@stage-labs/metro 0.1.0-beta.13 → 0.1.0-beta.130

package/runtime/node_modules/@metro-labs/daemon/src/routes/http.ts

@@ -0,0 +1,372 @@
+import { handleSessionApis, type SessionApis } from './session-apis.js';
+import { handleGatewayRequest } from '../gateway/gateway.js';
+import { handleRelayRequest } from '../connectors/relay.js';
+import { handleThreemaCallback } from './threema-callback.js';
+import { BodyTooLargeError, readBody, WEBHOOK_BODY_MAX } from './body.js';
+
+export { BodyTooLargeError, readBody } from './body.js';
+import {
+  createServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from 'node:http';
+import { Line } from '@metro-labs/core/lines';
+import { errMsg, log } from '@metro-labs/core/log';
+import {
+  classifyEvent,
+  formatDisplay,
+  mintId,
+  publishEvent,
+  userSelf,
+  type MetroEvent,
+} from '@metro-labs/core/events';
+import type { TrainEvent } from '@metro-labs/core/trains/protocol';
+import { agentForLine, agentIdForLine } from '../agents/map.js';
+import {
+  findEndpointByWebhookId,
+  listEndpoints,
+  tokenMatches,
+  webhookPort,
+  type Endpoint,
+} from '../net/tunnel.js';
+import { attachmentEventUrl, handleAttachRequest } from '../files/attach-serve.js';
+import { webhookEntry } from '@metro-labs/webhook';
+import { handleIdentityRequest } from './identity.js';
+import { attachTerminalSockets } from '../terminal/socket.js';
+import { tmuxCommand } from '../terminal/api.js';
+import { handleModeRequest } from '@metro-labs/http/mode-api';
+import { handleUploadRequest } from '../files/upload-api.js';
+import {
+  handleMonitorRequest,
+  type MonitorCall,
+} from '../monitor/api.js';
+import { applyMcpCors, handleMcpPreflight } from '@metro-labs/http/cors';
+import { METRO_VERSION } from '@metro-labs/core/version';
+
+const LRU_CAP = 2_000;
+
+function dedupKey(
+  e: Pick<MetroEvent, 'station' | 'line' | 'messageId'>,
+): string | null {
+  if (!e.messageId) return null;
+  return `${e.station} ${e.line} ${e.messageId}`;
+}
+
+export interface DedupSeq {
+  admit(entry: MetroEvent): number | null;
+}
+
+export function makeDedupSeq(): DedupSeq {
+  const seen = new Map<string, true>();
+  const seqByLine = new Map<string, number>();
+
+  log.info('dedup+seq: live-from-boot (no persisted seed)');
+
+  const isInbound = (e: MetroEvent): boolean => !Line.isLocal(e.from);
+
+  return {
+    admit(entry: MetroEvent): number | null {
+      const key = dedupKey(entry);
+      if (key && isInbound(entry)) {
+        if (seen.has(key)) {
+          log.debug(
+            {
+              station: entry.station,
+              line: entry.line,
+              messageId: entry.messageId,
+            },
+            'dedup: dropped duplicate inbound message',
+          );
+          return null;
+        }
+        seen.set(key, true);
+        while (seen.size > LRU_CAP) {
+          const oldest = seen.keys().next();
+          if (oldest.done) break;
+          seen.delete(oldest.value);
+        }
+      }
+      const next = (seqByLine.get(entry.line) ?? 0) + 1;
+      seqByLine.set(entry.line, next);
+      while (seqByLine.size > LRU_CAP) {
+        const oldest = seqByLine.keys().next();
+        if (oldest.done) break;
+        seqByLine.delete(oldest.value);
+      }
+      return next;
+    },
+  };
+}
+
+function withAttachmentUrl(entry: MetroEvent): MetroEvent {
+  const payload = entry.payload;
+  if (!payload || typeof payload !== 'object') return entry;
+  const agentId = agentIdForLine(entry.line);
+  if (agentId === undefined) return entry;
+  const url = attachmentEventUrl(payload as Record<string, unknown>, agentId);
+  if (!url) return entry;
+  return { ...entry, payload: { ...payload, url } };
+}
+
+type Emit = (entry: MetroEvent) => void;
+
+export function makeEmit(dedupSeq?: DedupSeq): Emit {
+  const tracker = dedupSeq ?? makeDedupSeq();
+  return function emit(entry: MetroEvent): void {
+    const seq = tracker.admit(entry);
+    if (seq === null) return;
+    const enriched: MetroEvent = withAttachmentUrl({
+      ...entry,
+      seq,
+      agent: entry.agent ?? agentForLine(entry.line),
+      display: entry.display ?? formatDisplay(entry),
+      event: entry.event ?? classifyEvent(entry),
+    });
+    process.stdout.write(JSON.stringify(enriched) + '\n');
+    publishEvent(enriched);
+  };
+}
+
+function eventText(env: TrainEvent): string | undefined {
+  if (env.text !== undefined) return env.text;
+  return env.emoji ? `[react ${env.emoji}]` : undefined;
+}
+
+function addressingFacts(
+  env: TrainEvent,
+  isPrivate: boolean,
+): Pick<MetroEvent, 'isPrivate' | 'mentionsSelf' | 'replyToSelf'> {
+  return {
+    ...(isPrivate ? { isPrivate: true } : {}),
+    ...(env.mentions_self === true ? { mentionsSelf: true } : {}),
+    ...(env.reply_to_self === true ? { replyToSelf: true } : {}),
+  };
+}
+
+export function trainEventToMetroEvent(
+  env: TrainEvent,
+  trainName: string,
+): MetroEvent | null {
+  const line = env.line;
+  if (typeof line !== 'string') {
+    log.warn({ train: trainName }, 'train: dropped event without `line`');
+    return null;
+  }
+  const station = env.station ?? Line.station(line) ?? trainName;
+  const isPrivate = env.is_private === true;
+  const text = eventText(env);
+  return {
+    event: env.event,
+    agent: agentForLine(line),
+    id: env.id ?? mintId(),
+    ts: env.ts ?? new Date().toISOString(),
+    station,
+    line: line as MetroEvent['line'],
+    lineName: env.line_name,
+    from: (env.from ?? `metro://${station}`) as MetroEvent['from'],
+    fromName: env.from_name,
+    fromDisplayName: env.from_display_name,
+    to: (env.to ?? (isPrivate ? userSelf() : line)) as MetroEvent['to'],
+    text,
+    messageId: env.message_id,
+    replyTo: env.reply_to,
+    ...addressingFacts(env, isPrivate),
+    payload: env.payload,
+  };
+}
+
+type McpHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+
+export async function startWebhookServer(
+  emit: Emit,
+  apis: SessionApis = {},
+  mcp?: McpHandler,
+  monitorCall?: MonitorCall,
+): Promise<Server> {
+  const port = webhookPort();
+  const server = createServer((req, res) => {
+    handleRequest(req, res, emit, apis, mcp, monitorCall).catch(
+      (err: unknown) => {
+      log.warn({ err: errMsg(err) }, 'webhook handler error');
+      if (!res.headersSent) res.writeHead(500).end();
+    });
+  });
+  if (apis.terminalApi !== undefined)
+    attachTerminalSockets(server, { command: apis.terminalApi.command ?? tmuxCommand });
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject);
+    const host = process.env.METRO_HTTP_HOST ?? '127.0.0.1';
+    server.listen(port, host, () => {
+      log.info(
+        {
+          host,
+          port,
+          endpoints: listEndpoints().length,
+          mcp: mcp ? '/' : 'off',
+        },
+        'webhook + mcp ready',
+      );
+      resolve();
+    });
+  });
+  return server;
+}
+
+function isMcpPath(req: IncomingMessage): boolean {
+  const path = (req.url ?? '').split('?')[0];
+  return path === '/' || path === '/mcp';
+}
+
+function flatHeaders(req: IncomingMessage): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(req.headers).map(([k, v]) => [
+      k,
+      Array.isArray(v) ? v.join(',') : (v ?? ''),
+    ]),
+  );
+}
+
+function parseBody(raw: Buffer): unknown {
+  const text = raw.toString('utf8');
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+async function handleWebhookPost(
+  req: IncomingMessage,
+  res: ServerResponse,
+  emit: Emit,
+  endpointId: string,
+  endpoint: Endpoint,
+): Promise<void> {
+  let raw: Buffer;
+  try {
+    raw = await readBody(req, WEBHOOK_BODY_MAX);
+  } catch (err) {
+    if (!(err instanceof BodyTooLargeError)) throw err;
+    log.warn({ endpoint: endpointId, limit: err.limit }, 'webhook body too large — rejecting');
+    res.writeHead(413).end('payload too large');
+    return;
+  }
+  const body = parseBody(raw);
+  emit(
+    webhookEntry(
+      endpoint,
+      flatHeaders(req),
+      body,
+      req.method ?? 'POST',
+      hookPath(endpointId),
+    ),
+  );
+  res.writeHead(200).end('ok');
+}
+
+function handleHealth(req: IncomingMessage, res: ServerResponse): boolean {
+  const reqPath = (req.url ?? '').split('?')[0];
+  if (reqPath !== '/health' && reqPath !== '/healthz') return false;
+  res.writeHead(200, { 'content-type': 'application/json' }).end(
+    JSON.stringify({
+      status: 'ok',
+      version: METRO_VERSION,
+      uptime: Math.round(process.uptime()),
+    }),
+  );
+  return true;
+}
+
+const HOOK_PATH =
+  /^\/api\/webhooks\/([0-9]{17,20})\/([A-Za-z0-9_-]{32,128})$/;
+
+const HOOK_PREFIX = '/api/webhooks/';
+
+const hookPath = (webhookId: string): string => `${HOOK_PREFIX}${webhookId}`;
+
+function hookTarget(
+  path: string,
+): { id: string; endpoint: Endpoint } | null {
+  const m = HOOK_PATH.exec(path);
+  const webhookId = m?.[1];
+  const token = m?.[2];
+  if (webhookId === undefined || token === undefined) return null;
+  const endpoint = findEndpointByWebhookId(webhookId);
+  if (!endpoint?.secret || !tokenMatches(endpoint.secret, token)) return null;
+  return { id: webhookId, endpoint };
+}
+
+async function handleWebhookRoute(
+  req: IncomingMessage,
+  res: ServerResponse,
+  emit: Emit,
+): Promise<boolean> {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (!path.startsWith(HOOK_PREFIX)) return false;
+  const target = hookTarget(path);
+  if (target === null) {
+    res.writeHead(404).end();
+    return true;
+  }
+  if (req.method === 'GET') {
+    res.writeHead(200).end(`metro webhook ${target.id} ready\n`);
+    return true;
+  }
+  if (req.method !== 'POST') {
+    res.writeHead(405).end();
+    return true;
+  }
+  await handleWebhookPost(req, res, emit, target.id, target.endpoint);
+  return true;
+}
+
+function handleSignInRoutes(
+  req: IncomingMessage,
+  res: ServerResponse,
+  apis: SessionApis,
+): boolean {
+  if (apis.identity !== undefined && handleIdentityRequest(req, res, apis.identity)) return true;
+  return apis.mode !== undefined && handleModeRequest(req, res, apis.mode);
+}
+
+function handleEarlyRoutes(req: IncomingMessage, res: ServerResponse, apis: SessionApis): boolean {
+  if (handleHealth(req, res)) return true;
+  if (apis.gateway !== undefined && handleGatewayRequest(req, res, apis.gateway)) return true;
+  if (handleSignInRoutes(req, res, apis)) return true;
+  return handleSessionApis(req, res, apis);
+}
+
+async function handlePreMcpRoutes(
+  req: IncomingMessage,
+  res: ServerResponse,
+  emit: Emit,
+  apis: SessionApis,
+  monitorCall?: MonitorCall,
+): Promise<boolean> {
+  if (handleEarlyRoutes(req, res, apis)) return true;
+  if (handleUploadRequest(req, res)) return true;
+  if (handleAttachRequest(req, res)) return true;
+  if (apis.relayApi && handleRelayRequest(req, res, apis.relayApi)) return true;
+  if (await handleWebhookRoute(req, res, emit)) return true;
+  if (await handleThreemaCallback(req, res)) return true;
+  return Boolean(monitorCall && handleMonitorRequest(req, res, monitorCall));
+}
+
+async function handleRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  emit: Emit,
+  apis: SessionApis = {},
+  mcp?: McpHandler,
+  monitorCall?: MonitorCall,
+): Promise<void> {
+  if (await handlePreMcpRoutes(req, res, emit, apis, monitorCall)) return;
+  if (mcp && isMcpPath(req)) {
+    applyMcpCors(req, res);
+    if (handleMcpPreflight(req, res)) return;
+    await mcp(req, res);
+    return;
+  }
+  res.writeHead(404).end();
+}

package/runtime/node_modules/@metro-labs/daemon/src/routes/identity.ts

@@ -0,0 +1,54 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { verifyTypedData } from 'viem';
+import { log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { apiFailure, bodyField, cors, readJsonBody, sendJson } from '@metro-labs/http/api-http';
+import { ENCRYPTION_KEY_TYPED_DATA, deriveIdentityAddress } from '@metro-labs/http/identity-key';
+import { authorizeIdentity } from '@metro-labs/http/identity-registry';
+
+const PATH = '/auth/identity';
+const SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
+
+export interface IdentityRouteDeps {
+  owner: () => string | null;
+}
+
+async function register(req: IncomingMessage, deps: IdentityRouteDeps): Promise<{ address: string; owner: string }> {
+  const signature = bodyField(await readJsonBody(req), 'signature');
+  if (typeof signature !== 'string' || !SIGNATURE_RE.test(signature))
+    throw new ApiError('signature is required: the EncryptionKey signature of the owner wallet', 400);
+  const owner = deps.owner();
+  if (owner === null)
+    throw new ApiError('this machine has no owner yet: start it with metro serve --owner <address>', 403);
+  const ok = await verifyTypedData({
+    ...ENCRYPTION_KEY_TYPED_DATA,
+    address: owner as `0x${string}`,
+    signature: signature as `0x${string}`,
+  }).catch(() => false);
+  if (!ok) throw new ApiError('this machine belongs to another wallet', 403);
+  const address = deriveIdentityAddress(signature as `0x${string}`);
+  authorizeIdentity(address, owner);
+  log.info({ owner, identity: address }, 'identity: owner signed in');
+  return { address, owner };
+}
+
+export function handleIdentityRequest(req: IncomingMessage, res: ServerResponse, deps: IdentityRouteDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'POST') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  register(req, deps)
+    .then((body) => {
+      sendJson(req, res, 200, body);
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'identity');
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -0,0 +1,223 @@
+import { ApiError } from '@metro-labs/http/api-error';
+import { errMsg, log } from '@metro-labs/core/log';
+import { AttachSessions } from '../stations/attach-session.js';
+import { recentSenders } from '../agents/senders.js';
+import { forwardTrainCall } from '../stations/train-call.js';
+import { syncPluginServers } from '../connectors/plugin-sync.js';
+import type { AgentApiDeps } from '../agents/api.js';
+import { ATTACHABLE, type AccountApiDeps } from '../agents/accounts-api.js';
+import type { SessionApis } from './session-apis.js';
+import type { ModeInfo } from '@metro-labs/http/mode-api';
+import { loadedAgentOf, type AgentBundle, type BundleApiDeps } from '../agents/bundle.js';
+import { METRO_VERSION } from '@metro-labs/core/version';
+import type { ConnectorApiDeps } from '../connectors/api.js';
+import { allowLocalConnectors } from '../connectors/url.js';
+import { keyIdentity, type LocalCliDeps } from '../connectors/cli-api.js';
+import type { RelayApiDeps } from '../connectors/relay.js';
+import {
+  readLocalConnectors,
+  localImportConnectors,
+  localConnectorNamesByIds,
+  localCreateConnector,
+  localCreatePendingConnector,
+  localDeleteConnector,
+  localDisconnectConnector,
+  localGetConnector,
+  localListConnectors,
+  localReconnectConnector,
+  localRelayTarget,
+  localRenameConnector,
+  localVerifyConnector,
+} from '../connectors/store.js';
+import {
+  assertLocalOwner,
+  LOCAL_PROJECT_ID,
+  localAttachAccount,
+  localCreateAgent,
+  localDeleteAgent,
+  localDetachAccount,
+  localSetAllowlist,
+  localSetAccountEnabled,
+  localImportAgent,
+  localListAgents,
+  localOwnedAgentOrThrow,
+  localOwner,
+  localResetAgentKey,
+  readLocalAgentFile,
+} from '../agents/file-admin.js';
+import { listAgentFiles, readAgentFile } from '../agents/files.js';
+import { readModelConfig } from '../gateway/model-config.js';
+import type { StationName } from '@metro-labs/core/station-names';
+
+export interface LocalModeDeps {
+  syncStations: (station: StationName) => Promise<void>;
+  reloadAgents: () => Promise<void>;
+  restart: () => void;
+  stop: () => void;
+  closeAgentSession: (id: string) => Promise<boolean>;
+  gatherAccounts: AgentApiDeps['gatherAccounts'];
+  capabilities: AgentApiDeps['capabilities'];
+  liveness: AgentApiDeps['liveness'];
+  prepareAccount: AccountApiDeps['prepareAccount'];
+}
+
+function attachSessions(deps: LocalModeDeps): AttachSessions {
+  return new AttachSessions({
+    authorize: async (owner) => {
+      await localOwnedAgentOrThrow(owner.subject, owner.agentId);
+    },
+    complete: async (owner, station, config) => {
+      const ref = await localAttachAccount(owner.subject, owner.agentId, station, config);
+      const activated = await deps.syncStations(station).then(
+        () => true,
+        (err: unknown) => {
+          log.warn(
+            { station, err: errMsg(err) },
+            'attach-session: station reload failed, the change lands at the next boot',
+          );
+          return false;
+        },
+      );
+      return { accountId: ref.accountId, activated };
+    },
+  });
+}
+
+function agentApi(deps: LocalModeDeps): AgentApiDeps {
+  return {
+    attachSessions: attachSessions(deps),
+    listAgents: localListAgents,
+    createAgent: localCreateAgent,
+    deleteAgent: localDeleteAgent,
+    resetKey: async (subject, id) => {
+      const reset = await localResetAgentKey(subject, id);
+      const closed = await deps.closeAgentSession(id);
+      log.info({ agent: reset.name, id, sessionClosed: closed }, 'local: key rotated');
+      return reset;
+    },
+    gatherAccounts: deps.gatherAccounts,
+    capabilities: deps.capabilities,
+    attachable: ATTACHABLE.filter((s) => s !== 'webhook'),
+    liveness: deps.liveness,
+    connectorIds: connectorIdsOfLocalAgents,
+    prepareAccount: deps.prepareAccount,
+    attachAccount: localAttachAccount,
+    detachAccount: localDetachAccount,
+    syncStations: deps.syncStations,
+    setAllowlist: localSetAllowlist,
+    setAccountEnabled: localSetAccountEnabled,
+    recentSenders,
+    resolveSender,
+    reloadAgents: deps.reloadAgents,
+  };
+}
+
+const allConnectorIds = (): string[] => readLocalConnectors().map((c) => c.id);
+
+function connectorIdsOfLocalAgents(ids: string[]): Promise<Map<string, string[]>> {
+  const all = allConnectorIds();
+  return Promise.resolve(new Map(ids.map((id) => [id, all] as const)));
+}
+
+const connectorApi: ConnectorApiDeps = {
+  listConnectors: async (subject, project) => {
+    const rows = await localListConnectors(subject, project);
+    syncPluginServers();
+    return rows;
+  },
+  createConnector: localCreateConnector,
+  verifyConnector: localVerifyConnector,
+  disconnectConnector: localDisconnectConnector,
+  renameConnector: localRenameConnector,
+  deleteConnector: localDeleteConnector,
+  createPendingConnector: localCreatePendingConnector,
+  reconnectConnector: localReconnectConnector,
+  getConnector: localGetConnector,
+};
+
+const relayApi: RelayApiDeps = {
+  target: (connectorId, force) => localRelayTarget(connectorId, force),
+  identify: keyIdentity,
+};
+
+function agentNameOf(agentId: string): string | null {
+  return listAgentFiles()
+    .map((path) => readAgentFile(path))
+    .find((file) => file.id === agentId)?.name ?? null;
+}
+
+const localCli: LocalCliDeps = {
+  agentName: agentNameOf,
+  connectorEntries: () => localConnectorNamesByIds(allConnectorIds()),
+};
+
+function bundleApi(deps: LocalModeDeps): BundleApiDeps {
+  return {
+    bundle: async (subject, agentId) => {
+      const { agent } = await localOwnedAgentOrThrow(subject, agentId);
+      const file = readLocalAgentFile(agentId);
+      const bundle: AgentBundle = {
+        version: 1,
+        agent: { id: file.id, name: file.name, key: file.key ?? '', stations: file.stations },
+        connectors: readLocalConnectors().map((c) => ({ id: c.id, name: c.name, url: c.url, transport: c.transport, config: { ...c.config } })),
+      };
+      if (bundle.agent.key === '') throw new ApiError(`agent '${agent.name}' has no key to bundle`, 400);
+      return bundle;
+    },
+    restore: async (subject, bundle, mode) => {
+      assertLocalOwner(subject);
+      const made = await localImportAgent(subject, loadedAgentOf(bundle), undefined, mode);
+      const connectors = localImportConnectors(bundle.connectors, undefined, mode);
+      for (const station of new Set(bundle.agent.stations.map((a) => a.station)))
+        await deps.syncStations(station).catch((err: unknown) => {
+          log.warn({ station, err: errMsg(err) }, 'restore: station reload failed, the change lands at the next boot');
+        });
+      return { id: made.id, name: made.name, stations: made.stations, connectors };
+    },
+  };
+}
+
+function localModeInfo(): ModeInfo {
+  return { mode: 'local', owner: localOwner(), project: LOCAL_PROJECT_ID, version: METRO_VERSION };
+}
+
+async function resolveSender(
+  station: StationName,
+  accountId: string,
+  query: string,
+): Promise<unknown> {
+  let response;
+  try {
+    response = await forwardTrainCall(station, 'resolve_sender', {
+      account: accountId,
+      query,
+    });
+  } catch (err) {
+    throw new ApiError(
+      `metro could not reach the ${station} train: ${errMsg(err)}`,
+      503,
+    );
+  }
+  if (response.error !== undefined) throw new ApiError(response.error, 400);
+  return response.result;
+}
+
+export function localSessionApis(deps: LocalModeDeps): SessionApis {
+  allowLocalConnectors(true);
+  return {
+    agentApi: agentApi(deps),
+    bundleApi: bundleApi(deps),
+    connectorApi,
+    relayApi,
+    localCli,
+    claudeApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    updateApi: { authorize: (subject) => { assertLocalOwner(subject); }, restart: deps.restart },
+    controlApi: { authorize: (subject) => { assertLocalOwner(subject); }, restart: deps.restart, stop: deps.stop },
+    machineApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    modelApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    gateway: { config: readModelConfig },
+    terminalApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    identity: { owner: localOwner },
+    mode: localModeInfo,
+  };
+}