@stage-labs/metro 0.1.0-beta.75 → 0.1.0-beta.77

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/claude-api.ts → daemon/src/claude/api.ts}

@@ -1,9 +1,18 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
-import { apiFailure, apiSession, cors, readJsonBody, sendJson } from './api-http.js';
-import { ApiError } from './api-error.js';
-import { isRecord } from './is-record.js';
-import { listClaudeSettings, SETTINGS_MAX, writeClaudeSettings } from './claude-settings.js';
+import { errMsg, log } from '@metro-labs/core/log';
+import { apiFailure, apiSession, cors, readJsonBody, sendJson } from '@metro-labs/http/api-http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { isRecord } from '@metro-labs/core/is-record';
+import { listClaudeSettings, SETTINGS_MAX, writeClaudeSettings } from './settings.js';
+import {
+  answerClaudeLogin,
+  claudeAccount,
+  claudeInstalled,
+  claudeLoginView,
+  endClaudeLogin,
+  startClaudeLogin,
+  type LoginDeps,
+} from './login.js';
 import {
   claudeDir,
   deleteClaudeSession,
@@ -12,17 +21,18 @@ import {
   listMemory,
   readMemoryFile,
   readTranscript,
-} from './claude-files.js';
+} from './files.js';
 
 const PREFIX = '/api/claude';
 const BODY_MAX = SETTINGS_MAX + 4096;
-const WRITABLE = new Set(['GET', 'DELETE', 'PUT']);
+const WRITABLE = new Set(['GET', 'DELETE', 'PUT', 'POST']);
 const PAGE = 100;
 const PAGE_MAX = 500;
 
 export interface ClaudeApiDeps {
   authorize: (subject: string) => void;
   dir?: () => string;
+  login?: LoginDeps;
 }
 
 function projectOf(query: URLSearchParams): string {
@@ -65,17 +75,38 @@ async function writeAnswer(req: IncomingMessage, path: string, dir: string): Pro
   return writeClaudeSettings(item, body.text, seenAt, dir);
 }
 
+const LOGIN = 'login';
+
+async function loginAnswer(req: IncomingMessage, id: string, deps: ClaudeApiDeps): Promise<unknown> {
+  const method = req.method ?? 'GET';
+  if (id === '') {
+    if (method === 'POST') return startClaudeLogin(deps.login);
+    if (method === 'GET') return { available: claudeInstalled(), ...claudeAccount() };
+    throw new ApiError('method not allowed', 405);
+  }
+  if (method === 'GET') return claudeLoginView(id);
+  if (method === 'DELETE') return endClaudeLogin(id);
+  if (method !== 'POST') throw new ApiError('method not allowed', 405);
+  const body = await readJsonBody(req);
+  if (!isRecord(body) || typeof body.text !== 'string') throw new ApiError('text is required', 400);
+  return answerClaudeLogin(id, body.text);
+}
+
+function removed(rest: string[], query: URLSearchParams, dir: string): unknown {
+  const [head = '', item = ''] = rest;
+  if (rest.length !== 2 || head !== 'sessions') throw new ApiError('method not allowed', 405);
+  deleteClaudeSession(projectOf(query), item, dir);
+  return { deleted: item };
+}
+
 function answer(method: string, path: string, query: URLSearchParams, dir: string): unknown {
   const rest = parts(path);
-  const [head = '', item] = rest;
-  if (method === 'DELETE') {
-    if (rest.length !== 2 || head !== 'sessions') throw new ApiError('method not allowed', 405);
-    deleteClaudeSession(projectOf(query), item ?? '', dir);
-    return { deleted: item };
-  }
+  const [head = '', item = ''] = rest;
+  if (method === 'DELETE') return removed(rest, query, dir);
+  if (method !== 'GET') throw new ApiError('method not allowed', 405);
   const handler = rest.length === 1 ? COLLECTIONS[head] : rest.length === 2 ? ITEMS[head] : undefined;
   if (handler === undefined) throw new ApiError('no such route', 404);
-  return handler(query, dir, item ?? '');
+  return handler(query, dir, item);
 }
 
 export function handleClaudeRequest(
@@ -98,6 +129,8 @@ export function handleClaudeRequest(
       if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
       const dir = (deps.dir ?? claudeDir)();
+      const [head = '', item = ''] = parts(path);
+      if (head === LOGIN) return loginAnswer(req, item, deps);
       if (req.method === 'PUT') return writeAnswer(req, path, dir);
       return answer(req.method ?? 'GET', path, new URLSearchParams(search), dir);
     })

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/claude-files.ts → daemon/src/claude/files.ts}

@@ -11,8 +11,8 @@ import {
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { createInterface } from 'node:readline';
-import { ApiError } from './api-error.js';
-import { isRecord } from './is-record.js';
+import { ApiError } from '@metro-labs/http/api-error';
+import { isRecord } from '@metro-labs/core/is-record';
 
 const PROJECT_RE = /^[A-Za-z0-9._-]{1,200}$/;
 const SESSION_RE = /^[A-Za-z0-9][A-Za-z0-9-]{7,63}$/;

package/runtime/node_modules/@metro-labs/daemon/src/claude/login.ts

@@ -0,0 +1,167 @@
+import { randomBytes } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { ApiError } from '@metro-labs/http/api-error';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+
+const LOGIN_COMMAND = ['claude', 'auth', 'login', '--claudeai'];
+const STATUS_COMMAND = ['auth', 'status', '--json'];
+const TTL_MS = 10 * 60_000;
+const OUTPUT_MAX = 8_000;
+const COLS = 100;
+const ROWS = 40;
+const ESC = String.fromCharCode(27);
+const CSI = /^\[[0-9;?]*[a-zA-Z]/;
+const URL_RE = /https:\/\/[^\s"'`]+/g;
+
+export type LoginState = 'pending' | 'done' | 'failed';
+
+export interface LoginView {
+  id: string;
+  state: LoginState;
+  url: string | null;
+  output: string;
+  error: string | null;
+}
+
+interface Live {
+  id: string;
+  startedAt: number;
+  state: LoginState;
+  output: string;
+  error: string | null;
+  write: (text: string) => void;
+  kill: () => void;
+}
+
+export interface LoginDeps {
+  command?: string[];
+}
+
+let live: Live | null = null;
+
+export function plainText(raw: string): string {
+  return raw
+    .split(ESC)
+    .map((part, index) => (index === 0 ? part : part.replace(CSI, '')))
+    .join('');
+}
+
+export function loginUrlIn(output: string): string | null {
+  const found = output.match(URL_RE) ?? [];
+  const trimmed = found.map((url) => url.replace(/[.,)]+$/, ''));
+  return trimmed.find((url) => url.includes('claude.ai') || url.includes('anthropic.com')) ?? trimmed[0] ?? null;
+}
+
+const view = (session: Live): LoginView => ({
+  id: session.id,
+  state: session.state,
+  url: loginUrlIn(session.output),
+  output: session.output,
+  error: session.error,
+});
+
+function sweep(now: number): void {
+  if (live !== null && live.state !== 'pending') return;
+  if (live !== null && now - live.startedAt > TTL_MS) {
+    live.kill();
+    live = null;
+  }
+}
+
+export function claudeInstalled(): boolean {
+  const run = spawnSync('claude', ['--version'], { stdio: 'ignore' });
+  return run.error === undefined && run.status === 0;
+}
+
+export function claudeAccount(): { signedIn: boolean; account: string | null } {
+  const run = spawnSync('claude', STATUS_COMMAND, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  if (run.error !== undefined || typeof run.stdout !== 'string') return { signedIn: false, account: null };
+  try {
+    const parsed: unknown = JSON.parse(run.stdout);
+    if (!isRecord(parsed)) return { signedIn: false, account: null };
+    const account = typeof parsed.email === 'string' ? parsed.email : typeof parsed.organization === 'string' ? parsed.organization : null;
+    return { signedIn: parsed.authenticated === true || parsed.loggedIn === true || account !== null, account };
+  } catch {
+    return { signedIn: false, account: null };
+  }
+}
+
+function note(session: Live, chunk: string): void {
+  const next = session.output + plainText(chunk);
+  session.output = next.length > OUTPUT_MAX ? next.slice(next.length - OUTPUT_MAX) : next;
+}
+
+export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now()): LoginView {
+  sweep(now);
+  if (live !== null && live.state === 'pending') return view(live);
+  const command = deps.command ?? LOGIN_COMMAND;
+  const session: Live = {
+    id: randomBytes(9).toString('base64url'),
+    startedAt: now,
+    state: 'pending',
+    output: '',
+    error: null,
+    write: () => undefined,
+    kill: () => undefined,
+  };
+  const terminal = new Bun.Terminal({
+    cols: COLS,
+    rows: ROWS,
+    data: (_term, chunk: Uint8Array) => {
+      note(session, Buffer.from(chunk).toString('utf8'));
+    },
+  });
+  const proc = Bun.spawn(command, { terminal, env: { ...process.env, TERM: 'xterm-256color' } });
+  session.write = (text: string) => {
+    terminal.write(Buffer.from(`${text}\r`, 'utf8'));
+  };
+  session.kill = () => {
+    proc.kill();
+    terminal.close();
+  };
+  proc.exited
+    .then((code) => {
+      session.state = code === 0 ? 'done' : 'failed';
+      if (code !== 0) session.error = `the login ended with status ${String(code)}`;
+      terminal.close();
+      log.info({ state: session.state }, 'claude-login: the official login finished');
+    })
+    .catch((err: unknown) => {
+      session.state = 'failed';
+      session.error = errMsg(err);
+    });
+  live = session;
+  log.info({ command: command[0] }, 'claude-login: started');
+  return view(session);
+}
+
+function current(id: string): Live {
+  const session = live;
+  if (session?.id !== id) throw new ApiError('that sign-in is over; start another one', 404);
+  return session;
+}
+
+export function claudeLoginView(id: string, now = Date.now()): LoginView {
+  sweep(now);
+  return view(current(id));
+}
+
+export function answerClaudeLogin(id: string, text: string): LoginView {
+  const session = current(id);
+  if (session.state !== 'pending') throw new ApiError('that sign-in has already finished', 409);
+  session.write(text);
+  return view(session);
+}
+
+export function endClaudeLogin(id: string): { ended: true } {
+  const session = current(id);
+  session.kill();
+  live = null;
+  return { ended: true };
+}
+
+export const forgetClaudeLogin = (): void => {
+  live?.kill();
+  live = null;
+};

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/claude-settings.ts → daemon/src/claude/settings.ts}

@@ -1,9 +1,9 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { ApiError } from './api-error.js';
-import { claudeDir, listClaudeProjects } from './claude-files.js';
-import { isRecord } from './is-record.js';
-import { errMsg } from './log.js';
+import { ApiError } from '@metro-labs/http/api-error';
+import { claudeDir, listClaudeProjects } from './files.js';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg } from '@metro-labs/core/log';
 
 export const SETTINGS_MAX = 256 * 1024;
 const USER_ID = 'user';

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/connector-api.ts → daemon/src/connectors/api.ts}

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
+import { errMsg, log } from '@metro-labs/core/log';
 import {
   apiFailure,
   apiSession,
@@ -9,22 +9,22 @@ import {
   readJsonBody,
   sendJson,
   type ApiSession,
-} from './api-http.js';
-import { parseId } from '../db/ids.js';
+} from '@metro-labs/http/api-http';
+import { parseId } from '@metro-labs/core/ids';
 import {
   handleCallback,
   handleConnect,
   hostOf,
   startOAuth,
   type OAuthRouteDeps,
-} from './connector-oauth-routes.js';
-import { ConnectorUnauthorized } from './connector-verify.js';
+} from './oauth-routes.js';
+import { ConnectorUnauthorized } from './verify.js';
 import type {
   Connector,
   ConnectorCheck,
   ConnectorInput,
   DeletedConnector,
-} from '../db/connectors.js';
+} from './model.js';
 
 const PREFIX = '/api/connectors';
 

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/local-cli-api.ts → daemon/src/connectors/cli-api.ts}

@@ -1,9 +1,9 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
-import { cors, sendJson, type AgentIdentity } from './api-http.js';
-import { publicBaseOrDefault } from './attach-serve.js';
-import { relayServersJson, type RelayServerEntry } from './connector-json.js';
-import { agentIdForKey } from '../db/key-map.js';
+import { errMsg, log } from '@metro-labs/core/log';
+import { cors, sendJson, type AgentIdentity } from '@metro-labs/http/api-http';
+import { publicBaseOrDefault } from '../files/attach-serve.js';
+import { relayServersJson, type RelayServerEntry } from './json.js';
+import { agentIdForKey } from '../agents/keys.js';
 
 const PATH = '/api/cli/mcp';
 

package/runtime/node_modules/@metro-labs/{mcp/src/db/connector-config.ts → daemon/src/connectors/config.ts}

@@ -1,11 +1,11 @@
-import { ApiError } from '../daemon/api-error.js';
+import { ApiError } from '@metro-labs/http/api-error';
 import type {
   ConnectorAuth,
   VerifiedRecord,
   VerifiedServer,
-} from '../daemon/connector-verify.js';
-import { readStoredTools } from '../daemon/connector-tools.js';
-import { isRecord } from '../daemon/is-record.js';
+} from './verify.js';
+import { readStoredTools } from './tools.js';
+import { isRecord } from '@metro-labs/core/is-record';
 
 const CONNECTOR_NAME_MAX = 64;
 const HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;

package/runtime/node_modules/@metro-labs/{mcp/src/db/connectors.ts → daemon/src/connectors/model.ts}

@@ -1,6 +1,6 @@
-import type { ConnectorAuth, VerifiedRecord } from '../daemon/connector-verify.js';
-import { readConfig, signInState, type ConnectorSignIn } from './connector-config.js';
-import type { ConnectorTransport } from './stations.js';
+import type { ConnectorAuth, VerifiedRecord } from './verify.js';
+import { readConfig, signInState, type ConnectorSignIn } from './config.js';
+import type { ConnectorTransport } from '@metro-labs/core/station-names';
 
 export interface Connector {
   id: string;

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/connectors}/oauth-client.ts

@@ -2,9 +2,9 @@ import { createHash, randomBytes } from 'node:crypto';
 import {
   ConnectorVerifyError,
   type OAuthTokens,
-} from './connector-verify.js';
+} from './verify.js';
 import type { OAuthServer } from './oauth-discovery.js';
-import { isRecord } from './is-record.js';
+import { isRecord } from '@metro-labs/core/is-record';
 
 const TOKEN_TIMEOUT_MS = 15_000;
 const CLIENT_NAME = 'Metro';

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/connectors}/oauth-discovery.ts

@@ -1,5 +1,5 @@
-import { ConnectorVerifyError, parseConnectorUrl } from './connector-verify.js';
-import { isRecord } from './is-record.js';
+import { ConnectorVerifyError, parseConnectorUrl } from './verify.js';
+import { isRecord } from '@metro-labs/core/is-record';
 
 const DISCOVERY_TIMEOUT_MS = 10_000;
 

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/connector-oauth-routes.ts → daemon/src/connectors/oauth-routes.ts}

@@ -1,15 +1,15 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
-import { bodyField, readJsonBody, sendJson, type ApiSession } from './api-http.js';
+import { errMsg, log } from '@metro-labs/core/log';
+import { bodyField, readJsonBody, sendJson, type ApiSession } from '@metro-labs/http/api-http';
 import {
   beginOAuth,
   completeOAuth,
   takePending,
   type PendingAuth,
-} from './connector-oauth.js';
-import { parseConnectorUrl } from './connector-verify.js';
-import type { OAuthAuth } from './connector-verify.js';
-import type { Connector } from '../db/connectors.js';
+} from './oauth.js';
+import { parseConnectorUrl } from './verify.js';
+import type { OAuthAuth } from './verify.js';
+import type { Connector } from './model.js';
 
 const asText = (value: unknown): string =>
   typeof value === 'string' ? value : '';

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/connector-oauth.ts → daemon/src/connectors/oauth.ts}

@@ -1,10 +1,10 @@
-import { publicBaseOrDefault } from './attach-serve.js';
+import { publicBaseOrDefault } from '../files/attach-serve.js';
 import {
   ConnectorVerifyError,
   type OAuthAuth,
   type OAuthTokens,
-} from './connector-verify.js';
-import { validateReturnTo } from './return-to.js';
+} from './verify.js';
+import { validateReturnTo } from '@metro-labs/http/return-to';
 import {
   authorizeUrl,
   exchangeCode,

package/runtime/node_modules/@metro-labs/{mcp/src/db/connector-relay.ts → daemon/src/connectors/relay-target.ts}

@@ -1,4 +1,4 @@
-import type { ConnectorAuth, OAuthAuth } from '../daemon/connector-verify.js';
+import type { ConnectorAuth, OAuthAuth } from './verify.js';
 
 export type RelayTarget =
   | { kind: 'ok'; url: string; headers: Record<string, string> }

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/connectors}/relay.ts

@@ -1,8 +1,8 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { RelayTarget } from '../db/connector-relay.js';
-import type { AgentIdentity } from './api-http.js';
-import { ApiError } from './api-error.js';
-import { errMsg, log } from './log.js';
+import type { RelayTarget } from './relay-target.js';
+import type { AgentIdentity } from '@metro-labs/http/api-http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { errMsg, log } from '@metro-labs/core/log';
 
 export interface RelayApiDeps {
   target: (connectorId: string, force: boolean) => Promise<RelayTarget>;

package/runtime/node_modules/@metro-labs/{mcp/src/db/local-connectors.ts → daemon/src/connectors/store.ts}

@@ -1,6 +1,6 @@
 import { join } from 'node:path';
-import { readJson, writeSecure } from '../daemon/secure-fs.js';
-import { errMsg, log } from '../daemon/log.js';
+import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { errMsg, log } from '@metro-labs/core/log';
 import {
   connectorUrlText,
   ConnectorVerifyError,
@@ -8,9 +8,9 @@ import {
   verifyRemoteMcp,
   type ConnectorAuth,
   type OAuthAuth,
-} from '../daemon/connector-verify.js';
-import { oauthExpired, refreshOAuth } from '../daemon/connector-oauth.js';
-import { advertisesOAuth } from '../daemon/oauth-discovery.js';
+} from './verify.js';
+import { oauthExpired, refreshOAuth } from './oauth.js';
+import { advertisesOAuth } from './oauth-discovery.js';
 import {
   ConnectorError,
   connectorAuth,
@@ -18,13 +18,13 @@ import {
   readConfig,
   stamp,
   type ConnectorConfig,
-} from './connector-config.js';
+} from './config.js';
 import {
   bearerHeaders,
   fixedTarget,
   unrefreshedTarget,
   type RelayTarget,
-} from './connector-relay.js';
+} from './relay-target.js';
 import {
   connectorFromRow,
   UNVERIFIED,
@@ -32,11 +32,11 @@ import {
   type ConnectorCheck,
   type ConnectorInput,
   type DeletedConnector,
-} from './connectors.js';
-import { agentsDir } from './file-source.js';
-import { assertLocalOwner, LOCAL_PROJECT_ID } from './file-admin.js';
-import { newId } from './ids.js';
-import type { LoadedConnector } from './materialize.js';
+} from './model.js';
+import { agentsDir } from '../agents/files.js';
+import { assertLocalOwner, LOCAL_PROJECT_ID } from '../agents/file-admin.js';
+import { newId } from '@metro-labs/core/ids';
+import type { LoadedConnector } from '../stations/materialize.js';
 
 export interface LocalConnectorRow {
   id: string;

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/connector-tools.ts → daemon/src/connectors/tools.ts}

@@ -1,4 +1,4 @@
-import { isRecord } from './is-record.js';
+import { isRecord } from '@metro-labs/core/is-record';
 
 export const TOOL_KINDS = ['read', 'write'] as const;
 

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/connector-url.ts → daemon/src/connectors/url.ts}

@@ -1,4 +1,4 @@
-import { ApiError } from './api-error.js';
+import { ApiError } from '@metro-labs/http/api-error';
 
 export class ConnectorVerifyError extends ApiError {}
 

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/connector-verify.ts → daemon/src/connectors/verify.ts}

@@ -1,19 +1,19 @@
-import { errMsg, log } from './log.js';
+import { errMsg, log } from '@metro-labs/core/log';
 import {
   ConnectorNotMcp,
   ConnectorUnauthorized,
   refused,
   safeIconSrc,
-} from './connector-url.js';
-import { toToolList, type ToolInfo } from './connector-tools.js';
+} from './url.js';
+import { toToolList, type ToolInfo } from './tools.js';
 
 export {
   ConnectorUnauthorized,
   ConnectorVerifyError,
   connectorUrlText,
   parseConnectorUrl,
-} from './connector-url.js';
-import { isRecord } from './is-record.js';
+} from './url.js';
+import { isRecord } from '@metro-labs/core/is-record';
 
 export interface OAuthTokens {
   accessToken: string;

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/files}/attach-grant.ts

@@ -1,8 +1,8 @@
 import { randomBytes, timingSafeEqual } from 'node:crypto';
-import { ID_RE } from '../db/ids.js';
+import { ID_RE } from '@metro-labs/core/ids';
 import { readFileSync } from 'node:fs';
-import { resolveCachedAttachment } from '../stations/attachments.js';
-import { writeSecure } from './secure-fs.js';
+import { resolveCachedAttachment } from '@metro-labs/core/stations/attachments';
+import { writeSecure } from '@metro-labs/core/secure-fs';
 
 const GRANT_SUFFIX = '.grant';
 

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/files}/attach-owner.ts

@@ -1,7 +1,7 @@
 import { readFileSync } from 'node:fs';
-import { ID_RE } from '../db/ids.js';
-import { resolveCachedAttachment } from '../stations/attachments.js';
-import { writeSecure } from './secure-fs.js';
+import { ID_RE } from '@metro-labs/core/ids';
+import { resolveCachedAttachment } from '@metro-labs/core/stations/attachments';
+import { writeSecure } from '@metro-labs/core/secure-fs';
 
 const OWNER_SUFFIX = '.owner';
 

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/files}/attach-serve.ts

@@ -4,7 +4,7 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import {
   guessMime,
   resolveCachedAttachment,
-} from '../stations/attachments.js';
+} from '@metro-labs/core/stations/attachments';
 import {
   allowedAgents,
   authenticate,
@@ -12,9 +12,8 @@ import {
 } from '../mcp/request-identity.js';
 import { attachmentOwner, recordAttachmentOwner } from './attach-owner.js';
 import { grantAllows, issueAttachmentGrant } from './attach-grant.js';
-import { errMsg, log } from './log.js';
-import { currentTunnelUrl, webhookPort } from './tunnel.js';
-import { isLocalMode } from './paths.js';
+import { errMsg, log } from '@metro-labs/core/log';
+import { currentTunnelUrl, webhookPort } from '../net/tunnel.js';
 
 function authorized(req: IncomingMessage, name: string): boolean {
   const owner = attachmentOwner(name);
@@ -25,21 +24,15 @@ function authorized(req: IncomingMessage, name: string): boolean {
   );
 }
 
-const DEFAULT_PUBLIC_BASE = 'https://api.metro.box';
-
 export function publicBaseUrl(): string | null {
   const env = process.env.METRO_PUBLIC_URL?.trim();
   if (env) return env.replace(/\/+$/, '');
   return currentTunnelUrl();
 }
 
-const servesLocally = (): boolean => isLocalMode();
-
-const localBase = (): string | null =>
-  servesLocally() ? `http://127.0.0.1:${String(webhookPort())}` : null;
+const localBase = (): string => `http://127.0.0.1:${String(webhookPort())}`;
 
-export const publicBaseOrDefault = (): string =>
-  publicBaseUrl() ?? localBase() ?? DEFAULT_PUBLIC_BASE;
+export const publicBaseOrDefault = (): string => publicBaseUrl() ?? localBase();
 
 export function attachmentUrl(
   pathOrName: string,

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/files}/upload-api.ts

@@ -1,16 +1,16 @@
 import { open, rename, rm, type FileHandle } from 'node:fs/promises';
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { guessMime } from '../stations/attachments.js';
+import { guessMime } from '@metro-labs/core/stations/attachments';
 import { safeFileName } from '../stations/attach-inline.js';
 import {
   allowedAgents,
   authenticate,
   extractToken,
 } from '../mcp/request-identity.js';
-import { ApiError } from './api-error.js';
-import { apiFailure, cors, sendJson } from './api-http.js';
-import { log } from './log.js';
-import { writeSecure } from './secure-fs.js';
+import { ApiError } from '@metro-labs/http/api-error';
+import { apiFailure, cors, sendJson } from '@metro-labs/http/api-http';
+import { log } from '@metro-labs/core/log';
+import { writeSecure } from '@metro-labs/core/secure-fs';
 import {
   createUploadSlot,
   liveUploadBytes,