@stage-labs/metro 0.1.0-beta.75 → 0.1.0-beta.76

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.75",
+  "version": "0.1.0-beta.76",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/claude-api.ts

@@ -4,6 +4,15 @@ import { apiFailure, apiSession, cors, readJsonBody, sendJson } from './api-http
 import { ApiError } from './api-error.js';
 import { isRecord } from './is-record.js';
 import { listClaudeSettings, SETTINGS_MAX, writeClaudeSettings } from './claude-settings.js';
+import {
+  answerClaudeLogin,
+  claudeAccount,
+  claudeInstalled,
+  claudeLoginView,
+  endClaudeLogin,
+  startClaudeLogin,
+  type LoginDeps,
+} from './claude-login.js';
 import {
   claudeDir,
   deleteClaudeSession,
@@ -16,13 +25,14 @@ import {
 
 const PREFIX = '/api/claude';
 const BODY_MAX = SETTINGS_MAX + 4096;
-const WRITABLE = new Set(['GET', 'DELETE', 'PUT']);
+const WRITABLE = new Set(['GET', 'DELETE', 'PUT', 'POST']);
 const PAGE = 100;
 const PAGE_MAX = 500;
 
 export interface ClaudeApiDeps {
   authorize: (subject: string) => void;
   dir?: () => string;
+  login?: LoginDeps;
 }
 
 function projectOf(query: URLSearchParams): string {
@@ -65,17 +75,38 @@ async function writeAnswer(req: IncomingMessage, path: string, dir: string): Pro
   return writeClaudeSettings(item, body.text, seenAt, dir);
 }
 
+const LOGIN = 'login';
+
+async function loginAnswer(req: IncomingMessage, id: string, deps: ClaudeApiDeps): Promise<unknown> {
+  const method = req.method ?? 'GET';
+  if (id === '') {
+    if (method === 'POST') return startClaudeLogin(deps.login);
+    if (method === 'GET') return { available: claudeInstalled(), ...claudeAccount() };
+    throw new ApiError('method not allowed', 405);
+  }
+  if (method === 'GET') return claudeLoginView(id);
+  if (method === 'DELETE') return endClaudeLogin(id);
+  if (method !== 'POST') throw new ApiError('method not allowed', 405);
+  const body = await readJsonBody(req);
+  if (!isRecord(body) || typeof body.text !== 'string') throw new ApiError('text is required', 400);
+  return answerClaudeLogin(id, body.text);
+}
+
+function removed(rest: string[], query: URLSearchParams, dir: string): unknown {
+  const [head = '', item = ''] = rest;
+  if (rest.length !== 2 || head !== 'sessions') throw new ApiError('method not allowed', 405);
+  deleteClaudeSession(projectOf(query), item, dir);
+  return { deleted: item };
+}
+
 function answer(method: string, path: string, query: URLSearchParams, dir: string): unknown {
   const rest = parts(path);
-  const [head = '', item] = rest;
-  if (method === 'DELETE') {
-    if (rest.length !== 2 || head !== 'sessions') throw new ApiError('method not allowed', 405);
-    deleteClaudeSession(projectOf(query), item ?? '', dir);
-    return { deleted: item };
-  }
+  const [head = '', item = ''] = rest;
+  if (method === 'DELETE') return removed(rest, query, dir);
+  if (method !== 'GET') throw new ApiError('method not allowed', 405);
   const handler = rest.length === 1 ? COLLECTIONS[head] : rest.length === 2 ? ITEMS[head] : undefined;
   if (handler === undefined) throw new ApiError('no such route', 404);
-  return handler(query, dir, item ?? '');
+  return handler(query, dir, item);
 }
 
 export function handleClaudeRequest(
@@ -98,6 +129,8 @@ export function handleClaudeRequest(
       if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
       const dir = (deps.dir ?? claudeDir)();
+      const [head = '', item = ''] = parts(path);
+      if (head === LOGIN) return loginAnswer(req, item, deps);
       if (req.method === 'PUT') return writeAnswer(req, path, dir);
       return answer(req.method ?? 'GET', path, new URLSearchParams(search), dir);
     })

package/runtime/node_modules/@metro-labs/mcp/src/daemon/claude-login.ts

@@ -0,0 +1,167 @@
+import { randomBytes } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { ApiError } from './api-error.js';
+import { isRecord } from './is-record.js';
+import { errMsg, log } from './log.js';
+
+const LOGIN_COMMAND = ['claude', 'auth', 'login', '--claudeai'];
+const STATUS_COMMAND = ['auth', 'status', '--json'];
+const TTL_MS = 10 * 60_000;
+const OUTPUT_MAX = 8_000;
+const COLS = 100;
+const ROWS = 40;
+const ESC = String.fromCharCode(27);
+const CSI = /^\[[0-9;?]*[a-zA-Z]/;
+const URL_RE = /https:\/\/[^\s"'`]+/g;
+
+export type LoginState = 'pending' | 'done' | 'failed';
+
+export interface LoginView {
+  id: string;
+  state: LoginState;
+  url: string | null;
+  output: string;
+  error: string | null;
+}
+
+interface Live {
+  id: string;
+  startedAt: number;
+  state: LoginState;
+  output: string;
+  error: string | null;
+  write: (text: string) => void;
+  kill: () => void;
+}
+
+export interface LoginDeps {
+  command?: string[];
+}
+
+let live: Live | null = null;
+
+export function plainText(raw: string): string {
+  return raw
+    .split(ESC)
+    .map((part, index) => (index === 0 ? part : part.replace(CSI, '')))
+    .join('');
+}
+
+export function loginUrlIn(output: string): string | null {
+  const found = output.match(URL_RE) ?? [];
+  const trimmed = found.map((url) => url.replace(/[.,)]+$/, ''));
+  return trimmed.find((url) => url.includes('claude.ai') || url.includes('anthropic.com')) ?? trimmed[0] ?? null;
+}
+
+const view = (session: Live): LoginView => ({
+  id: session.id,
+  state: session.state,
+  url: loginUrlIn(session.output),
+  output: session.output,
+  error: session.error,
+});
+
+function sweep(now: number): void {
+  if (live !== null && live.state !== 'pending') return;
+  if (live !== null && now - live.startedAt > TTL_MS) {
+    live.kill();
+    live = null;
+  }
+}
+
+export function claudeInstalled(): boolean {
+  const run = spawnSync('claude', ['--version'], { stdio: 'ignore' });
+  return run.error === undefined && run.status === 0;
+}
+
+export function claudeAccount(): { signedIn: boolean; account: string | null } {
+  const run = spawnSync('claude', STATUS_COMMAND, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  if (run.error !== undefined || typeof run.stdout !== 'string') return { signedIn: false, account: null };
+  try {
+    const parsed: unknown = JSON.parse(run.stdout);
+    if (!isRecord(parsed)) return { signedIn: false, account: null };
+    const account = typeof parsed.email === 'string' ? parsed.email : typeof parsed.organization === 'string' ? parsed.organization : null;
+    return { signedIn: parsed.authenticated === true || parsed.loggedIn === true || account !== null, account };
+  } catch {
+    return { signedIn: false, account: null };
+  }
+}
+
+function note(session: Live, chunk: string): void {
+  const next = session.output + plainText(chunk);
+  session.output = next.length > OUTPUT_MAX ? next.slice(next.length - OUTPUT_MAX) : next;
+}
+
+export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now()): LoginView {
+  sweep(now);
+  if (live !== null && live.state === 'pending') return view(live);
+  const command = deps.command ?? LOGIN_COMMAND;
+  const session: Live = {
+    id: randomBytes(9).toString('base64url'),
+    startedAt: now,
+    state: 'pending',
+    output: '',
+    error: null,
+    write: () => undefined,
+    kill: () => undefined,
+  };
+  const terminal = new Bun.Terminal({
+    cols: COLS,
+    rows: ROWS,
+    data: (_term, chunk: Uint8Array) => {
+      note(session, Buffer.from(chunk).toString('utf8'));
+    },
+  });
+  const proc = Bun.spawn(command, { terminal, env: { ...process.env, TERM: 'xterm-256color' } });
+  session.write = (text: string) => {
+    terminal.write(Buffer.from(`${text}\r`, 'utf8'));
+  };
+  session.kill = () => {
+    proc.kill();
+    terminal.close();
+  };
+  proc.exited
+    .then((code) => {
+      session.state = code === 0 ? 'done' : 'failed';
+      if (code !== 0) session.error = `the login ended with status ${String(code)}`;
+      terminal.close();
+      log.info({ state: session.state }, 'claude-login: the official login finished');
+    })
+    .catch((err: unknown) => {
+      session.state = 'failed';
+      session.error = errMsg(err);
+    });
+  live = session;
+  log.info({ command: command[0] }, 'claude-login: started');
+  return view(session);
+}
+
+function current(id: string): Live {
+  const session = live;
+  if (session?.id !== id) throw new ApiError('that sign-in is over; start another one', 404);
+  return session;
+}
+
+export function claudeLoginView(id: string, now = Date.now()): LoginView {
+  sweep(now);
+  return view(current(id));
+}
+
+export function answerClaudeLogin(id: string, text: string): LoginView {
+  const session = current(id);
+  if (session.state !== 'pending') throw new ApiError('that sign-in has already finished', 409);
+  session.write(text);
+  return view(session);
+}
+
+export function endClaudeLogin(id: string): { ended: true } {
+  const session = current(id);
+  session.kill();
+  live = null;
+  return { ended: true };
+}
+
+export const forgetClaudeLogin = (): void => {
+  live?.kill();
+  live = null;
+};

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.75"
+  "version": "0.1.0-beta.76"
 }