agent]
+                  print the mcpServers block of the agent's connectors; with a local daemon
+                  running, its agent's connectors (name one if several)
   metro plugin    set up the Claude Code plugin (connector servers + /metro:login)
   metro claude [args...]
                   open Claude Code with the metro channel; every argument is passed through
@@ -142,9 +145,9 @@ async function login(given) {
         process.stderr.write('Claude Code plugin refreshed — new sessions have the connectors; ' +
             'run /reload-plugins in any session already open.\n');
 }
-async function whoami() {
-    const { email, agent } = await whoisAuthorized();
-    process.stdout.write(`${email} · agent '${agent}' on ${metroUrl()}\n`);
+async function whoami(wanted) {
+    const { email, agent, where } = await whoisAuthorized(wanted);
+    process.stdout.write(`${email} · agent '${agent}' on ${where}\n`);
 }
 const HELP = new Set([undefined, 'help', '--help', '-h']);
 const COMMANDS = {
@@ -158,7 +161,7 @@ const COMMANDS = {
         return Promise.resolve(0);
     },
     whoami: async () => {
-        await whoami();
+        await whoami(process.argv[3]);
         return 0;
     },
     start: () => start(process.argv.slice(3)),
@@ -168,7 +171,7 @@ const COMMANDS = {
     logs: () => logs(process.argv.slice(3)),
     tail: () => tailEvents(process.argv.slice(3)),
     mcp: async () => {
-        process.stdout.write(`${await mcpServers()}\n`);
+        process.stdout.write(`${await mcpServers(process.argv[3])}\n`);
         return 0;
     },
     plugin: installPlugin,

package/dist/local.js

@@ -0,0 +1,67 @@
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { localUrl } from './runtime.js';
+const PROBE_MS = 3_000;
+const READ_MS = 20_000;
+export function agentsDir() {
+    const explicit = process.env.METRO_AGENTS_DIR?.trim();
+    return explicit !== undefined && explicit !== '' ? explicit : join(homedir(), '.metro', 'agents');
+}
+export function localAgents(dir = agentsDir()) {
+    if (!existsSync(dir))
+        return [];
+    const out = [];
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const path = join(dir, entry.name, 'agent.json');
+        if (!existsSync(path))
+            continue;
+        try {
+            const file = JSON.parse(readFileSync(path, 'utf8'));
+            if (typeof file.id === 'string' && typeof file.name === 'string' && typeof file.key === 'string')
+                out.push({ id: file.id, name: file.name, key: file.key });
+        }
+        catch {
+            continue;
+        }
+    }
+    return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+export function pickLocalAgent(agents, wanted) {
+    if (wanted !== undefined && wanted !== '') {
+        const found = agents.find((a) => a.name === wanted || a.id === wanted);
+        if (found === undefined)
+            throw new Error(`no local agent named '${wanted}'`);
+        return found;
+    }
+    const only = agents[0];
+    if (only !== undefined && agents.length === 1)
+        return only;
+    throw new Error(agents.length === 0
+        ? 'no agent on this machine yet'
+        : `several agents on this machine — name one: ${agents.map((a) => a.name).join(', ')}`);
+}
+export async function localDaemonUp(base = localUrl()) {
+    try {
+        const res = await fetch(`${base}/api/mode`, { signal: AbortSignal.timeout(PROBE_MS) });
+        const body = (await res.json());
+        return res.ok && body.mode === 'local';
+    }
+    catch {
+        return false;
+    }
+}
+export async function localMcpServers(agent, base = localUrl()) {
+    const res = await fetch(`${base}/api/cli/mcp`, {
+        headers: { authorization: `Bearer ${agent.key}` },
+        signal: AbortSignal.timeout(READ_MS),
+    });
+    if (!res.ok)
+        throw new Error(`the local daemon answered ${String(res.status)} for the connectors`);
+    const body = (await res.json());
+    if (typeof body.json !== 'string')
+        throw new Error('the local daemon returned an unexpected response');
+    return body.json;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.41",
+  "version": "0.1.0-beta.43",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/claude-api.ts

@@ -0,0 +1,95 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from './log.js';
+import { apiFailure, apiSession, cors, sendJson } from './api-http.js';
+import { ApiError } from './api-error.js';
+import {
+  claudeDir,
+  listClaudeProjects,
+  listClaudeSessions,
+  listMemory,
+  readMemoryFile,
+  readTranscript,
+} from './claude-files.js';
+
+const PREFIX = '/api/claude';
+const PAGE = 100;
+const PAGE_MAX = 500;
+
+export interface ClaudeApiDeps {
+  authorize: (subject: string) => void;
+  dir?: () => string;
+}
+
+function projectOf(query: URLSearchParams): string {
+  const project = query.get('project');
+  if (project === null || project === '') throw new ApiError('project is required', 400);
+  return project;
+}
+
+function pageOf(query: URLSearchParams): { offset: number; limit: number } {
+  const offset = Math.max(0, Math.floor(Number(query.get('offset') ?? '0')) || 0);
+  const limit = Math.min(PAGE_MAX, Math.max(1, Math.floor(Number(query.get('limit') ?? String(PAGE))) || PAGE));
+  return { offset, limit };
+}
+
+type Handler = (query: URLSearchParams, dir: string, item: string) => unknown;
+
+const COLLECTIONS: Record<string, Handler> = {
+  projects: (_query, dir) => ({ projects: listClaudeProjects(dir) }),
+  sessions: (query, dir) => ({ sessions: listClaudeSessions(projectOf(query), dir) }),
+  memory: (query, dir) => listMemory(projectOf(query), dir),
+};
+
+const ITEMS: Record<string, Handler> = {
+  sessions: (query, dir, id) => {
+    const { offset, limit } = pageOf(query);
+    return readTranscript(projectOf(query), id, offset, limit, dir);
+  },
+  memory: (query, dir, name) => ({ name, content: readMemoryFile(projectOf(query), name, dir) }),
+};
+
+function answer(path: string, query: URLSearchParams, dir: string): unknown {
+  const rest = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
+  const [head = '', item] = rest;
+  const handler = rest.length === 1 ? COLLECTIONS[head] : rest.length === 2 ? ITEMS[head] : undefined;
+  if (handler === undefined) throw new ApiError('no such route', 404);
+  return handler(query, dir, item ?? '');
+}
+
+export function handleClaudeRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ClaudeApiDeps,
+): boolean {
+  const [path = '', search = ''] = (req.url ?? '').split('?');
+  if (path !== PREFIX && !path.startsWith(`${PREFIX}/`)) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  const session = apiSession(req);
+  if (!session) {
+    sendJson(req, res, 401, { error: 'unauthorized' });
+    return true;
+  }
+  Promise.resolve()
+    .then(() => {
+      deps.authorize(session.subject);
+      return answer(path, new URLSearchParams(search), (deps.dir ?? claudeDir)());
+    })
+    .then((body) => {
+      sendJson(req, res, 200, body);
+    })
+    .catch((err: unknown) => {
+      if (err instanceof ApiError) apiFailure(req, res, err, 'claude-api');
+      else {
+        log.warn({ err: errMsg(err) }, 'claude-api: request failed');
+        if (!res.headersSent) sendJson(req, res, 500, { error: 'claude-api failed' });
+      }
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/claude-files.ts

@@ -0,0 +1,321 @@
+import {
+  closeSync,
+  createReadStream,
+  existsSync,
+  openSync,
+  readdirSync,
+  readSync,
+  statSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { createInterface } from 'node:readline';
+import { ApiError } from './api-error.js';
+
+const PROJECT_RE = /^[A-Za-z0-9._-]{1,200}$/;
+const SESSION_RE = /^[A-Za-z0-9][A-Za-z0-9-]{7,63}$/;
+const MEMORY_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,119}\.md$/;
+const EDGE_BYTES = 64 * 1024;
+const TEXT_CAP = 20_000;
+const RESULT_CAP = 8_000;
+const INPUT_CAP = 4_000;
+const FILE_CAP = 1_000_000;
+const NOISE = ['<task-notification>', '<system-reminder>', '<local-command', '<command-name>'];
+
+export function claudeDir(): string {
+  const explicit = process.env.METRO_CLAUDE_DIR?.trim();
+  if (explicit !== undefined && explicit !== '') return explicit;
+  const cfg = process.env.CLAUDE_CONFIG_DIR?.trim();
+  if (cfg !== undefined && cfg !== '') return cfg;
+  return join(homedir(), '.claude');
+}
+
+const isRecord = (v: unknown): v is Record<string, unknown> =>
+  typeof v === 'object' && v !== null && !Array.isArray(v);
+
+const str = (v: unknown): string | null => (typeof v === 'string' && v !== '' ? v : null);
+
+function safeName(value: string, re: RegExp, what: string): string {
+  if (!re.test(value) || value === '.' || value === '..')
+    throw new ApiError(`that is not a ${what}`, 400);
+  return value;
+}
+
+function projectDir(project: string, dir: string): string {
+  const path = join(dir, 'projects', safeName(project, PROJECT_RE, 'Claude project id'));
+  if (!existsSync(path)) throw new ApiError('no such Claude project', 404);
+  return path;
+}
+
+function parseLines(text: string): Record<string, unknown>[] {
+  const out: Record<string, unknown>[] = [];
+  for (const line of text.split('\n')) {
+    if (line.trim() === '') continue;
+    try {
+      const parsed: unknown = JSON.parse(line);
+      if (isRecord(parsed)) out.push(parsed);
+    } catch {
+      continue;
+    }
+  }
+  return out;
+}
+
+function readEdge(path: string, fromEnd: boolean): Record<string, unknown>[] {
+  const size = statSync(path).size;
+  const length = Math.min(EDGE_BYTES, size);
+  const fd = openSync(path, 'r');
+  try {
+    const buffer = Buffer.alloc(length);
+    readSync(fd, buffer, 0, length, fromEnd ? size - length : 0);
+    const text = buffer.toString('utf8');
+    const cut = fromEnd && length < size ? text.indexOf('\n') + 1 : 0;
+    return parseLines(text.slice(cut));
+  } finally {
+    closeSync(fd);
+  }
+}
+
+export interface ClaudeProject {
+  id: string;
+  cwd: string | null;
+  sessions: number;
+  lastActiveAt: string | null;
+  hasMemory: boolean;
+}
+
+function sessionFiles(path: string): { name: string; mtime: number; size: number }[] {
+  return readdirSync(path)
+    .filter((name) => name.endsWith('.jsonl'))
+    .map((name) => {
+      const s = statSync(join(path, name));
+      return { name, mtime: s.mtimeMs, size: s.size };
+    })
+    .sort((a, b) => b.mtime - a.mtime);
+}
+
+function cwdOf(path: string): string | null {
+  for (const line of readEdge(path, false)) {
+    const cwd = str(line.cwd);
+    if (cwd !== null) return cwd;
+  }
+  return null;
+}
+
+export function listClaudeProjects(dir = claudeDir()): ClaudeProject[] {
+  const root = join(dir, 'projects');
+  if (!existsSync(root)) return [];
+  return readdirSync(root, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory() && PROJECT_RE.test(entry.name))
+    .map((entry) => {
+      const path = join(root, entry.name);
+      const files = sessionFiles(path);
+      const newest = files[0];
+      return {
+        id: entry.name,
+        cwd: newest === undefined ? null : cwdOf(join(path, newest.name)),
+        sessions: files.length,
+        lastActiveAt: newest === undefined ? null : new Date(newest.mtime).toISOString(),
+        hasMemory: existsSync(join(path, 'memory')),
+      };
+    })
+    .sort((a, b) => (b.lastActiveAt ?? '').localeCompare(a.lastActiveAt ?? ''));
+}
+
+export interface ClaudeSession {
+  id: string;
+  title: string;
+  startedAt: string | null;
+  lastAt: string;
+  bytes: number;
+  gitBranch: string | null;
+  version: string | null;
+}
+
+function firstPrompt(lines: Record<string, unknown>[]): string | null {
+  for (const line of lines) {
+    if (line.type !== 'user' || line.isSidechain === true) continue;
+    const message = isRecord(line.message) ? line.message : {};
+    const text = promptText(message.content);
+    if (text !== null && !NOISE.some((n) => text.startsWith(n))) return text.slice(0, 120);
+  }
+  return null;
+}
+
+function promptText(content: unknown): string | null {
+  if (typeof content === 'string') return content.trim() === '' ? null : content.trim();
+  if (!Array.isArray(content)) return null;
+  for (const block of content)
+    if (isRecord(block) && block.type === 'text') {
+      const text = str(block.text);
+      if (text !== null) return text.trim();
+    }
+  return null;
+}
+
+function sessionOf(path: string, id: string, mtime: number, size: number): ClaudeSession {
+  const head = readEdge(path, false);
+  const tail = readEdge(path, true);
+  const titled = [...tail].reverse().find((l) => l.type === 'ai-title' && str(l.aiTitle) !== null);
+  const meta = head.find((l) => l.type === 'user' || l.type === 'assistant') ?? {};
+  return {
+    id,
+    title: (titled === undefined ? null : str(titled.aiTitle)) ?? firstPrompt(head) ?? 'Untitled session',
+    startedAt: str(head.find((l) => str(l.timestamp) !== null)?.timestamp) ?? null,
+    lastAt: new Date(mtime).toISOString(),
+    bytes: size,
+    gitBranch: str(meta.gitBranch),
+    version: str(meta.version),
+  };
+}
+
+export function listClaudeSessions(project: string, dir = claudeDir()): ClaudeSession[] {
+  const path = projectDir(project, dir);
+  return sessionFiles(path).map((f) =>
+    sessionOf(join(path, f.name), f.name.slice(0, -'.jsonl'.length), f.mtime, f.size),
+  );
+}
+
+export type Block =
+  | { kind: 'text'; text: string }
+  | { kind: 'tool_use'; name: string; input: string }
+  | { kind: 'tool_result'; text: string; isError: boolean }
+  | { kind: 'thinking' }
+  | { kind: 'image' };
+
+export interface TranscriptEntry {
+  uuid: string;
+  at: string | null;
+  role: 'user' | 'assistant';
+  blocks: Block[];
+}
+
+export interface TranscriptPage {
+  entries: TranscriptEntry[];
+  total: number;
+  next: number | null;
+}
+
+const cap = (text: string, max: number): string =>
+  text.length > max ? `${text.slice(0, max)}\n… (${String(text.length - max)} more characters)` : text;
+
+function resultText(content: unknown): string {
+  if (typeof content === 'string') return content;
+  if (!Array.isArray(content)) return '';
+  return content
+    .map((b) => (isRecord(b) && b.type === 'text' ? (str(b.text) ?? '') : ''))
+    .filter((t) => t !== '')
+    .join('\n');
+}
+
+function textBlock(raw: Record<string, unknown>): Block | null {
+  const text = str(raw.text);
+  if (text === null || NOISE.some((n) => text.startsWith(n))) return null;
+  return { kind: 'text', text: cap(text, TEXT_CAP) };
+}
+
+const BLOCKS: Record<string, (raw: Record<string, unknown>) => Block | null> = {
+  text: textBlock,
+  tool_use: (raw) => ({
+    kind: 'tool_use',
+    name: str(raw.name) ?? 'tool',
+    input: cap(JSON.stringify(raw.input ?? {}, null, 1), INPUT_CAP),
+  }),
+  tool_result: (raw) => ({
+    kind: 'tool_result',
+    text: cap(resultText(raw.content), RESULT_CAP),
+    isError: raw.is_error === true,
+  }),
+  thinking: () => ({ kind: 'thinking' }),
+  image: () => ({ kind: 'image' }),
+};
+
+function blockOf(raw: unknown): Block | null {
+  if (!isRecord(raw) || typeof raw.type !== 'string') return null;
+  const make = BLOCKS[raw.type];
+  return make === undefined ? null : make(raw);
+}
+
+function entryOf(line: Record<string, unknown>): TranscriptEntry | null {
+  if ((line.type !== 'user' && line.type !== 'assistant') || line.isSidechain === true) return null;
+  const message = isRecord(line.message) ? line.message : {};
+  const content = message.content;
+  const blocks =
+    typeof content === 'string'
+      ? [blockOf({ type: 'text', text: content })]
+      : Array.isArray(content)
+        ? content.map(blockOf)
+        : [];
+  const kept = blocks.filter((b): b is Block => b !== null);
+  if (kept.length === 0) return null;
+  return { uuid: str(line.uuid) ?? '', at: str(line.timestamp), role: line.type, blocks: kept };
+}
+
+export async function readTranscript(
+  project: string,
+  session: string,
+  offset: number,
+  limit: number,
+  dir = claudeDir(),
+): Promise<TranscriptPage> {
+  const path = join(projectDir(project, dir), `${safeName(session, SESSION_RE, 'session id')}.jsonl`);
+  if (!existsSync(path)) throw new ApiError('no such session', 404);
+  const entries: TranscriptEntry[] = [];
+  let total = 0;
+  const lines = createInterface({ input: createReadStream(path, { encoding: 'utf8' }), crlfDelay: Infinity });
+  for await (const line of lines) {
+    const parsed = parseLines(line)[0];
+    const entry = parsed === undefined ? null : entryOf(parsed);
+    if (entry === null) continue;
+    if (total >= offset && entries.length < limit) entries.push(entry);
+    total += 1;
+  }
+  return { entries, total, next: offset + limit < total ? offset + limit : null };
+}
+
+export interface MemoryFile {
+  name: string;
+  bytes: number;
+  modifiedAt: string;
+}
+
+export interface MemoryListing {
+  files: MemoryFile[];
+  index: string | null;
+}
+
+function memoryDir(project: string, dir: string): string {
+  return join(projectDir(project, dir), 'memory');
+}
+
+function readCapped(path: string): string {
+  const size = statSync(path).size;
+  const fd = openSync(path, 'r');
+  try {
+    const buffer = Buffer.alloc(Math.min(size, FILE_CAP));
+    readSync(fd, buffer, 0, buffer.length, 0);
+    return size > FILE_CAP ? `${buffer.toString('utf8')}\n\n… truncated` : buffer.toString('utf8');
+  } finally {
+    closeSync(fd);
+  }
+}
+
+export function listMemory(project: string, dir = claudeDir()): MemoryListing {
+  const path = memoryDir(project, dir);
+  if (!existsSync(path)) return { files: [], index: null };
+  const files = readdirSync(path)
+    .filter((name) => MEMORY_RE.test(name) && name !== 'MEMORY.md')
+    .map((name) => {
+      const s = statSync(join(path, name));
+      return { name, bytes: s.size, modifiedAt: s.mtime.toISOString() };
+    })
+    .sort((a, b) => a.name.localeCompare(b.name));
+  const index = join(path, 'MEMORY.md');
+  return { files, index: existsSync(index) ? readCapped(index) : null };
+}
+
+export function readMemoryFile(project: string, name: string, dir = claudeDir()): string {
+  const path = join(memoryDir(project, dir), safeName(name, MEMORY_RE, 'memory file name'));
+  if (!existsSync(path)) throw new ApiError('no such memory file', 404);
+  return readCapped(path);
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-url.ts

@@ -9,6 +9,12 @@ export class ConnectorNotMcp extends ConnectorVerifyError {}
 export const POLICY_MESSAGE =
   'Metro connects from its own server, so it cannot reach a URL on your machine. localhost and private addresses are not usable as connectors.';
 
+let localAllowed = false;
+
+export function allowLocalConnectors(on: boolean): void {
+  localAllowed = on;
+}
+
 const IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/;
 const PRIVATE_SUFFIX = /(?:^|\.)(?:localhost|local|internal|flycast)$/;
 
@@ -22,6 +28,19 @@ function hostAllowed(host: string): boolean {
   return !PRIVATE_SUFFIX.test(host);
 }
 
+function schemeAllowed(url: URL): boolean {
+  return url.protocol === 'https:' || (localAllowed && url.protocol === 'http:');
+}
+
+function refuseShape(url: URL): void {
+  if (!schemeAllowed(url)) throw refused('a connector url must start with https://');
+  if (url.username !== '' || url.password !== '')
+    throw refused('a connector url must not carry a user:password');
+  if (url.hash !== '')
+    throw refused('a connector url must not carry a #fragment');
+  if (!localAllowed && !hostAllowed(url.hostname.toLowerCase())) throw refused(POLICY_MESSAGE);
+}
+
 export function parseConnectorUrl(raw: unknown): URL {
   const text = typeof raw === 'string' ? raw.trim() : '';
   if (text === '') throw refused('a connector url is required');
@@ -31,13 +50,7 @@ export function parseConnectorUrl(raw: unknown): URL {
   } catch {
     throw refused('that is not a valid url');
   }
-  if (url.protocol !== 'https:')
-    throw refused('a connector url must start with https://');
-  if (url.username !== '' || url.password !== '')
-    throw refused('a connector url must not carry a user:password');
-  if (url.hash !== '')
-    throw refused('a connector url must not carry a #fragment');
-  if (!hostAllowed(url.hostname.toLowerCase())) throw refused(POLICY_MESSAGE);
+  refuseShape(url);
   return url;
 }