@stage-labs/metro 0.1.0-beta.44 → 0.1.0-beta.46

package/dist/api.js

@@ -103,10 +103,10 @@ export async function claimCode(code) {
     const body = await post('/api/cli/claim', { code });
     if (!isRecord(body) ||
         typeof body.token !== 'string' ||
-        typeof body.email !== 'string' ||
+        typeof body.subject !== 'string' ||
         typeof body.agent !== 'string')
         throw new Error('metro returned an unexpected response');
-    return { token: body.token, email: body.email, agent: body.agent };
+    return { token: body.token, subject: body.subject, agent: body.agent };
 }
 export async function claimRuntime(code, label) {
     const body = await post('/api/run/claim', { code, label });
@@ -133,7 +133,7 @@ export async function whoisAuthorized(wanted) {
         const agents = localAgents();
         if (agents.length > 0) {
             const agent = pickLocalAgent(agents, wanted);
-            return { email: 'this machine', agent: agent.name, where: `${localUrl()} (local)` };
+            return { subject: 'this machine', agent: agent.name, where: `${localUrl()} (local)` };
         }
     }
     return { ...(await hostedIdentity()), where: metroUrl() };
@@ -141,8 +141,8 @@ export async function whoisAuthorized(wanted) {
 async function hostedIdentity() {
     const body = await get('/api/cli/session');
     if (!isRecord(body) ||
-        typeof body.email !== 'string' ||
+        typeof body.subject !== 'string' ||
         typeof body.agent !== 'string')
         throw new Error('metro returned an unexpected response');
-    return { email: body.email, agent: body.agent };
+    return { subject: body.subject, agent: body.agent };
 }

package/dist/bedrock-proxy.js

@@ -3,7 +3,7 @@ import { EventStreamDecoder } from './bedrock-eventstream.js';
 import { callBedrock, freshAdaptations, invoke, invokeUrl, upstreamMessage, } from './bedrock-upstream.js';
 export class BedrockConfigError extends Error {
 }
-export class ProxyError extends Error {
+class ProxyError extends Error {
     status;
     kind;
     constructor(status, kind, message) {

package/dist/cli.js

@@ -65,7 +65,7 @@ function hostLabel() {
     return name === '' ? 'unnamed machine' : name;
 }
 async function authorizeRuntime(agentId) {
-    process.stderr.write(`Authorize this machine at ${metroWebUrl()}/#/authorize/${agentId}\n`);
+    process.stderr.write(`Authorize this machine with a pairing code for agent ${agentId} from ${metroWebUrl()}\n`);
     const code = (await askSecret('Paste the code (input is hidden): ')).trim();
     if (code === '')
         throw new Error('no code given');
@@ -134,20 +134,20 @@ function logs(argv) {
 async function pastedCode(given) {
     if (given !== undefined && given.trim() !== '')
         return given.trim();
-    process.stderr.write(`Get a pairing code from the agent's page, or pick the agent at ${metroWebUrl()}/#/authorize\n`);
+    process.stderr.write(`Get a pairing code for the agent from ${metroWebUrl()}\n`);
     return askSecret('Paste the code here (input is hidden): ');
 }
 async function login(given) {
-    const { token, email, agent } = await claimCode(await pastedCode(given));
+    const { token, subject, agent } = await claimCode(await pastedCode(given));
     writeToken(token);
-    process.stderr.write(`Authorized '${agent}' for ${email}. Stored in ${credentialsPath()}\n`);
+    process.stderr.write(`Authorized '${agent}' for ${subject}. Stored in ${credentialsPath()}\n`);
     if (syncPluginServers())
         process.stderr.write('Claude Code plugin refreshed — new sessions have the connectors; ' +
             'run /reload-plugins in any session already open.\n');
 }
 async function whoami(wanted) {
-    const { email, agent, where } = await whoisAuthorized(wanted);
-    process.stdout.write(`${email} · agent '${agent}' on ${where}\n`);
+    const { subject, agent, where } = await whoisAuthorized(wanted);
+    process.stdout.write(`${subject} · agent '${agent}' on ${where}\n`);
 }
 const HELP = new Set([undefined, 'help', '--help', '-h']);
 const COMMANDS = {

package/dist/plugin.js

@@ -76,7 +76,7 @@ export async function installPlugin() {
             'run /reload-plugins in any session already open.\n');
         return 0;
     }
-    process.stderr.write('Now sign in: metro login (get a code at https://metro.box/#/authorize), ' +
+    process.stderr.write('Now sign in: metro login (with a pairing code from https://metro.box), ' +
         'or run /metro:login <code> inside Claude Code.\n');
     return Promise.resolve(0);
 }

package/dist/prompt.js

@@ -1,7 +1,7 @@
 import { createInterface } from 'node:readline';
 const CTRL_C = '\u0003';
 const BACKSPACE = '\u007f';
-export function askLine(question) {
+function askLine(question) {
     const rl = createInterface({ input: process.stdin, output: process.stderr });
     return new Promise((resolve) => {
         rl.question(question, (answer) => {

package/dist/runtime.js

@@ -18,7 +18,7 @@ export function runtimeDir() {
         throw new MissingRuntime(`no metro daemon at ${dir}. Reinstall with: npm i -g @stage-labs/metro@beta`);
     return dir;
 }
-export class MissingBun extends Error {
+class MissingBun extends Error {
 }
 export function assertAgentId(id) {
     if (id === undefined || !AGENT_RE.test(id))

package/dist/serve.js

@@ -34,7 +34,7 @@ export function parseServeArgs(argv) {
     }
     return { port, tunnel };
 }
-export function findCloudflared() {
+function findCloudflared() {
     const found = spawnSync('cloudflared', ['--version'], { stdio: 'ignore' });
     if (found.error !== undefined || found.status !== 0)
         throw new Error('metro serve --tunnel needs cloudflared, which is not on PATH.\n' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.44",
+  "version": "0.1.0-beta.46",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/discord-bot/src/accounts.ts

@@ -22,7 +22,6 @@ export interface AccountConfig {
 export const { loadAccounts } = makeAccountStore<AccountConfig>({
   prefix: 'discord-bot',
   file: ACCOUNTS_FILE,
-  allowlistEnv: ['DISCORD_BOT_ONLY_ACCOUNTS', 'DISCORD_BOT_ACCOUNTS'],
   validate(raw, die) {
     const seen = new Set<string>();
     for (const a of raw) {

package/runtime/node_modules/@metro-labs/mcp/package.json

@@ -2,7 +2,7 @@
   "name": "@metro-labs/mcp",
   "version": "0.1.0-beta.15",
   "private": true,
-  "description": "Event-interception wire. Supervises train subprocesses in ~/.metro/trains/, multiplexes their JSON event stream onto stdout, and routes outbound action calls back via stdin. Per-platform code is written by the agent (or user) as train scripts — metro core is pure transport.",
+  "description": "Event-interception wire. Supervises train subprocesses in ~/.metro/trains/, multiplexes their JSON event stream onto stdout, and routes outbound action calls back via stdin. Per-platform code is written by the agent (or user) as train scripts \u2014 metro core is pure transport.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -14,12 +14,8 @@
   "engines": {
     "node": ">=22"
   },
-  "bin": {
-    "metro-daemon": "./dist/server.js"
-  },
   "exports": {
     ".": "./src/mcp/index.ts",
-    "./server": "./dist/server.js",
     "./log": "./src/daemon/log.ts",
     "./train-error": "./src/daemon/train-error.ts",
     "./secure-fs": "./src/daemon/secure-fs.ts",

package/runtime/node_modules/@metro-labs/mcp/src/daemon/agent-import.ts

@@ -9,7 +9,7 @@ import type { LoadedAgent } from '../db/materialize.js';
 const CLAIM_TIMEOUT_MS = 15_000;
 const CODE_RE = /^ma_[A-Za-z0-9_-]{16}$/;
 
-export function metroBaseUrl(): string {
+function metroBaseUrl(): string {
   const raw = (process.env.METRO_URL?.trim() ?? '').replace(/\/+$/, '');
   const url = raw === '' ? 'https://mcp.metro.box' : raw;
   if (!carriesSecretsSafely(url))
@@ -53,7 +53,7 @@ async function claim(base: string, code: string, label: string): Promise<string>
   return token;
 }
 
-export function storeRunToken(agentId: string, token: string, url: string): string {
+function storeRunToken(agentId: string, token: string, url: string): string {
   const dir = configDir();
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   const path = join(dir, `runtime-${agentId}.json`);

package/runtime/node_modules/@metro-labs/mcp/src/daemon/attach-grant.ts

@@ -34,7 +34,7 @@ function parseGrant(raw: string): AttachmentGrant | undefined {
   };
 }
 
-export function readGrant(path: string): AttachmentGrant | undefined {
+function readGrant(path: string): AttachmentGrant | undefined {
   try {
     return parseGrant(readFileSync(`${path}${GRANT_SUFFIX}`, 'utf8'));
   } catch {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/attach-serve.ts

@@ -14,7 +14,7 @@ import {
 import { attachmentOwner, recordAttachmentOwner } from './attach-owner.js';
 import { grantAllows, issueAttachmentGrant } from './attach-grant.js';
 import { errMsg, log } from './log.js';
-import { configuredTunnelHost, currentTunnelUrl, webhookPort } from './tunnel.js';
+import { currentTunnelUrl, webhookPort } from './tunnel.js';
 import { isLocalMode } from './paths.js';
 
 function authorized(req: IncomingMessage, name: string): boolean {
@@ -31,10 +31,7 @@ const DEFAULT_PUBLIC_BASE = 'https://mcp.metro.box';
 export function publicBaseUrl(): string | null {
   const env = process.env.METRO_PUBLIC_URL?.trim();
   if (env) return env.replace(/\/+$/, '');
-  const live = currentTunnelUrl();
-  if (live !== null) return live;
-  const host = configuredTunnelHost();
-  return host ? `https://${host}` : null;
+  return currentTunnelUrl();
 }
 
 const servesLocally = (): boolean =>

package/runtime/node_modules/@metro-labs/mcp/src/daemon/boot.ts

@@ -1,24 +1,12 @@
 import type { ProjectApiDeps } from './project-api.js';
 import { join } from 'node:path';
 import { type Server } from 'node:http';
-import { selfLine, userSelf } from './events.js';
+import { userSelf } from './events.js';
 import { setTrainCallBackend } from './train-call.js';
 import { errMsg, log, logFatalSync } from './log.js';
-import {
-  acquireLock,
-  isLocalMode,
-  loadMetroEnv,
-  STATE_DIR,
-  trainsDir,
-} from './paths.js';
+import { acquireLock, isLocalMode, STATE_DIR, trainsDir } from './paths.js';
 import { installCrashGuard, markDaemonReady } from './crash-guard.js';
-import {
-  loadTunnelConfig,
-  Tunnel,
-  tunnelConfigFromEnv,
-  warnOnLegacyWebhooks,
-  webhookPort,
-} from './tunnel.js';
+import { quickTunnelWanted, Tunnel, webhookPort } from './tunnel.js';
 import {
   localConnectHint,
   publicConnectHint,
@@ -115,11 +103,9 @@ import type { AgentApiDeps } from './agent-api.js';
 import type { ConnectorApiDeps } from './connector-api.js';
 
 installCrashGuard();
-loadMetroEnv();
 acquireLock(join(STATE_DIR, '.tail-lock'));
 
-const self = userSelf();
-log.info({ self, line: selfLine() }, 'user identity');
+log.info({ self: userSelf() }, 'user identity');
 
 process.stdout.on('error', (err) => {
   if ((err as NodeJS.ErrnoException).code !== 'EPIPE')
@@ -135,8 +121,7 @@ supervisor.onTrainEvent((env, train) => {
 });
 
 let webhookServer: Server | null = null;
-const tunnelCfg = loadTunnelConfig() ?? tunnelConfigFromEnv();
-const tunnel = tunnelCfg ? new Tunnel(tunnelCfg, webhookPort(), announcePublic) : null;
+const tunnel = quickTunnelWanted() ? new Tunnel(webhookPort(), announcePublic) : null;
 
 function announcePublic(url: string): void {
   process.stderr.write(`\n${publicConnectHint(url)}`);
@@ -321,7 +306,6 @@ async function main(): Promise<void> {
   if (isLocalMode()) ensureLocalSessionSecret();
   if (localSource === null) await materializeFromDb();
   else await materializeFrom(localSource, { allowEmpty: linkedSource === null });
-  warnOnLegacyWebhooks();
   supervisor.start();
   const metroMcp = await createMetroMcp();
   webhookServer = await startWebhookServer(
@@ -373,8 +357,6 @@ const onShutdown = (): void => {
     process.exit(1);
   });
 };
-if (process.env.METRO_STDIN_SHUTDOWN === '1')
-  process.stdin.on('end', onShutdown).on('close', onShutdown);
 for (const sig of ['SIGINT', 'SIGTERM'] as const) process.on(sig, onShutdown);
 
 await main().catch((err: unknown) => {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/claude-files.ts

@@ -12,6 +12,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { ApiError } from './api-error.js';
+import { isRecord } from './is-record.js';
 
 const PROJECT_RE = /^[A-Za-z0-9._-]{1,200}$/;
 const SESSION_RE = /^[A-Za-z0-9][A-Za-z0-9-]{7,63}$/;
@@ -31,9 +32,6 @@ export function claudeDir(): string {
   return join(homedir(), '.claude');
 }
 
-const isRecord = (v: unknown): v is Record<string, unknown> =>
-  typeof v === 'object' && v !== null && !Array.isArray(v);
-
 const str = (v: unknown): string | null => (typeof v === 'string' && v !== '' ? v : null);
 
 function safeName(value: string, re: RegExp, what: string): string {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/cli-pair-api.ts

@@ -13,7 +13,7 @@ import { extractToken } from '../mcp/request-identity.js';
 import { publicBaseOrDefault } from './attach-serve.js';
 import { AGENT_CODE_RE, takeAgentCode } from './agent-pair.js';
 import { relayServersJson } from './connector-json.js';
-import { sessionTtlFromEnv } from './session-config.js';
+import { SESSION_TTL_SEC } from './session-config.js';
 import { signAgentToken } from './session.js';
 import type { ConnectorApiDeps } from './connector-api.js';
 
@@ -64,12 +64,11 @@ async function handleClaim(
   const token = signAgentToken(
     { subject: taken.subject, agentId: agent.id },
     secret,
-    { ttlSec: sessionTtlFromEnv() },
+    { ttlSec: SESSION_TTL_SEC },
   );
   log.info({ subject: taken.subject, agent: agent.id }, 'cli: code claimed');
   sendJson(req, res, 200, {
     token,
-    email: taken.subject,
     subject: taken.subject,
     agent: agent.name,
   });
@@ -90,7 +89,6 @@ async function handleRead(
   const agent = await deps.agentConnectors(who.subject, who.agentId);
   if (path === SESSION_PATH) {
     sendJson(req, res, 200, {
-      email: who.subject,
       subject: who.subject,
       agent: agent.name,
     });

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connect-hint.ts

@@ -2,8 +2,8 @@ import { hostname } from 'node:os';
 
 const uiBase = (): string => process.env.METRO_UI_URL ?? 'https://metro.box';
 
-export const connectLink = (base: string): string =>
-  `${uiBase()}/#/connect/${encodeURIComponent(base)}`;
+const connectLink = (base: string): string =>
+  `${uiBase()}/#/${new URL(base).host}`;
 
 export function localConnectHint(port: number): string {
   const here = `http://127.0.0.1:${String(port)}`;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-oauth.ts

@@ -19,9 +19,9 @@ export { takePending, type PendingAuth };
 
 const REFRESH_SKEW_MS = 300_000;
 
-export const CALLBACK_PATH = '/api/connectors/callback';
+const CALLBACK_PATH = '/api/connectors/callback';
 
-export const callbackUri = (): string =>
+const callbackUri = (): string =>
   `${publicBaseOrDefault()}${CALLBACK_PATH}`;
 
 function refused(message: string): ConnectorVerifyError {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-tools.ts

@@ -1,3 +1,5 @@
+import { isRecord } from './is-record.js';
+
 export const TOOL_KINDS = ['read', 'write'] as const;
 
 export type ToolKind = (typeof TOOL_KINDS)[number];
@@ -16,10 +18,6 @@ export interface ToolInfo {
 const MAX_TOOLS = 500;
 const MAX_DESCRIPTION = 400;
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
 const str = (value: unknown, cap: number): string =>
   typeof value === 'string' ? value.slice(0, cap) : '';
 
@@ -66,7 +64,7 @@ export function toToolList(raw: unknown): ToolInfo[] {
   return out;
 }
 
-export function toStoredTool(raw: unknown): ToolInfo | null {
+function toStoredTool(raw: unknown): ToolInfo | null {
   if (!isRecord(raw)) return null;
   const name = str(raw.name, 200);
   if (name === '') return null;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-verify.ts

@@ -13,6 +13,7 @@ export {
   connectorUrlText,
   parseConnectorUrl,
 } from './connector-url.js';
+import { isRecord } from './is-record.js';
 
 export interface OAuthTokens {
   accessToken: string;
@@ -58,10 +59,6 @@ function notMcp(url: URL): ConnectorNotMcp {
 const PROBE_TIMEOUT_MS = 10_000;
 const ACCEPT = 'application/json, text/event-stream';
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
 async function discard(res: Response): Promise<void> {
   await res.body?.cancel().catch((err: unknown) => {
     log.debug(

package/runtime/node_modules/@metro-labs/mcp/src/daemon/events.ts

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { Line } from '../stations/lines.js';
 
-export { userSelf, daemonSelf, selfLine } from './identity.js';
+export { userSelf, daemonSelf } from './identity.js';
 
 export type StructuredEvent =
   | { type: 'msg' }
@@ -81,7 +81,7 @@ export interface BufferedEvent {
   event: MetroEvent;
 }
 
-export const BUS_BUFFER_MAX = 500;
+const BUS_BUFFER_MAX = 500;
 
 const listeners = new Set<BusListener>();
 const buffer: BufferedEvent[] = [];

package/runtime/node_modules/@metro-labs/mcp/src/daemon/http.ts

@@ -35,11 +35,10 @@ import {
   type MonitorCall,
 } from '../monitor/api.js';
 import { applyMcpCors, handleMcpPreflight } from './cors.js';
+import { METRO_VERSION } from './version.js';
 
 const LRU_CAP = 2_000;
 
-const METRO_VERSION = process.env.npm_package_version ?? '0.1.0-beta.15';
-
 function dedupKey(
   e: Pick<MetroEvent, 'station' | 'line' | 'messageId'>,
 ): string | null {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/identity.ts

@@ -1,86 +1,7 @@
-import { execFileSync } from 'node:child_process';
-import { errMsg, log } from './log.js';
 import { Line } from '../stations/lines.js';
 
-const TTL_MS = 5_000;
-type Cache = { id: string; at: number } | null;
+export const userSelf = (): Line =>
+  (process.env.METRO_FROM ?? 'metro://user') as Line;
 
-function memo(loader: () => string): () => string {
-  let cache: Cache = null;
-  return () => {
-    if (cache && Date.now() - cache.at < TTL_MS) return cache.id;
-    const id = loader();
-    cache = { id, at: Date.now() };
-    return id;
-  };
-}
-
-const claudeAccountId = memo(() => {
-  let raw: string;
-  try {
-    raw = execFileSync('claude', ['auth', 'status', '--json'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-  } catch (e) {
-    throw new Error(
-      `metro: failed to run 'claude auth status --json' — is Claude Code installed? (${errMsg(e)})`,
-    );
-  }
-  let p: { loggedIn?: boolean; orgId?: string };
-  try {
-    p = JSON.parse(raw) as { loggedIn?: boolean; orgId?: string };
-  } catch {
-    throw new Error(
-      `metro: 'claude auth status --json' returned non-JSON: ${raw.slice(0, 200)}`,
-    );
-  }
-  if (!p.loggedIn || !p.orgId)
-    throw new Error(
-      "metro: Claude Code is not logged in — run 'claude auth login'",
-    );
-  return p.orgId;
-});
-
-export const claudeUserId = (): string =>
-  process.env.METRO_USER_ID ?? claudeAccountId();
-
-export const claudeSessionId = (): string | null =>
-  process.env.METRO_USER_SESSION_ID ??
-  process.env.CLAUDE_CODE_SESSION_ID ??
-  null;
-
-export function userSelf(): Line {
-  const explicit = process.env.METRO_FROM;
-  if (explicit) return explicit as Line;
-  if (!process.env.CLAUDECODE) return 'metro://user' as Line;
-  try {
-    return Line.user('claude', claudeUserId());
-  } catch (e) {
-    log.warn(
-      { reason: errMsg(e) },
-      'could not resolve a Claude account id; relaying as metro://user',
-    );
-    return 'metro://user' as Line;
-  }
-}
-
-export function daemonSelf(): Line {
-  const explicit = process.env.METRO_FROM ?? process.env.METRO_SELF_URI;
-  return (explicit ?? 'metro://user') as Line;
-}
-
-export function selfLine(): Line | null {
-  if (!process.env.CLAUDECODE) return null;
-  const s = claudeSessionId();
-  if (!s) return null;
-  try {
-    return Line.claude(claudeUserId(), s);
-  } catch (e) {
-    log.warn(
-      { reason: errMsg(e) },
-      'could not resolve a Claude account id; relaying with no self line',
-    );
-    return null;
-  }
-}
+export const daemonSelf = (): Line =>
+  (process.env.METRO_FROM ?? process.env.METRO_SELF_URI ?? 'metro://user') as Line;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/is-record.ts

@@ -0,0 +1,2 @@
+export const isRecord = (v: unknown): v is Record<string, unknown> =>
+  typeof v === 'object' && v !== null && !Array.isArray(v);

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-cli-api.ts

@@ -14,7 +14,7 @@ export interface LocalCliDeps {
   connectorSummaries: (agentId: string) => Promise<ConnectorSummary[]>;
 }
 
-export function keyOf(req: IncomingMessage): string {
+function keyOf(req: IncomingMessage): string {
   const header = req.headers.authorization ?? '';
   if (header.toLowerCase().startsWith('bearer ')) return header.slice(7).trim();
   const query = new URLSearchParams((req.url ?? '').split('?')[1] ?? '');
@@ -29,7 +29,7 @@ export function keyIdentity(req: IncomingMessage): AgentIdentity | null {
 
 async function answer(path: string, key: string, agentId: string, deps: LocalCliDeps): Promise<unknown> {
   const agent = deps.agentName(agentId) ?? '';
-  if (path === `${PREFIX}/session`) return { email: 'this machine', subject: 'this machine', agent };
+  if (path === `${PREFIX}/session`) return { subject: 'this machine', agent };
   if (path === `${PREFIX}/connectors`) return { agent, connectors: await deps.connectorSummaries(agentId) };
   return { json: relayServersJson(await deps.connectorEntries(agentId), publicBaseOrDefault(), key), agent };
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-mode.ts

@@ -5,7 +5,6 @@ import { AttachSessions } from './attach-session.js';
 import type { AgentApiDeps } from './agent-api.js';
 import { ATTACHABLE, type AccountApiDeps } from './account-api.js';
 import type { AgentConnectorApiDeps } from './agent-connector-api.js';
-import type { ProjectApiDeps } from './project-api.js';
 import type { SessionApis } from './session-apis.js';
 import type { ModeInfo } from './mode-api.js';
 import type { ImportApiDeps } from './import-api.js';
@@ -46,9 +45,7 @@ import {
   localOwner,
   localResetAgentKey,
 } from '../db/file-admin.js';
-import { normalizeAddress } from '../db/users.js';
 import { listAgentFiles, readAgentFile } from '../db/file-source.js';
-import type { Project } from '../db/projects.js';
 import type { StationName } from '../db/schema.js';
 
 export interface LocalModeDeps {
@@ -66,16 +63,6 @@ const notHere = (what: string): Promise<never> =>
     new ApiError(`${what} are managed on metro.box, not on a local daemon`, 400),
   );
 
-function localProject(): Project {
-  return {
-    id: LOCAL_PROJECT_ID,
-    name: hostname(),
-    isDefault: true,
-    owner: true,
-    role: 'admin',
-  };
-}
-
 function attachSessions(deps: LocalModeDeps): AttachSessions {
   return new AttachSessions({
     authorize: async (owner) => {
@@ -124,28 +111,6 @@ function agentApi(deps: LocalModeDeps): AgentApiDeps {
   };
 }
 
-const projectApi: ProjectApiDeps = {
-  listProjects: (subject) => {
-    const owner = localOwner();
-    const mine = owner !== null && owner === normalizeAddress(subject);
-    return Promise.resolve(mine ? [localProject()] : []);
-  },
-  createProject: () => notHere('projects'),
-  renameProject: () => notHere('projects'),
-  deleteProject: () => notHere('projects'),
-  listMembers: (subject, id) => {
-    const owner = localOwner();
-    if (id !== LOCAL_PROJECT_ID || owner === null || owner !== normalizeAddress(subject))
-      return Promise.reject(new ApiError('no such project', 404));
-    return Promise.resolve([
-      { id: 'owner', address: owner, email: null, role: 'admin', owner: true },
-    ]);
-  },
-  addMember: () => notHere('members'),
-  setMemberRole: () => notHere('members'),
-  removeMember: () => notHere('members'),
-};
-
 function connectorIdsOfLocalAgents(ids: string[]): Promise<Map<string, string[]>> {
   return Promise.resolve(new Map(ids.map((id) => [id, connectorIdsOfLocalAgent(id) ?? []] as const)));
 }
@@ -211,7 +176,7 @@ function importApi(deps: LocalModeDeps): ImportApiDeps {
   };
 }
 
-export function localModeInfo(): ModeInfo {
+function localModeInfo(): ModeInfo {
   return { mode: 'local', owner: localOwner(), project: LOCAL_PROJECT_ID };
 }
 
@@ -225,7 +190,6 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
     relayApi,
     localCli,
     claudeApi: { authorize: (subject) => { assertLocalOwner(subject); } },
-    projectApi,
     siwe: { ensureUser: claimLocalOwner },
     mode: localModeInfo,
   };

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-client.ts

@@ -4,6 +4,7 @@ import {
   type OAuthTokens,
 } from './connector-verify.js';
 import type { OAuthServer } from './oauth-discovery.js';
+import { isRecord } from './is-record.js';
 
 const TOKEN_TIMEOUT_MS = 15_000;
 const CLIENT_NAME = 'Metro';
@@ -17,10 +18,6 @@ function refused(message: string): ConnectorVerifyError {
   return new ConnectorVerifyError(message, 400);
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
 export function newVerifier(): string {
   return randomBytes(32).toString('base64url');
 }