@stage-labs/metro 0.1.0-beta.74 → 0.1.0-beta.76

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.74",
+  "version": "0.1.0-beta.76",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/claude-api.ts

@@ -4,6 +4,15 @@ import { apiFailure, apiSession, cors, readJsonBody, sendJson } from './api-http
 import { ApiError } from './api-error.js';
 import { isRecord } from './is-record.js';
 import { listClaudeSettings, SETTINGS_MAX, writeClaudeSettings } from './claude-settings.js';
+import {
+  answerClaudeLogin,
+  claudeAccount,
+  claudeInstalled,
+  claudeLoginView,
+  endClaudeLogin,
+  startClaudeLogin,
+  type LoginDeps,
+} from './claude-login.js';
 import {
   claudeDir,
   deleteClaudeSession,
@@ -16,13 +25,14 @@ import {
 
 const PREFIX = '/api/claude';
 const BODY_MAX = SETTINGS_MAX + 4096;
-const WRITABLE = new Set(['GET', 'DELETE', 'PUT']);
+const WRITABLE = new Set(['GET', 'DELETE', 'PUT', 'POST']);
 const PAGE = 100;
 const PAGE_MAX = 500;
 
 export interface ClaudeApiDeps {
   authorize: (subject: string) => void;
   dir?: () => string;
+  login?: LoginDeps;
 }
 
 function projectOf(query: URLSearchParams): string {
@@ -65,17 +75,38 @@ async function writeAnswer(req: IncomingMessage, path: string, dir: string): Pro
   return writeClaudeSettings(item, body.text, seenAt, dir);
 }
 
+const LOGIN = 'login';
+
+async function loginAnswer(req: IncomingMessage, id: string, deps: ClaudeApiDeps): Promise<unknown> {
+  const method = req.method ?? 'GET';
+  if (id === '') {
+    if (method === 'POST') return startClaudeLogin(deps.login);
+    if (method === 'GET') return { available: claudeInstalled(), ...claudeAccount() };
+    throw new ApiError('method not allowed', 405);
+  }
+  if (method === 'GET') return claudeLoginView(id);
+  if (method === 'DELETE') return endClaudeLogin(id);
+  if (method !== 'POST') throw new ApiError('method not allowed', 405);
+  const body = await readJsonBody(req);
+  if (!isRecord(body) || typeof body.text !== 'string') throw new ApiError('text is required', 400);
+  return answerClaudeLogin(id, body.text);
+}
+
+function removed(rest: string[], query: URLSearchParams, dir: string): unknown {
+  const [head = '', item = ''] = rest;
+  if (rest.length !== 2 || head !== 'sessions') throw new ApiError('method not allowed', 405);
+  deleteClaudeSession(projectOf(query), item, dir);
+  return { deleted: item };
+}
+
 function answer(method: string, path: string, query: URLSearchParams, dir: string): unknown {
   const rest = parts(path);
-  const [head = '', item] = rest;
-  if (method === 'DELETE') {
-    if (rest.length !== 2 || head !== 'sessions') throw new ApiError('method not allowed', 405);
-    deleteClaudeSession(projectOf(query), item ?? '', dir);
-    return { deleted: item };
-  }
+  const [head = '', item = ''] = rest;
+  if (method === 'DELETE') return removed(rest, query, dir);
+  if (method !== 'GET') throw new ApiError('method not allowed', 405);
   const handler = rest.length === 1 ? COLLECTIONS[head] : rest.length === 2 ? ITEMS[head] : undefined;
   if (handler === undefined) throw new ApiError('no such route', 404);
-  return handler(query, dir, item ?? '');
+  return handler(query, dir, item);
 }
 
 export function handleClaudeRequest(
@@ -98,6 +129,8 @@ export function handleClaudeRequest(
       if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
       const dir = (deps.dir ?? claudeDir)();
+      const [head = '', item = ''] = parts(path);
+      if (head === LOGIN) return loginAnswer(req, item, deps);
       if (req.method === 'PUT') return writeAnswer(req, path, dir);
       return answer(req.method ?? 'GET', path, new URLSearchParams(search), dir);
     })

package/runtime/node_modules/@metro-labs/mcp/src/daemon/claude-login.ts

@@ -0,0 +1,167 @@
+import { randomBytes } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { ApiError } from './api-error.js';
+import { isRecord } from './is-record.js';
+import { errMsg, log } from './log.js';
+
+const LOGIN_COMMAND = ['claude', 'auth', 'login', '--claudeai'];
+const STATUS_COMMAND = ['auth', 'status', '--json'];
+const TTL_MS = 10 * 60_000;
+const OUTPUT_MAX = 8_000;
+const COLS = 100;
+const ROWS = 40;
+const ESC = String.fromCharCode(27);
+const CSI = /^\[[0-9;?]*[a-zA-Z]/;
+const URL_RE = /https:\/\/[^\s"'`]+/g;
+
+export type LoginState = 'pending' | 'done' | 'failed';
+
+export interface LoginView {
+  id: string;
+  state: LoginState;
+  url: string | null;
+  output: string;
+  error: string | null;
+}
+
+interface Live {
+  id: string;
+  startedAt: number;
+  state: LoginState;
+  output: string;
+  error: string | null;
+  write: (text: string) => void;
+  kill: () => void;
+}
+
+export interface LoginDeps {
+  command?: string[];
+}
+
+let live: Live | null = null;
+
+export function plainText(raw: string): string {
+  return raw
+    .split(ESC)
+    .map((part, index) => (index === 0 ? part : part.replace(CSI, '')))
+    .join('');
+}
+
+export function loginUrlIn(output: string): string | null {
+  const found = output.match(URL_RE) ?? [];
+  const trimmed = found.map((url) => url.replace(/[.,)]+$/, ''));
+  return trimmed.find((url) => url.includes('claude.ai') || url.includes('anthropic.com')) ?? trimmed[0] ?? null;
+}
+
+const view = (session: Live): LoginView => ({
+  id: session.id,
+  state: session.state,
+  url: loginUrlIn(session.output),
+  output: session.output,
+  error: session.error,
+});
+
+function sweep(now: number): void {
+  if (live !== null && live.state !== 'pending') return;
+  if (live !== null && now - live.startedAt > TTL_MS) {
+    live.kill();
+    live = null;
+  }
+}
+
+export function claudeInstalled(): boolean {
+  const run = spawnSync('claude', ['--version'], { stdio: 'ignore' });
+  return run.error === undefined && run.status === 0;
+}
+
+export function claudeAccount(): { signedIn: boolean; account: string | null } {
+  const run = spawnSync('claude', STATUS_COMMAND, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  if (run.error !== undefined || typeof run.stdout !== 'string') return { signedIn: false, account: null };
+  try {
+    const parsed: unknown = JSON.parse(run.stdout);
+    if (!isRecord(parsed)) return { signedIn: false, account: null };
+    const account = typeof parsed.email === 'string' ? parsed.email : typeof parsed.organization === 'string' ? parsed.organization : null;
+    return { signedIn: parsed.authenticated === true || parsed.loggedIn === true || account !== null, account };
+  } catch {
+    return { signedIn: false, account: null };
+  }
+}
+
+function note(session: Live, chunk: string): void {
+  const next = session.output + plainText(chunk);
+  session.output = next.length > OUTPUT_MAX ? next.slice(next.length - OUTPUT_MAX) : next;
+}
+
+export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now()): LoginView {
+  sweep(now);
+  if (live !== null && live.state === 'pending') return view(live);
+  const command = deps.command ?? LOGIN_COMMAND;
+  const session: Live = {
+    id: randomBytes(9).toString('base64url'),
+    startedAt: now,
+    state: 'pending',
+    output: '',
+    error: null,
+    write: () => undefined,
+    kill: () => undefined,
+  };
+  const terminal = new Bun.Terminal({
+    cols: COLS,
+    rows: ROWS,
+    data: (_term, chunk: Uint8Array) => {
+      note(session, Buffer.from(chunk).toString('utf8'));
+    },
+  });
+  const proc = Bun.spawn(command, { terminal, env: { ...process.env, TERM: 'xterm-256color' } });
+  session.write = (text: string) => {
+    terminal.write(Buffer.from(`${text}\r`, 'utf8'));
+  };
+  session.kill = () => {
+    proc.kill();
+    terminal.close();
+  };
+  proc.exited
+    .then((code) => {
+      session.state = code === 0 ? 'done' : 'failed';
+      if (code !== 0) session.error = `the login ended with status ${String(code)}`;
+      terminal.close();
+      log.info({ state: session.state }, 'claude-login: the official login finished');
+    })
+    .catch((err: unknown) => {
+      session.state = 'failed';
+      session.error = errMsg(err);
+    });
+  live = session;
+  log.info({ command: command[0] }, 'claude-login: started');
+  return view(session);
+}
+
+function current(id: string): Live {
+  const session = live;
+  if (session?.id !== id) throw new ApiError('that sign-in is over; start another one', 404);
+  return session;
+}
+
+export function claudeLoginView(id: string, now = Date.now()): LoginView {
+  sweep(now);
+  return view(current(id));
+}
+
+export function answerClaudeLogin(id: string, text: string): LoginView {
+  const session = current(id);
+  if (session.state !== 'pending') throw new ApiError('that sign-in has already finished', 409);
+  session.write(text);
+  return view(session);
+}
+
+export function endClaudeLogin(id: string): { ended: true } {
+  const session = current(id);
+  session.kill();
+  live = null;
+  return { ended: true };
+}
+
+export const forgetClaudeLogin = (): void => {
+  live?.kill();
+  live = null;
+};

package/runtime/node_modules/@metro-labs/mcp/src/gateway/forward.ts

@@ -113,6 +113,19 @@ export function forwardedHeaders(req: IncomingMessage): Record<string, string> {
   return out;
 }
 
+export function anthropicHeaders(req: IncomingMessage, apiKey: string): Record<string, string> {
+  const headers = forwardedHeaders(req);
+  delete headers.authorization;
+  const betas = (headers['anthropic-beta'] ?? '')
+    .split(',')
+    .map((beta) => beta.trim())
+    .filter((beta) => beta !== '' && !beta.includes('oauth'));
+  if (betas.length > 0) headers['anthropic-beta'] = betas.join(',');
+  else delete headers['anthropic-beta'];
+  headers['x-api-key'] = apiKey;
+  return headers;
+}
+
 export interface PipeOptions {
   keepalive?: boolean;
   ownCredential?: boolean;

package/runtime/node_modules/@metro-labs/mcp/src/gateway/gateway.ts

@@ -9,7 +9,7 @@ import {
   freshAdaptations,
   type Adaptations,
 } from './bedrock.js';
-import { forwardedHeaders, GatewayError, parseJson, pipeResponse, readBody, sendError, watchUpstream } from './forward.js';
+import { anthropicHeaders, forwardedHeaders, GatewayError, parseJson, pipeResponse, readBody, sendError, watchUpstream } from './forward.js';
 import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, writeModelConfig, type ModelConfig, type Route } from './model-config.js';
 import { codexCount, codexMessages, freshCodexState, type CodexDeps } from './codex.js';
 import { OPENROUTER_BASE } from './openrouter.js';
@@ -82,14 +82,15 @@ async function toAnthropic(
   const payload = explicit ? Buffer.from(JSON.stringify({ ...body, model: route.model })) : raw;
   const url = `${deps.anthropicBase ?? ANTHROPIC_BASE}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
   const watch = watchUpstream(res);
+  const key = deps.config().anthropic.apiKey;
   const upstream = await fetch(url, {
     method: 'POST',
-    headers: forwardedHeaders(req),
+    headers: key === '' ? forwardedHeaders(req) : anthropicHeaders(req, key),
     body: new Uint8Array(payload),
     signal: watch.signal,
     redirect: 'manual',
   });
-  await pipeResponse(upstream, res, watch);
+  await pipeResponse(upstream, res, watch, key === '' ? {} : { ownCredential: true });
 }
 
 async function toOpenRouter(

package/runtime/node_modules/@metro-labs/mcp/src/gateway/model-config.ts

@@ -7,6 +7,11 @@ import type { CodexTokens } from './codex-auth.js';
 export const PROVIDERS = ['anthropic', 'bedrock', 'openrouter', 'codex'] as const;
 export type Provider = (typeof PROVIDERS)[number];
 
+export interface AnthropicSettings {
+  apiKey: string;
+  model: string;
+}
+
 export interface BedrockSettings {
   region: string;
   apiKey: string;
@@ -26,6 +31,7 @@ export interface CodexSettings {
 export interface ModelConfig {
   version: 1;
   provider: Provider;
+  anthropic: AnthropicSettings;
   bedrock: BedrockSettings;
   openrouter: OpenRouterSettings;
   codex: CodexSettings;
@@ -41,10 +47,12 @@ export class ModelConfigError extends Error {}
 export const MODEL_FILE = 'model.json';
 const MAX_FIELD = 512;
 const PREFIX_RE = /^(anthropic|bedrock|openrouter|codex):(.+)$/;
+const SMALL_RE = /haiku/i;
 
 const empty = (): ModelConfig => ({
   version: 1,
   provider: 'anthropic',
+  anthropic: { apiKey: '', model: '' },
   bedrock: { region: '', apiKey: '', model: '' },
   openrouter: { apiKey: '', model: '' },
   codex: { model: '', auth: null },
@@ -76,12 +84,14 @@ function tokensFromDisk(raw: unknown): CodexTokens | null {
 function fromDisk(raw: unknown): ModelConfig {
   const base = empty();
   if (!isRecord(raw)) return base;
+  const anthropic = isRecord(raw.anthropic) ? raw.anthropic : {};
   const bedrock = isRecord(raw.bedrock) ? raw.bedrock : {};
   const openrouter = isRecord(raw.openrouter) ? raw.openrouter : {};
   const codex = isRecord(raw.codex) ? raw.codex : {};
   return {
     version: 1,
     provider: isProvider(raw.provider) ? raw.provider : 'anthropic',
+    anthropic: { apiKey: text(anthropic.apiKey), model: text(anthropic.model) },
     bedrock: { region: text(bedrock.region), apiKey: text(bedrock.apiKey), model: text(bedrock.model) },
     openrouter: { apiKey: text(openrouter.apiKey), model: text(openrouter.model) },
     codex: { model: text(codex.model), auth: tokensFromDisk(codex.auth) },
@@ -108,12 +118,17 @@ export function applyModelUpdate(cfg: ModelConfig, patch: unknown): ModelConfig
   if (!isRecord(patch)) throw new ModelConfigError('body must be a JSON object');
   const provider = 'provider' in patch ? patch.provider : cfg.provider;
   if (!isProvider(provider)) throw new ModelConfigError(`provider must be one of ${PROVIDERS.join(', ')}`);
+  const anthropic = isRecord(patch.anthropic) ? patch.anthropic : {};
   const bedrock = isRecord(patch.bedrock) ? patch.bedrock : {};
   const openrouter = isRecord(patch.openrouter) ? patch.openrouter : {};
   const codex = isRecord(patch.codex) ? patch.codex : {};
   return {
     version: 1,
     provider,
+    anthropic: {
+      apiKey: field(anthropic, 'apiKey', cfg.anthropic.apiKey, 'Anthropic API key'),
+      model: field(anthropic, 'model', cfg.anthropic.model, 'Anthropic model'),
+    },
     bedrock: {
       region: field(bedrock, 'region', cfg.bedrock.region, 'Bedrock region'),
       apiKey: field(bedrock, 'apiKey', cfg.bedrock.apiKey, 'Bedrock API key'),
@@ -155,17 +170,20 @@ export function publicModelConfig(cfg: ModelConfig): Record<string, unknown> {
     provider: cfg.provider,
     ready: notReady(cfg) === null,
     reason: notReady(cfg),
+    anthropic: { model: cfg.anthropic.model, hasKey: cfg.anthropic.apiKey !== '' },
     bedrock: { region: cfg.bedrock.region, model: cfg.bedrock.model, hasKey: cfg.bedrock.apiKey !== '' },
     openrouter: { model: cfg.openrouter.model, hasKey: cfg.openrouter.apiKey !== '' },
     codex: { model: cfg.codex.model, signedIn: auth !== null, account: auth?.email ?? null, plan: auth?.plan ?? null },
   };
 }
 
+export const isSmallModel = (requested: string): boolean => SMALL_RE.test(requested);
+
 function defaultModelFor(provider: Provider, requested: string, cfg: ModelConfig): string {
   if (provider === 'openrouter') return requested.includes('/') ? requested : cfg.openrouter.model;
   if (provider === 'bedrock') return cfg.bedrock.model === '' ? requested : cfg.bedrock.model;
   if (provider === 'codex') return requested.startsWith('gpt-') ? requested : cfg.codex.model;
-  return requested;
+  return cfg.anthropic.model === '' || isSmallModel(requested) ? requested : cfg.anthropic.model;
 }
 
 export function resolveRoute(requested: string, cfg: ModelConfig): Route {

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.74"
+  "version": "0.1.0-beta.76"
 }