@stage-labs/metro 0.1.0-beta.81 → 0.1.0-beta.83

package/dist/claude.js

@@ -1,4 +1,4 @@
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { settingsConflicts, settingsFiles } from './claude-settings.js';
 import { localAgents, pickLocalAgent } from './local.js';
 import { PROVIDER_FLAGS } from './provider-flags.js';
@@ -28,6 +28,24 @@ export function gatewayEnv(base, agentKey, port) {
         CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY: '1',
     };
 }
+const OWN_CREDENTIALS = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'];
+export function credentialEnv(env, agentKey, signedIn) {
+    if (signedIn || OWN_CREDENTIALS.some((name) => set(env, name)))
+        return env;
+    return { ...env, ANTHROPIC_AUTH_TOKEN: agentKey };
+}
+export function claudeSignedIn() {
+    const run = spawnSync('claude', ['auth', 'status', '--json'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    if (run.error !== undefined || typeof run.stdout !== 'string')
+        return false;
+    try {
+        const parsed = JSON.parse(run.stdout);
+        return parsed.authenticated === true || parsed.loggedIn === true || typeof parsed.email === 'string' || typeof parsed.organization === 'string';
+    }
+    catch {
+        return false;
+    }
+}
 export function servingDaemon(body) {
     if (typeof body !== 'object' || body === null)
         return false;
@@ -103,5 +121,9 @@ export async function launchClaude(extra) {
     }
     const port = localPort();
     process.stderr.write(`metro claude: inference goes through the daemon at http://127.0.0.1:${String(port)}/gateway (the Model page decides where)\n`);
-    return runClaude(claudeArgs(extra), gatewayEnv(process.env, decision.key, port));
+    const routed = gatewayEnv(process.env, decision.key, port);
+    const env = credentialEnv(routed, decision.key, claudeSignedIn());
+    if (env !== routed)
+        process.stderr.write("metro claude: Claude Code has no login of its own here, so metro's key stands in as its credential; the Model page must route to Bedrock, OpenRouter or Codex\n");
+    return runClaude(claudeArgs(extra), env);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.81",
+  "version": "0.1.0-beta.83",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -70,6 +70,11 @@ function requestedModel(body: Record<string, unknown>): string {
   return model;
 }
 
+const standsInFor = (req: IncomingMessage): boolean => {
+  const metroKey = req.headers['x-metro-key'];
+  return typeof metroKey === 'string' && metroKey !== '' && req.headers.authorization === `Bearer ${metroKey}`;
+};
+
 async function toAnthropic(
   req: IncomingMessage,
   res: ServerResponse,
@@ -81,8 +86,14 @@ async function toAnthropic(
   const explicit = typeof body.model === 'string' && body.model !== route.model;
   const payload = explicit ? Buffer.from(JSON.stringify({ ...body, model: route.model })) : raw;
   const url = `${deps.anthropicBase ?? ANTHROPIC_BASE}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
-  const watch = watchUpstream(res);
   const key = deps.config().anthropic.apiKey;
+  if (key === '' && standsInFor(req))
+    throw new GatewayError(
+      403,
+      'permission_error',
+      'Claude Code on this machine has no Anthropic login of its own; choose Bedrock, OpenRouter or Codex on the Model page, or sign in on the Claude tab',
+    );
+  const watch = watchUpstream(res);
   const upstream = await fetch(url, {
     method: 'POST',
     headers: key === '' ? forwardedHeaders(req) : anthropicHeaders(req, key),

package/runtime/node_modules/@metro-labs/daemon/src/terminal/api.ts

@@ -7,7 +7,6 @@ import { mintTerminalTicket } from './tickets.js';
 
 const PREFIX = '/api/terminal';
 const TICKETS = `${PREFIX}/tickets`;
-export const TMUX_SESSION = 'metro';
 const SESSION_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/;
 
 export const tmuxCommand = (session: string): string[] => ['tmux', 'new-session', '-A', '-D', '-s', session, ';', 'set-option', '-g', 'mouse', 'on'];
@@ -33,7 +32,8 @@ export function tmuxSessions(): string[] {
 }
 
 export function sessionOf(raw: unknown): string {
-  if (raw === undefined || raw === null || raw === '') return TMUX_SESSION;
+  if (raw === undefined || raw === null || raw === '')
+    throw new ApiError('name the tmux session to open; GET /api/terminal lists the ones that exist', 400);
   if (typeof raw !== 'string' || !SESSION_RE.test(raw))
     throw new ApiError('a session name is 1 to 32 letters, digits, dots, dashes or underscores', 400);
   return raw;
@@ -56,7 +56,7 @@ export function handleTerminalRequest(req: IncomingMessage, res: ServerResponse,
       if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
       if (path === PREFIX) {
-        sendJson(req, res, 200, { available: tmuxAvailable(deps), session: TMUX_SESSION, sessions: tmuxSessions() });
+        sendJson(req, res, 200, { available: tmuxAvailable(deps), sessions: tmuxSessions() });
         return;
       }
       const wanted = sessionOf(bodyField(await readJsonBody(req), 'session'));

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.81"
+  "version": "0.1.0-beta.83"
 }