@stage-labs/metro 0.1.0-beta.45 → 0.1.0-beta.47

package/runtime/node_modules/@metro-labs/mcp/src/daemon/identity.ts

@@ -1,86 +1,7 @@
-import { execFileSync } from 'node:child_process';
-import { errMsg, log } from './log.js';
 import { Line } from '../stations/lines.js';
 
-const TTL_MS = 5_000;
-type Cache = { id: string; at: number } | null;
+export const userSelf = (): Line =>
+  (process.env.METRO_FROM ?? 'metro://user') as Line;
 
-function memo(loader: () => string): () => string {
-  let cache: Cache = null;
-  return () => {
-    if (cache && Date.now() - cache.at < TTL_MS) return cache.id;
-    const id = loader();
-    cache = { id, at: Date.now() };
-    return id;
-  };
-}
-
-const claudeAccountId = memo(() => {
-  let raw: string;
-  try {
-    raw = execFileSync('claude', ['auth', 'status', '--json'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-  } catch (e) {
-    throw new Error(
-      `metro: failed to run 'claude auth status --json' — is Claude Code installed? (${errMsg(e)})`,
-    );
-  }
-  let p: { loggedIn?: boolean; orgId?: string };
-  try {
-    p = JSON.parse(raw) as { loggedIn?: boolean; orgId?: string };
-  } catch {
-    throw new Error(
-      `metro: 'claude auth status --json' returned non-JSON: ${raw.slice(0, 200)}`,
-    );
-  }
-  if (!p.loggedIn || !p.orgId)
-    throw new Error(
-      "metro: Claude Code is not logged in — run 'claude auth login'",
-    );
-  return p.orgId;
-});
-
-export const claudeUserId = (): string =>
-  process.env.METRO_USER_ID ?? claudeAccountId();
-
-export const claudeSessionId = (): string | null =>
-  process.env.METRO_USER_SESSION_ID ??
-  process.env.CLAUDE_CODE_SESSION_ID ??
-  null;
-
-export function userSelf(): Line {
-  const explicit = process.env.METRO_FROM;
-  if (explicit) return explicit as Line;
-  if (!process.env.CLAUDECODE) return 'metro://user' as Line;
-  try {
-    return Line.user('claude', claudeUserId());
-  } catch (e) {
-    log.warn(
-      { reason: errMsg(e) },
-      'could not resolve a Claude account id; relaying as metro://user',
-    );
-    return 'metro://user' as Line;
-  }
-}
-
-export function daemonSelf(): Line {
-  const explicit = process.env.METRO_FROM ?? process.env.METRO_SELF_URI;
-  return (explicit ?? 'metro://user') as Line;
-}
-
-export function selfLine(): Line | null {
-  if (!process.env.CLAUDECODE) return null;
-  const s = claudeSessionId();
-  if (!s) return null;
-  try {
-    return Line.claude(claudeUserId(), s);
-  } catch (e) {
-    log.warn(
-      { reason: errMsg(e) },
-      'could not resolve a Claude account id; relaying with no self line',
-    );
-    return null;
-  }
-}
+export const daemonSelf = (): Line =>
+  (process.env.METRO_FROM ?? process.env.METRO_SELF_URI ?? 'metro://user') as Line;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/is-record.ts

@@ -0,0 +1,2 @@
+export const isRecord = (v: unknown): v is Record<string, unknown> =>
+  typeof v === 'object' && v !== null && !Array.isArray(v);

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-cli-api.ts

@@ -14,7 +14,7 @@ export interface LocalCliDeps {
   connectorSummaries: (agentId: string) => Promise<ConnectorSummary[]>;
 }
 
-export function keyOf(req: IncomingMessage): string {
+function keyOf(req: IncomingMessage): string {
   const header = req.headers.authorization ?? '';
   if (header.toLowerCase().startsWith('bearer ')) return header.slice(7).trim();
   const query = new URLSearchParams((req.url ?? '').split('?')[1] ?? '');
@@ -29,7 +29,7 @@ export function keyIdentity(req: IncomingMessage): AgentIdentity | null {
 
 async function answer(path: string, key: string, agentId: string, deps: LocalCliDeps): Promise<unknown> {
   const agent = deps.agentName(agentId) ?? '';
-  if (path === `${PREFIX}/session`) return { email: 'this machine', subject: 'this machine', agent };
+  if (path === `${PREFIX}/session`) return { subject: 'this machine', agent };
   if (path === `${PREFIX}/connectors`) return { agent, connectors: await deps.connectorSummaries(agentId) };
   return { json: relayServersJson(await deps.connectorEntries(agentId), publicBaseOrDefault(), key), agent };
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-mode.ts

@@ -5,7 +5,6 @@ import { AttachSessions } from './attach-session.js';
 import type { AgentApiDeps } from './agent-api.js';
 import { ATTACHABLE, type AccountApiDeps } from './account-api.js';
 import type { AgentConnectorApiDeps } from './agent-connector-api.js';
-import type { ProjectApiDeps } from './project-api.js';
 import type { SessionApis } from './session-apis.js';
 import type { ModeInfo } from './mode-api.js';
 import type { ImportApiDeps } from './import-api.js';
@@ -33,7 +32,7 @@ import {
 } from '../db/local-connectors.js';
 import {
   assertLocalOwner,
-  claimLocalOwner,
+  ownerSignIn,
   connectorIdsOfLocalAgent,
   LOCAL_PROJECT_ID,
   localAttachAccount,
@@ -46,9 +45,7 @@ import {
   localOwner,
   localResetAgentKey,
 } from '../db/file-admin.js';
-import { normalizeAddress } from '../db/users.js';
 import { listAgentFiles, readAgentFile } from '../db/file-source.js';
-import type { Project } from '../db/projects.js';
 import type { StationName } from '../db/schema.js';
 
 export interface LocalModeDeps {
@@ -66,16 +63,6 @@ const notHere = (what: string): Promise<never> =>
     new ApiError(`${what} are managed on metro.box, not on a local daemon`, 400),
   );
 
-function localProject(): Project {
-  return {
-    id: LOCAL_PROJECT_ID,
-    name: hostname(),
-    isDefault: true,
-    owner: true,
-    role: 'admin',
-  };
-}
-
 function attachSessions(deps: LocalModeDeps): AttachSessions {
   return new AttachSessions({
     authorize: async (owner) => {
@@ -124,28 +111,6 @@ function agentApi(deps: LocalModeDeps): AgentApiDeps {
   };
 }
 
-const projectApi: ProjectApiDeps = {
-  listProjects: (subject) => {
-    const owner = localOwner();
-    const mine = owner !== null && owner === normalizeAddress(subject);
-    return Promise.resolve(mine ? [localProject()] : []);
-  },
-  createProject: () => notHere('projects'),
-  renameProject: () => notHere('projects'),
-  deleteProject: () => notHere('projects'),
-  listMembers: (subject, id) => {
-    const owner = localOwner();
-    if (id !== LOCAL_PROJECT_ID || owner === null || owner !== normalizeAddress(subject))
-      return Promise.reject(new ApiError('no such project', 404));
-    return Promise.resolve([
-      { id: 'owner', address: owner, email: null, role: 'admin', owner: true },
-    ]);
-  },
-  addMember: () => notHere('members'),
-  setMemberRole: () => notHere('members'),
-  removeMember: () => notHere('members'),
-};
-
 function connectorIdsOfLocalAgents(ids: string[]): Promise<Map<string, string[]>> {
   return Promise.resolve(new Map(ids.map((id) => [id, connectorIdsOfLocalAgent(id) ?? []] as const)));
 }
@@ -211,7 +176,7 @@ function importApi(deps: LocalModeDeps): ImportApiDeps {
   };
 }
 
-export function localModeInfo(): ModeInfo {
+function localModeInfo(): ModeInfo {
   return { mode: 'local', owner: localOwner(), project: LOCAL_PROJECT_ID };
 }
 
@@ -225,8 +190,7 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
     relayApi,
     localCli,
     claudeApi: { authorize: (subject) => { assertLocalOwner(subject); } },
-    projectApi,
-    siwe: { ensureUser: claimLocalOwner },
+    siwe: { ensureUser: ownerSignIn },
     mode: localModeInfo,
   };
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-owner.ts

@@ -0,0 +1,14 @@
+import { localOwner, setLocalOwner } from '../db/file-admin.js';
+import { log } from './log.js';
+
+export function applyLocalOwner(): string | null {
+  const wanted = process.env.METRO_OWNER?.trim() ?? '';
+  if (wanted !== '') {
+    const address = setLocalOwner(wanted);
+    log.info({ owner: address }, 'local daemon: owner set from METRO_OWNER');
+    return address;
+  }
+  const stored = localOwner();
+  if (stored === null) log.warn('local daemon: no owner set, so no wallet can sign in; restart with metro serve --owner <address>');
+  return stored;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-client.ts

@@ -4,6 +4,7 @@ import {
   type OAuthTokens,
 } from './connector-verify.js';
 import type { OAuthServer } from './oauth-discovery.js';
+import { isRecord } from './is-record.js';
 
 const TOKEN_TIMEOUT_MS = 15_000;
 const CLIENT_NAME = 'Metro';
@@ -17,10 +18,6 @@ function refused(message: string): ConnectorVerifyError {
   return new ConnectorVerifyError(message, 400);
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
 export function newVerifier(): string {
   return randomBytes(32).toString('base64url');
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-discovery.ts

@@ -1,4 +1,5 @@
 import { ConnectorVerifyError, parseConnectorUrl } from './connector-verify.js';
+import { isRecord } from './is-record.js';
 
 const DISCOVERY_TIMEOUT_MS = 10_000;
 
@@ -14,10 +15,6 @@ function refused(message: string): ConnectorVerifyError {
   return new ConnectorVerifyError(message, 400);
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
 const str = (value: unknown): string =>
   typeof value === 'string' ? value : '';
 

package/runtime/node_modules/@metro-labs/mcp/src/daemon/paths.ts

@@ -1,7 +1,6 @@
 import { execFileSync } from 'node:child_process';
 import {
   closeSync,
-  existsSync,
   mkdirSync,
   openSync,
   readFileSync,
@@ -20,10 +19,6 @@ mkdirSync(STATE_DIR, { recursive: true });
 export const configDir = (): string =>
   process.env.METRO_CONFIG_DIR ??
   join(process.env.XDG_CONFIG_HOME ?? join(homedir(), '.config'), 'metro');
-export const CONFIG_DIR = configDir();
-export const CONFIG_ENV_FILE = join(CONFIG_DIR, '.env');
-
-export const TRAINS_ENV_FILE = join(homedir(), '.metro', '.env');
 
 export function trainsDir(): string {
   const env = process.env.METRO_TRAINS_DIR?.trim();
@@ -34,34 +29,6 @@ export function trainsDir(): string {
 export const isLocalMode = (): boolean =>
   process.env.METRO_MODE?.trim() === 'local';
 
-export const envSources = (): readonly string[] => [
-  join(process.cwd(), '.env'),
-  TRAINS_ENV_FILE,
-  CONFIG_ENV_FILE,
-];
-
-const LINE_RE = /^\s*([A-Za-z_]\w*)\s*=\s*(.*?)\s*$/;
-const QUOTED_RE = /^(['"])(.*)\1$/;
-
-export function readDotenv(path: string): Record<string, string> {
-  if (!existsSync(path)) return {};
-  const out: Record<string, string> = {};
-  for (const line of readFileSync(path, 'utf8').split('\n')) {
-    const m = LINE_RE.exec(line);
-    if (m?.[1] !== undefined && m[2] !== undefined)
-      out[m[1]] = m[2].replace(QUOTED_RE, '$2');
-  }
-  return out;
-}
-
-export function loadMetroEnv(): void {
-  for (const path of envSources()) {
-    for (const [k, v] of Object.entries(readDotenv(path))) {
-      process.env[k] ??= v;
-    }
-  }
-}
-
 function readLockPid(lockFile: string): number {
   try {
     return Number(readFileSync(lockFile, 'utf8').trim());

package/runtime/node_modules/@metro-labs/mcp/src/daemon/protocol.ts

@@ -11,7 +11,7 @@ export {
   type TrainErrorInfo,
 } from './train-error.js';
 
-export const CALL_TIMEOUT_MS = 60_000;
+const CALL_TIMEOUT_MS = 60_000;
 
 export interface Pending {
   resolve: (r: TrainCallResponse) => void;
@@ -24,7 +24,7 @@ export interface CallTarget {
   proc: ({ stdin?: unknown } & Record<string, unknown>) | null;
 }
 
-export const STDOUT_LINE_MAX = 4 * 1024 * 1024;
+const STDOUT_LINE_MAX = 4 * 1024 * 1024;
 
 export type TrainEvent = {
   station?: string;
@@ -149,7 +149,7 @@ export function readCalls(
   });
 }
 
-export function encodeCall(id: string, action: string, args: unknown): string {
+function encodeCall(id: string, action: string, args: unknown): string {
   return JSON.stringify({ op: 'call', id, action, args }) + '\n';
 }
 

package/runtime/node_modules/@metro-labs/mcp/src/daemon/run-api.ts

@@ -9,7 +9,7 @@ import {
   sendJson,
 } from './api-http.js';
 import { AGENT_CODE_RE, takeAgentCode } from './agent-pair.js';
-import { sessionTtlFromEnv } from './session-config.js';
+import { SESSION_TTL_SEC } from './session-config.js';
 import { signRunToken } from './session.js';
 import type { LoadedAgent } from '../db/materialize.js';
 import type { RuntimeLease } from '../db/runtimes.js';
@@ -80,7 +80,7 @@ async function handleClaim(
   const token = signRunToken(
     { subject: taken.subject, agentId: lease.agentId, runtimeId: lease.runtimeId },
     secret,
-    { ttlSec: sessionTtlFromEnv() },
+    { ttlSec: SESSION_TTL_SEC },
   );
   log.info(
     { agent: lease.agentId, runtime: lease.runtimeId, label: lease.label },

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-config.ts

@@ -1,11 +1,6 @@
-const DEFAULT_SESSION_TTL_SEC = 30 * 24 * 3600;
+export const SESSION_TTL_SEC = 30 * 24 * 3600;
 const PREVIEW = /^([a-z0-9-]+--)?metro-ui\.netlify\.app$/;
 
-export function sessionTtlFromEnv(): number {
-  const ttl = Number(process.env.METRO_SESSION_TTL_SEC);
-  return Number.isFinite(ttl) && ttl > 0 ? ttl : DEFAULT_SESSION_TTL_SEC;
-}
-
 export function allowedWebHost(host: string): boolean {
   if (host === 'metro.box' || host === 'localhost' || host === '127.0.0.1')
     return true;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session.ts

@@ -1,4 +1,4 @@
-import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createHmac, timingSafeEqual } from 'node:crypto';
 import { ID_RE } from '../db/ids.js';
 
 export class SessionError extends Error {}
@@ -53,47 +53,6 @@ function verify(token: string, secret: string): Record<string, unknown> {
 
 const nowSec = (now?: number): number => Math.floor((now ?? Date.now()) / 1000);
 
-export function newNonce(): string {
-  return b64url(randomBytes(16));
-}
-
-interface StateClaims {
-  return_to: string;
-  nonce: string;
-}
-
-export function signState(
-  claims: StateClaims,
-  secret: string,
-  opts: { ttlSec?: number; now?: number } = {},
-): string {
-  const iat = nowSec(opts.now);
-  return sign(
-    {
-      typ: 'state',
-      return_to: claims.return_to,
-      nonce: claims.nonce,
-      iat,
-      exp: iat + (opts.ttlSec ?? 600),
-    },
-    secret,
-  );
-}
-
-export function verifyState(
-  token: string,
-  secret: string,
-  now?: number,
-): StateClaims {
-  const p = verify(token, secret);
-  if (p.typ !== 'state') throw new SessionError('wrong token type');
-  if (typeof p.exp !== 'number' || p.exp < nowSec(now))
-    throw new SessionError('state expired');
-  if (typeof p.return_to !== 'string' || typeof p.nonce !== 'string')
-    throw new SessionError('malformed state');
-  return { return_to: p.return_to, nonce: p.nonce };
-}
-
 interface SessionClaims {
   subject: string;
   agentIds: string[];

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-auth.ts

@@ -10,16 +10,8 @@ export interface SiweLogin {
   signature: string;
 }
 
-export interface SiweVerifyArgs {
-  address: `0x${string}`;
-  message: string;
-  signature: Hex;
-}
-
 export interface SiweDeps {
   takeNonce: (nonce: string) => boolean;
-  now?: number;
-  verify?: (args: SiweVerifyArgs) => Promise<boolean>;
 }
 
 const HEX_SIGNATURE = /^0x[0-9a-fA-F]{130}$/;
@@ -66,14 +58,13 @@ export async function verifySiweLogin(
   if (!HEX_SIGNATURE.test(input.signature))
     throw new SiweError('that is not an Ethereum signature', 400);
   const { address, domain, nonce, parsed } = fieldsOrThrow(input.message);
-  const time = new Date(deps.now ?? Date.now());
+  const time = new Date();
   if (!validateSiweMessage({ message: parsed, domain, nonce, time }))
     throw new SiweError('this sign-in message is expired or does not match', 400);
   if (!deps.takeNonce(nonce))
     throw new SiweError('that sign-in has expired or was already used', 400);
-  const verify = deps.verify ?? verifyMessage;
   const signature = input.signature as Hex;
-  if (!(await verify({ address, message: input.message, signature })))
+  if (!(await verifyMessage({ address, message: input.message, signature })))
     throw new SiweError(
       'the signature does not match the address; smart-contract wallets are not supported yet',
       401,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-routes.ts

@@ -10,7 +10,7 @@ import {
 import { mintNonce, takeNonce } from './siwe-nonces.js';
 import { verifySiweLogin } from './siwe-auth.js';
 import { signSession } from './session.js';
-import { sessionTtlFromEnv } from './session-config.js';
+import { SESSION_TTL_SEC } from './session-config.js';
 import { ensureUserWithProject } from '../db/projects.js';
 
 const NONCE_PATH = '/auth/siwe/nonce';
@@ -39,7 +39,7 @@ async function handleVerify(
   const userId = await deps.ensureUser(address);
   log.info({ userId, address }, 'siwe: session issued');
   const session = signSession({ subject: address, agentIds: [] }, secret, {
-    ttlSec: sessionTtlFromEnv(),
+    ttlSec: SESSION_TTL_SEC,
   });
   sendJson(req, res, 200, { session, address });
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/tunnel.ts

@@ -1,31 +1,15 @@
-import { spawn, spawnSync, type ChildProcess } from 'node:child_process';
+import { spawn, type ChildProcess } from 'node:child_process';
 import { timingSafeEqual } from 'node:crypto';
 import { Resolver } from 'node:dns/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { STATE_DIR } from './paths.js';
 import { errMsg, log } from './log.js';
 import { readJson } from './secure-fs.js';
 
-const FILE = join(STATE_DIR, 'tunnel.json');
-const LEGACY_WEBHOOKS_FILE = join(STATE_DIR, 'webhooks.json');
 const RESTART_DELAY_MS = 2_000;
 
-interface NamedTunnel {
-  name: string;
-  hostname: string;
-}
-
-interface QuickTunnel {
-  quick: true;
-}
-
-export type TunnelConfig = NamedTunnel | QuickTunnel;
-
-const isQuick = (cfg: TunnelConfig): cfg is QuickTunnel => 'quick' in cfg;
-
-export const tunnelConfigFromEnv = (): TunnelConfig | null =>
-  process.env.METRO_TUNNEL?.trim() === 'quick' ? { quick: true } : null;
+export const quickTunnelWanted = (): boolean =>
+  process.env.METRO_TUNNEL?.trim() === 'quick';
 
 const QUICK_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
 
@@ -61,17 +45,11 @@ async function untilResolvable(host: string, resolves: Resolves): Promise<boolea
   return false;
 }
 
-export function configuredTunnelHost(): string | null {
-  const cfg = loadTunnelConfig();
-  return cfg !== null && !isQuick(cfg) ? cfg.hostname : null;
-}
-
 export interface Endpoint {
   id: string;
   webhookId?: string;
   label: string;
   secret?: string;
-  session?: string;
   createdAt: string;
 }
 interface AccountRecord {
@@ -79,7 +57,6 @@ interface AccountRecord {
   webhookId?: unknown;
   label?: unknown;
   secret?: unknown;
-  session?: unknown;
   createdAt?: unknown;
 }
 
@@ -101,7 +78,6 @@ function toEndpoint(raw: AccountRecord): Endpoint | null {
     webhookId: str(raw.webhookId),
     label: str(raw.label) ?? id,
     secret: str(raw.secret),
-    session: str(raw.session),
     createdAt: str(raw.createdAt) ?? '',
   };
 }
@@ -125,76 +101,21 @@ export function tokenMatches(secret: string, given: string): boolean {
   return want.length === got.length && timingSafeEqual(want, got);
 }
 
-export function warnOnLegacyWebhooks(): void {
-  const legacy = readJson<{ endpoints?: unknown[] }>(LEGACY_WEBHOOKS_FILE, {});
-  const count = Array.isArray(legacy.endpoints) ? legacy.endpoints.length : 0;
-  if (count > 0)
-    log.warn(
-      { file: LEGACY_WEBHOOKS_FILE, endpoints: count },
-      'webhook: webhooks.json is no longer read — endpoints live in the accounts table; these endpoints are inactive',
-    );
-}
-
-export const loadTunnelConfig = (): TunnelConfig | null =>
-  readJson<TunnelConfig | null>(FILE, null, {
-    warn: 'tunnel.json: malformed, ignoring',
-  });
-
-function fetchTunnelToken(name: string): string | null {
-  const r = spawnSync('cloudflared', ['tunnel', 'token', name], {
-    encoding: 'utf8',
-  });
-  if (r.status !== 0) return null;
-  const token = r.stdout.trim();
-  return token.length > 0 ? token : null;
-}
-
-interface Plan {
-  args: string[];
-  env: NodeJS.ProcessEnv;
-  mode: string;
-}
-
 export class Tunnel {
   private child: ChildProcess | null = null;
   private closed = false;
-  private token: string | null | undefined = undefined;
 
   constructor(
-    private cfg: TunnelConfig,
     private port: number,
     private onUrl: (url: string) => void = () => undefined,
     private resolves: Resolves = resolvesAtCloudflare,
   ) {}
 
-  get hostname(): string {
-    if (!isQuick(this.cfg)) return this.cfg.hostname;
-    return liveUrl === null ? '' : new URL(liveUrl).host;
-  }
-
   private origin(): string {
     return `http://127.0.0.1:${String(this.port)}`;
   }
 
-  private plan(): Plan {
-    if (isQuick(this.cfg))
-      return {
-        args: ['--no-autoupdate', 'tunnel', '--url', this.origin()],
-        env: process.env,
-        mode: 'quick',
-      };
-    if (this.token === undefined) this.token = fetchTunnelToken(this.cfg.name);
-    const args = ['--no-autoupdate', 'tunnel', 'run', '--url', this.origin()];
-    if (!this.token) args.push(this.cfg.name);
-    return {
-      args,
-      env: this.token ? { ...process.env, TUNNEL_TOKEN: this.token } : process.env,
-      mode: this.token ? 'token' : 'named',
-    };
-  }
-
   private noticeUrl(text: string): void {
-    if (!isQuick(this.cfg)) return;
     const url = quickTunnelUrlIn(text);
     if (url === null || url === liveUrl) return;
     liveUrl = url;
@@ -213,15 +134,12 @@ export class Tunnel {
 
   start(): void {
     if (this.closed) return;
-    const plan = this.plan();
-    log.info(
-      { tunnel: isQuick(this.cfg) ? 'quick' : this.cfg.name, port: this.port, mode: plan.mode },
-      'cloudflared tunnel starting',
+    log.info({ port: this.port }, 'cloudflared quick tunnel starting');
+    const child = spawn(
+      'cloudflared',
+      ['--no-autoupdate', 'tunnel', '--url', this.origin()],
+      { stdio: ['ignore', 'pipe', 'pipe'] },
     );
-    const child = spawn('cloudflared', plan.args, {
-      stdio: ['ignore', 'pipe', 'pipe'],
-      env: plan.env,
-    });
     this.child = child;
     child.stderr?.on('data', (d: Buffer | string) => {
       const text = (typeof d === 'string' ? d : d.toString('utf8')).trim();

package/runtime/node_modules/@metro-labs/mcp/src/daemon/upload-api.ts

@@ -38,7 +38,7 @@ const VAGUE_MIMES = new Set([
 
 const mib = (n: number): string => `${Math.round(n / (1024 * 1024))} MiB`;
 
-export const uploadLimit = (): string =>
+const uploadLimit = (): string =>
   `${mib(MAX_UPLOAD_BYTES)} (${MAX_UPLOAD_BYTES} bytes)`;
 
 const tooLarge = (): string =>

package/runtime/node_modules/@metro-labs/mcp/src/daemon/version.ts

@@ -0,0 +1 @@
+export const METRO_VERSION = process.env.npm_package_version ?? '0.1.0-beta.15';

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-connectors.ts

@@ -56,7 +56,7 @@ export async function assertRenameFreeOfClash(
   if (clash !== null) throw nameClash(name, clash);
 }
 
-export async function connectorIdsOfAgent(agentId: string): Promise<string[]> {
+async function connectorIdsOfAgent(agentId: string): Promise<string[]> {
   const rows = await getDb()
     .select({ connectorId: agentConnectors.connectorId })
     .from(agentConnectors)