@stage-labs/metro 0.1.0-beta.64 → 0.1.0-beta.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.64",
+  "version": "0.1.0-beta.65",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/http.ts

@@ -29,7 +29,7 @@ import { attachmentEventUrl, handleAttachRequest } from './attach-serve.js';
 import { webhookEntry } from '@metro-labs/webhook';
 import { handleIdentityRequest } from './identity-routes.js';
 import { attachTerminalSockets } from './terminal-ws.js';
-import { DEFAULT_TERMINAL_COMMAND } from './terminal-api.js';
+import { tmuxCommand } from './terminal-api.js';
 import { handleModeRequest } from './mode-api.js';
 import { handleUploadRequest } from './upload-api.js';
 import {
@@ -176,7 +176,7 @@ export async function startWebhookServer(
     });
   });
   if (apis.terminalApi !== undefined)
-    attachTerminalSockets(server, { command: apis.terminalApi.command ?? DEFAULT_TERMINAL_COMMAND });
+    attachTerminalSockets(server, { command: apis.terminalApi.command ?? tmuxCommand });
   await new Promise<void>((resolve, reject) => {
     server.once('error', reject);
     const host = process.env.METRO_HTTP_HOST ?? '127.0.0.1';

package/runtime/node_modules/@metro-labs/mcp/src/daemon/terminal-api.ts

@@ -1,27 +1,44 @@
 import { spawnSync } from 'node:child_process';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { ApiError } from './api-error.js';
-import { apiFailure, apiSession, cors, sendJson } from './api-http.js';
+import { apiFailure, apiSession, bodyField, cors, readJsonBody, sendJson } from './api-http.js';
 import { log } from './log.js';
 import { mintTerminalTicket } from './terminal-tickets.js';
 
 const PREFIX = '/api/terminal';
 const TICKETS = `${PREFIX}/tickets`;
 export const TMUX_SESSION = 'metro';
-export const DEFAULT_TERMINAL_COMMAND = ['tmux', 'new-session', '-A', '-s', TMUX_SESSION];
+const SESSION_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/;
+
+export const tmuxCommand = (session: string): string[] => ['tmux', 'new-session', '-A', '-D', '-s', session];
 
 export interface TerminalApiDeps {
   authorize: (subject: string) => void;
-  command?: string[];
+  command?: (session: string) => string[];
 }
 
-function tmuxAvailable(command: string[]): boolean {
-  const bin = command[0] ?? '';
-  if (bin !== 'tmux') return true;
+function tmuxAvailable(deps: TerminalApiDeps): boolean {
+  if (deps.command !== undefined) return true;
   const run = spawnSync('tmux', ['-V'], { stdio: 'ignore' });
   return run.error === undefined && run.status === 0;
 }
 
+export function tmuxSessions(): string[] {
+  const run = spawnSync('tmux', ['list-sessions', '-F', '#{session_name}'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  if (run.error !== undefined || run.status !== 0) return [];
+  return run.stdout
+    .split('\n')
+    .map((l) => l.trim())
+    .filter((l) => SESSION_RE.test(l));
+}
+
+export function sessionOf(raw: unknown): string {
+  if (raw === undefined || raw === null || raw === '') return TMUX_SESSION;
+  if (typeof raw !== 'string' || !SESSION_RE.test(raw))
+    throw new ApiError('a session name is 1 to 32 letters, digits, dots, dashes or underscores', 400);
+  return raw;
+}
+
 export function handleTerminalRequest(req: IncomingMessage, res: ServerResponse, deps: TerminalApiDeps): boolean {
   const path = (req.url ?? '').split('?')[0] ?? '';
   if (path !== PREFIX && path !== TICKETS) return false;
@@ -35,17 +52,17 @@ export function handleTerminalRequest(req: IncomingMessage, res: ServerResponse,
     return true;
   }
   apiSession(req)
-    .then((session) => {
+    .then(async (session) => {
       if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
-      const command = deps.command ?? DEFAULT_TERMINAL_COMMAND;
       if (path === PREFIX) {
-        sendJson(req, res, 200, { available: tmuxAvailable(command), session: TMUX_SESSION, command });
+        sendJson(req, res, 200, { available: tmuxAvailable(deps), session: TMUX_SESSION, sessions: tmuxSessions() });
         return;
       }
-      const minted = mintTerminalTicket(session.subject);
-      log.info({ subject: session.subject }, 'terminal: ticket minted');
-      sendJson(req, res, 200, { ...minted, path: `${PREFIX}/${minted.ticket}` });
+      const wanted = sessionOf(bodyField(await readJsonBody(req), 'session'));
+      const minted = mintTerminalTicket(session.subject, wanted);
+      log.info({ subject: session.subject, session: wanted }, 'terminal: ticket minted');
+      sendJson(req, res, 200, { ...minted, session: wanted, path: `${PREFIX}/${minted.ticket}` });
     })
     .catch((err: unknown) => {
       apiFailure(req, res, err, 'terminal-api');

package/runtime/node_modules/@metro-labs/mcp/src/daemon/terminal-tickets.ts

@@ -3,8 +3,12 @@ import { randomBytes } from 'node:crypto';
 const TTL_MS = 30_000;
 const MAX_OPEN = 20;
 
-interface Pending {
+export interface TerminalGrant {
   subject: string;
+  session: string;
+}
+
+interface Pending extends TerminalGrant {
   expiresAt: number;
 }
 
@@ -19,18 +23,18 @@ function prune(now: number): void {
   }
 }
 
-export function mintTerminalTicket(subject: string, now = Date.now()): { ticket: string; expiresAt: number } {
+export function mintTerminalTicket(subject: string, session: string, now = Date.now()): { ticket: string; expiresAt: number } {
   prune(now);
   const ticket = randomBytes(32).toString('base64url');
   const expiresAt = now + TTL_MS;
-  pending.set(ticket, { subject, expiresAt });
+  pending.set(ticket, { subject, session, expiresAt });
   return { ticket, expiresAt };
 }
 
-export function takeTerminalTicket(ticket: string, now = Date.now()): string | null {
+export function takeTerminalTicket(ticket: string, now = Date.now()): TerminalGrant | null {
   const entry = pending.get(ticket);
   pending.delete(ticket);
-  return entry !== undefined && entry.expiresAt > now ? entry.subject : null;
+  return entry !== undefined && entry.expiresAt > now ? { subject: entry.subject, session: entry.session } : null;
 }
 
 export const pendingTerminalTickets = (): number => pending.size;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/terminal-ws.ts

@@ -3,7 +3,7 @@ import type { Duplex } from 'node:stream';
 import { WebSocketServer, type RawData, type WebSocket } from 'ws';
 import { errMsg, log } from './log.js';
 import { isRecord } from './is-record.js';
-import { takeTerminalTicket } from './terminal-tickets.js';
+import { takeTerminalTicket, type TerminalGrant } from './terminal-tickets.js';
 
 const TICKET_PATH = /^\/api\/terminal\/([A-Za-z0-9_-]{43})$/;
 const MAX_MESSAGE = 1024 * 1024;
@@ -12,8 +12,8 @@ const DEFAULT_ROWS = 36;
 const MAX_DIMENSION = 500;
 
 export interface TerminalSocketDeps {
-  command: string[];
-  takeTicket?: (ticket: string) => string | null;
+  command: (session: string) => string[];
+  takeTicket?: (ticket: string) => TerminalGrant | null;
 }
 
 const rawBytes = (data: RawData): Buffer =>
@@ -79,13 +79,13 @@ export function attachTerminalSockets(server: Server, deps: TerminalSocketDeps):
       refuse(socket, 404, 'Not Found');
       return;
     }
-    const subject = take(found[1] ?? '');
-    if (subject === null) {
+    const grant = take(found[1] ?? '');
+    if (grant === null) {
       refuse(socket, 401, 'Unauthorized');
       return;
     }
     wss.handleUpgrade(req, socket, head, (ws) => {
-      runTerminal(ws, deps.command, subject);
+      runTerminal(ws, deps.command(grant.session), grant.subject);
     });
   });
 }

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.64"
+  "version": "0.1.0-beta.65"
 }