@stage-labs/metro 0.1.0-beta.8 → 0.1.0-beta.9

package/README.md

@@ -174,7 +174,7 @@ All commands accept `--json`. `reply` / `send` / `edit` read multi-line `<text>`
 - `agent-registry.json` — every `(station, agent-id, sessions[])` tuple metro has seen; surfaced under each agent row in `metro stations`
 - `stations/codex/session-id` — current codex-rc thread id (daemon writes on handshake; CLI processes read for `metro://codex/<agent-id>/<session>`)
 - `webhooks.json` — registered HTTP receive endpoints (id, label, optional shared secret)
-- `tunnel.json` — Cloudflare named-tunnel config (`{name, hostname}`); when present, the daemon spawns `cloudflared tunnel run`
+- `tunnel.json` — Cloudflare named-tunnel config (`{name, hostname}`); when present, the daemon spawns `cloudflared tunnel run`. The token is resolved via `cloudflared tunnel token <name>` and passed through as `TUNNEL_TOKEN`, so the per-tunnel credentials JSON at `~/.cloudflared/<id>.json` is not required (the named-form spawn is the fallback when the token call fails)
 - `.tail-lock` — dispatcher pid
 - `metro.sock` — daemon IPC socket
 - `telegram-offset.json` — last processed update id

package/dist/tunnel.js

@@ -1,5 +1,5 @@
-/** Cloudflared named-tunnel manager. Spawns `cloudflared tunnel run` from `tunnel.json` for stable webhook URLs. */
-import { spawn } from 'node:child_process';
+/** Cloudflared tunnel manager. Prefers token-from-env so a missing local credentials JSON does not block startup. */
+import { spawn, spawnSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { STATE_DIR } from './paths.js';
@@ -10,11 +10,21 @@ export const loadTunnelConfig = () => existsSync(FILE)
     ? JSON.parse(readFileSync(FILE, 'utf8'))
     : null;
 export function saveTunnelConfig(c) { writeFileSync(FILE, JSON.stringify(c, null, 2)); }
+/** Fetch the tunnel's auth token. Null when CLI is unavailable, not logged in, or no such tunnel. */
+function fetchTunnelToken(name) {
+    const r = spawnSync('cloudflared', ['tunnel', 'token', name], { encoding: 'utf8' });
+    if (r.status !== 0)
+        return null;
+    const token = r.stdout.trim();
+    return token.length > 0 ? token : null;
+}
 export class Tunnel {
     cfg;
     port;
     child = null;
     closed = false;
+    token = null;
+    tokenResolved = false;
     constructor(cfg, port) {
         this.cfg = cfg;
         this.port = port;
@@ -23,14 +33,21 @@ export class Tunnel {
     start() {
         if (this.closed)
             return;
-        log.info({ name: this.cfg.name, hostname: this.cfg.hostname, port: this.port }, 'cloudflared tunnel starting');
+        if (!this.tokenResolved) {
+            this.token = fetchTunnelToken(this.cfg.name);
+            this.tokenResolved = true;
+        }
+        const mode = this.token ? 'token' : 'named';
+        log.info({ name: this.cfg.name, hostname: this.cfg.hostname, port: this.port, mode }, 'cloudflared tunnel starting');
         /** `--no-autoupdate` is a global cloudflared flag — must come before the `tunnel` subcommand. */
-        this.child = spawn('cloudflared', [
-            '--no-autoupdate',
-            'tunnel', 'run',
-            '--url', `http://127.0.0.1:${this.port}`,
-            this.cfg.name,
-        ], { stdio: ['ignore', 'pipe', 'pipe'] });
+        const args = ['--no-autoupdate', 'tunnel', 'run', '--url', `http://127.0.0.1:${this.port}`];
+        /** Token form resolves the tunnel from TUNNEL_TOKEN so the trailing name arg must be omitted. */
+        if (!this.token)
+            args.push(this.cfg.name);
+        const env = this.token
+            ? { ...process.env, TUNNEL_TOKEN: this.token }
+            : process.env;
+        this.child = spawn('cloudflared', args, { stdio: ['ignore', 'pipe', 'pipe'], env });
         this.child.stderr?.on('data', d => log.debug({ cloudflared: d.toString().trim() }, 'cloudflared'));
         this.child.on('exit', code => {
             this.child = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.8",
+  "version": "0.1.0-beta.9",
   "description": "Live JSON stream of Telegram + Discord messages for your local Claude Code / Codex session. The agent launches metro; metro emits inbounds on stdout and accepts replies via CLI subcommands.",
   "license": "MIT",
   "repository": {