@stage-labs/metro 0.1.0-beta.71 → 0.1.0-beta.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.71",
+  "version": "0.1.0-beta.73",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/claude-api.ts

@@ -1,7 +1,9 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from './log.js';
-import { apiFailure, apiSession, cors, sendJson } from './api-http.js';
+import { apiFailure, apiSession, cors, readJsonBody, sendJson } from './api-http.js';
 import { ApiError } from './api-error.js';
+import { isRecord } from './is-record.js';
+import { listClaudeSettings, SETTINGS_MAX, writeClaudeSettings } from './claude-settings.js';
 import {
   claudeDir,
   deleteClaudeSession,
@@ -13,6 +15,8 @@ import {
 } from './claude-files.js';
 
 const PREFIX = '/api/claude';
+const BODY_MAX = SETTINGS_MAX + 4096;
+const WRITABLE = new Set(['GET', 'DELETE', 'PUT']);
 const PAGE = 100;
 const PAGE_MAX = 500;
 
@@ -39,6 +43,7 @@ const COLLECTIONS: Record<string, Handler> = {
   projects: (_query, dir) => ({ projects: listClaudeProjects(dir) }),
   sessions: (query, dir) => ({ sessions: listClaudeSessions(projectOf(query), dir) }),
   memory: (query, dir) => listMemory(projectOf(query), dir),
+  settings: (_query, dir) => ({ files: listClaudeSettings(dir) }),
 };
 
 const ITEMS: Record<string, Handler> = {
@@ -49,8 +54,19 @@ const ITEMS: Record<string, Handler> = {
   memory: (query, dir, name) => ({ name, content: readMemoryFile(projectOf(query), name, dir) }),
 };
 
+const parts = (path: string): string[] => path.slice(PREFIX.length + 1).split('/').filter(Boolean);
+
+async function writeAnswer(req: IncomingMessage, path: string, dir: string): Promise<unknown> {
+  const [head = '', item = ''] = parts(path);
+  if (head !== 'settings' || item === '') throw new ApiError('method not allowed', 405);
+  const body = await readJsonBody(req, BODY_MAX);
+  if (!isRecord(body) || typeof body.text !== 'string') throw new ApiError('text is required', 400);
+  const seenAt = 'seenAt' in body ? (typeof body.seenAt === 'string' ? body.seenAt : null) : undefined;
+  return writeClaudeSettings(item, body.text, seenAt, dir);
+}
+
 function answer(method: string, path: string, query: URLSearchParams, dir: string): unknown {
-  const rest = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
+  const rest = parts(path);
   const [head = '', item] = rest;
   if (method === 'DELETE') {
     if (rest.length !== 2 || head !== 'sessions') throw new ApiError('method not allowed', 405);
@@ -73,7 +89,7 @@ export function handleClaudeRequest(
     res.writeHead(204, cors(req)).end();
     return true;
   }
-  if (req.method !== 'GET' && req.method !== 'DELETE') {
+  if (!WRITABLE.has(req.method ?? '')) {
     sendJson(req, res, 405, { error: 'method not allowed' });
     return true;
   }
@@ -81,7 +97,9 @@ export function handleClaudeRequest(
     .then((session) => {
       if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
-      return answer(req.method ?? 'GET', path, new URLSearchParams(search), (deps.dir ?? claudeDir)());
+      const dir = (deps.dir ?? claudeDir)();
+      if (req.method === 'PUT') return writeAnswer(req, path, dir);
+      return answer(req.method ?? 'GET', path, new URLSearchParams(search), dir);
     })
     .then((body) => {
       sendJson(req, res, 200, body);

package/runtime/node_modules/@metro-labs/mcp/src/daemon/claude-settings.ts

@@ -0,0 +1,117 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { ApiError } from './api-error.js';
+import { claudeDir, listClaudeProjects } from './claude-files.js';
+import { isRecord } from './is-record.js';
+import { errMsg } from './log.js';
+
+export const SETTINGS_MAX = 256 * 1024;
+const USER_ID = 'user';
+const LOCAL_SUFFIX = '.local';
+const DEFAULT_MODE = 0o644;
+
+export type SettingsScope = 'user' | 'project' | 'local';
+
+export interface ClaudeSettingsFile {
+  id: string;
+  scope: SettingsScope;
+  label: string;
+  path: string;
+  exists: boolean;
+  editable: boolean;
+  text: string;
+  modifiedAt: string | null;
+}
+
+const missing = (id: string, scope: SettingsScope, label: string, path: string): ClaudeSettingsFile => ({
+  id,
+  scope,
+  label,
+  path,
+  exists: false,
+  editable: true,
+  text: '',
+  modifiedAt: null,
+});
+
+function entryOf(id: string, scope: SettingsScope, label: string, path: string): ClaudeSettingsFile {
+  if (!existsSync(path)) return missing(id, scope, label, path);
+  const stat = statSync(path);
+  const editable = stat.size <= SETTINGS_MAX;
+  return {
+    id,
+    scope,
+    label,
+    path,
+    exists: true,
+    editable,
+    text: editable ? readFileSync(path, 'utf8') : '',
+    modifiedAt: stat.mtime.toISOString(),
+  };
+}
+
+const PROJECT_FILES: [string, SettingsScope, string][] = [
+  ['', 'project', 'settings.json'],
+  [LOCAL_SUFFIX, 'local', 'settings.local.json'],
+];
+
+function projectEntries(dir: string): ClaudeSettingsFile[] {
+  const out: ClaudeSettingsFile[] = [];
+  for (const project of listClaudeProjects(dir)) {
+    const cwd = project.cwd;
+    if (cwd === null) continue;
+    for (const [suffix, scope, name] of PROJECT_FILES) {
+      const path = join(cwd, '.claude', name);
+      if (existsSync(path)) out.push(entryOf(`${project.id}${suffix}`, scope, cwd, path));
+    }
+  }
+  return out;
+}
+
+export function listClaudeSettings(dir = claudeDir()): ClaudeSettingsFile[] {
+  return [entryOf(USER_ID, 'user', 'This machine', join(dir, 'settings.json')), ...projectEntries(dir)];
+}
+
+function assertSettingsJson(text: string): void {
+  if (text.length > SETTINGS_MAX) throw new ApiError('that is more text than a settings file may hold', 413);
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    throw new ApiError(`that is not valid JSON: ${errMsg(err)}`, 400);
+  }
+  if (!isRecord(parsed)) throw new ApiError('Claude Code settings must be a JSON object', 400);
+}
+
+function modeOf(path: string): number {
+  try {
+    return statSync(path).mode & 0o777;
+  } catch {
+    return DEFAULT_MODE;
+  }
+}
+
+function writeAtomic(path: string, text: string): void {
+  const mode = existsSync(path) ? modeOf(path) : DEFAULT_MODE;
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.metro-${String(process.pid)}`;
+  writeFileSync(tmp, text, { mode });
+  chmodSync(tmp, mode);
+  renameSync(tmp, path);
+}
+
+export function writeClaudeSettings(
+  id: string,
+  text: string,
+  seenAt: string | null | undefined,
+  dir = claudeDir(),
+): ClaudeSettingsFile {
+  const target = listClaudeSettings(dir).find((file) => file.id === id);
+  if (target === undefined) throw new ApiError('no such settings file', 404);
+  if (!target.editable) throw new ApiError('that settings file is too large to edit here', 409);
+  assertSettingsJson(text);
+  if (seenAt !== undefined && seenAt !== target.modifiedAt)
+    throw new ApiError('that file changed on disk since you opened it; reload it before saving', 409);
+  writeAtomic(target.path, text);
+  return entryOf(target.id, target.scope, target.label, target.path);
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/model-api.ts

@@ -6,6 +6,7 @@ import { log } from './log.js';
 import { beginLogin, CodexAuthError, finishLogin, readCodexCliAuth } from '../gateway/codex-auth.js';
 import { beginDeviceLogin, pollDeviceLogin } from '../gateway/codex-device.js';
 import { codexModels, currentTokens, freshCodexState } from '../gateway/codex.js';
+import { openrouterModels } from '../gateway/openrouter.js';
 import type { CodexTokens } from '../gateway/codex-auth.js';
 import { GatewayError } from '../gateway/forward.js';
 import {
@@ -20,6 +21,7 @@ import {
 
 const PATH = '/api/model';
 const CODEX = '/api/model/codex/';
+const OPENROUTER = '/api/model/openrouter/';
 const BODY_MAX = 16 * 1024;
 const DEVICE_PREFIX = 'device/';
 const DEVICE_ID_RE = /^[A-Za-z0-9_-]{16,64}$/;
@@ -32,6 +34,7 @@ export interface ModelApiDeps {
   fetchImpl?: typeof fetch;
   codexHome?: string;
   codexBase?: string;
+  openrouterBase?: string;
 }
 
 interface Store {
@@ -129,23 +132,43 @@ const CODEX_ROUTES: Record<string, Route> = {
   },
 };
 
-function routeFor(path: string, method: string | undefined): Route | number {
-  if (path === PATH) {
-    if (method === 'GET') return { method: 'GET', run: (_req, _deps, store) => Promise.resolve(publicModelConfig(store.read())) };
-    if (method === 'PUT') return { method: 'POST', run: (req, _deps, store) => update(req, store) };
-    return 405;
-  }
-  const rest = path.slice(CODEX.length);
-  const route = CODEX_ROUTES[rest];
-  if (route !== undefined) return route.method === method ? route : 405;
+const OPENROUTER_ROUTES: Record<string, Route> = {
+  models: {
+    method: 'GET',
+    run: async (_req, deps) => ({ models: await openrouterModels(deps.openrouterBase, deps.fetchImpl).catch(asApiError) }),
+  },
+};
+
+const named = (table: Record<string, Route>, name: string, method: string | undefined): Route | number => {
+  const route = table[name];
+  if (route === undefined) return 404;
+  return route.method === method ? route : 405;
+};
+
+function settingsRoute(method: string | undefined): Route | number {
+  if (method === 'GET') return { method: 'GET', run: (_req, _deps, store) => Promise.resolve(publicModelConfig(store.read())) };
+  if (method === 'PUT') return { method: 'POST', run: (req, _deps, store) => update(req, store) };
+  return 405;
+}
+
+function codexRoute(rest: string, method: string | undefined): Route | number {
+  if (rest in CODEX_ROUTES) return named(CODEX_ROUTES, rest, method);
   const id = rest.startsWith(DEVICE_PREFIX) ? rest.slice(DEVICE_PREFIX.length) : '';
   if (!DEVICE_ID_RE.test(id)) return 404;
   return method === 'GET' ? { method: 'GET', run: (_req, deps, store) => pollDevice(id, deps, store) } : 405;
 }
 
+const mine = (path: string): boolean => path === PATH || path.startsWith(CODEX) || path.startsWith(OPENROUTER);
+
+function routeFor(path: string, method: string | undefined): Route | number {
+  if (path === PATH) return settingsRoute(method);
+  if (path.startsWith(OPENROUTER)) return named(OPENROUTER_ROUTES, path.slice(OPENROUTER.length), method);
+  return codexRoute(path.slice(CODEX.length), method);
+}
+
 export function handleModelRequest(req: IncomingMessage, res: ServerResponse, deps: ModelApiDeps): boolean {
   const path = (req.url ?? '').split('?')[0] ?? '';
-  if (path !== PATH && !path.startsWith(CODEX)) return false;
+  if (!mine(path)) return false;
   if (req.method === 'OPTIONS') {
     res.writeHead(204, cors(req)).end();
     return true;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/terminal-ws.ts

@@ -34,12 +34,22 @@ function sizeTmuxWindow(command: string[], session: string, cols: number, rows:
   if (command[0] !== 'tmux') return;
   const child = spawn('tmux', resizeWindowArgs(session, cols, rows), { stdio: 'ignore' });
   child.on('error', (err) => {
-    log.debug({ err: errMsg(err) }, 'terminal: resize-window failed');
+    log.warn({ err: errMsg(err) }, 'terminal: resize-window could not run');
+  });
+  child.on('exit', (code) => {
+    if (code !== 0) log.warn({ code, session, cols, rows }, 'terminal: tmux refused the window resize');
   });
 }
 
-const dimension = (raw: unknown, fallback: number): number =>
-  typeof raw === 'number' && Number.isInteger(raw) && raw > 1 && raw <= MAX_DIMENSION ? raw : fallback;
+const dimension = (raw: unknown): number | null =>
+  typeof raw === 'number' && Number.isInteger(raw) && raw > 1 && raw <= MAX_DIMENSION ? raw : null;
+
+export function sizeFrom(control: unknown): { cols: number; rows: number } | null {
+  if (!isRecord(control)) return null;
+  const cols = dimension(control.cols);
+  const rows = dimension(control.rows);
+  return cols === null || rows === null ? null : { cols, rows };
+}
 
 function runTerminal(ws: WebSocket, command: string[], subject: string, session: string): void {
   const terminal = new Bun.Terminal({
@@ -61,12 +71,11 @@ function runTerminal(ws: WebSocket, command: string[], subject: string, session:
       return;
     }
     try {
-      const control: unknown = JSON.parse(bytes.toString('utf8'));
-      if (isRecord(control) && 'cols' in control) {
-        const cols = dimension(control.cols, DEFAULT_COLS);
-        const rows = dimension(control.rows, DEFAULT_ROWS);
-        terminal.resize(cols, rows);
-        sizeTmuxWindow(command, session, cols, rows);
+      const size = sizeFrom(JSON.parse(bytes.toString('utf8')));
+      if (size !== null) {
+        terminal.resize(size.cols, size.rows);
+        proc.kill('SIGWINCH');
+        sizeTmuxWindow(command, session, size.cols, size.rows);
       }
     } catch (err) {
       log.warn({ err: errMsg(err) }, 'terminal: bad control frame');

package/runtime/node_modules/@metro-labs/mcp/src/gateway/codex.ts

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { arch, platform, release } from 'node:os';
 import { isRecord } from '../daemon/is-record.js';
-import { errMsg } from '../daemon/log.js';
+import { errMsg, log } from '../daemon/log.js';
 import { refreshTokens, tokensStale, type CodexTokens } from './codex-auth.js';
 import { assembleMessage, CodexEventTranslator, parseEvent, SseParser } from './codex-stream.js';
 import { ToolNames, toResponsesRequest } from './codex-translate.js';
@@ -10,7 +10,8 @@ import { GatewayError, idleMessage, providerStatus, sendError, upstreamMessage,
 import type { ModelConfig } from './model-config.js';
 
 export const CODEX_BASE = 'https://chatgpt.com/backend-api/codex';
-const CODEX_VERSION = '0.104.0';
+const CODEX_VERSION = '0.153.4';
+const VERSION_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.]+)?$/;
 const PING_MS = 25_000;
 const STATUS_OF: Record<string, number> = { rate_limit_error: 429, invalid_request_error: 400, permission_error: 403, overloaded_error: 529 };
 
@@ -30,7 +31,15 @@ export const freshCodexState = (): CodexState => ({ refreshing: null, latest: nu
 
 const OS_NAMES: Record<string, string> = { darwin: 'Mac OS', linux: 'Linux', win32: 'Windows' };
 
-export const userAgent = (): string => `codex_cli_rs/${CODEX_VERSION} (${OS_NAMES[platform()] ?? platform()} ${release()}; ${arch()}) metro`;
+export function codexVersion(): string {
+  const wanted = process.env.METRO_CODEX_VERSION?.trim() ?? '';
+  if (wanted === '') return CODEX_VERSION;
+  if (VERSION_RE.test(wanted)) return wanted;
+  log.warn({ value: wanted }, 'gateway: METRO_CODEX_VERSION is not a version like 0.153.4; using the built-in one');
+  return CODEX_VERSION;
+}
+
+export const userAgent = (): string => `codex_cli_rs/${codexVersion()} (${OS_NAMES[platform()] ?? platform()} ${release()}; ${arch()}) metro`;
 
 function headersFor(tokens: CodexTokens, sessionId: string): Record<string, string> {
   return {
@@ -192,7 +201,7 @@ export function codexCount(res: ServerResponse, body: Record<string, unknown>):
 }
 
 export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'save'>): Promise<string[]> {
-  const res = await (deps.fetchImpl ?? fetch)(`${deps.base ?? CODEX_BASE}/models?client_version=${CODEX_VERSION}`, {
+  const res = await (deps.fetchImpl ?? fetch)(`${deps.base ?? CODEX_BASE}/models?client_version=${codexVersion()}`, {
     headers: { ...headersFor(tokens, randomUUID()), accept: 'application/json' },
     redirect: 'manual',
   });

package/runtime/node_modules/@metro-labs/mcp/src/gateway/gateway.ts

@@ -12,11 +12,11 @@ import {
 import { forwardedHeaders, GatewayError, parseJson, pipeResponse, readBody, sendError, watchUpstream } from './forward.js';
 import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, writeModelConfig, type ModelConfig, type Route } from './model-config.js';
 import { codexCount, codexMessages, freshCodexState, type CodexDeps } from './codex.js';
+import { OPENROUTER_BASE } from './openrouter.js';
 import type { CodexTokens } from './codex-auth.js';
 
 export const GATEWAY_PREFIX = '/gateway';
 export const ANTHROPIC_BASE = 'https://api.anthropic.com';
-export const OPENROUTER_BASE = 'https://openrouter.ai/api';
 const MESSAGES = '/v1/messages';
 const COUNT = '/v1/messages/count_tokens';
 const MODELS = '/v1/models';

package/runtime/node_modules/@metro-labs/mcp/src/gateway/openrouter.ts

@@ -0,0 +1,31 @@
+import { GatewayError } from './forward.js';
+
+export const OPENROUTER_BASE = 'https://openrouter.ai/api';
+const MODELS_MAX = 2000;
+
+export interface OpenRouterModel {
+  id: string;
+  name: string;
+}
+
+const str = (value: unknown): string => (typeof value === 'string' ? value : '');
+
+function modelOf(entry: unknown): OpenRouterModel | null {
+  if (typeof entry !== 'object' || entry === null) return null;
+  const row = entry as { id?: unknown; name?: unknown };
+  const id = str(row.id);
+  return id === '' ? null : { id, name: str(row.name) || id };
+}
+
+export async function openrouterModels(base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<OpenRouterModel[]> {
+  const res = await fetchImpl(`${base}/v1/models`, { headers: { accept: 'application/json' }, redirect: 'manual' });
+  if (!res.ok) throw new GatewayError(res.status, 'api_error', `OpenRouter would not list its models (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const data = typeof body === 'object' && body !== null ? (body as { data?: unknown }).data : undefined;
+  if (!Array.isArray(data)) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no model list');
+  return data
+    .map(modelOf)
+    .filter((model): model is OpenRouterModel => model !== null)
+    .slice(0, MODELS_MAX)
+    .sort((a, b) => a.id.localeCompare(b.id));
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.71"
+  "version": "0.1.0-beta.73"
 }