@stage-labs/metro 0.1.0-beta.13 → 0.1.0-beta.131

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -0,0 +1,229 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from '@metro-labs/core/log';
+import { agentIdForKey } from '../agents/keys.js';
+import {
+  assertBedrockReady,
+  bedrockBase,
+  bedrockCount,
+  bedrockMessages,
+  freshAdaptations,
+  type Adaptations,
+} from './bedrock.js';
+import { anthropicHeaders, forwardedHeaders, GatewayError, parseJson, pipeResponse, readBody, sendError, watchUpstream } from './forward.js';
+import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, writeModelConfig, type ModelConfig, type Route } from './model-config.js';
+import { codexCount, codexMessages, freshCodexState, type CodexDeps } from './codex.js';
+import { OPENROUTER_BASE } from './openrouter.js';
+import { isRecord } from '@metro-labs/core/is-record';
+import { forgetServed, noteServed } from './served.js';
+import { forgetUsage, noteUsageHeaders, UsageScanner } from './usage.js';
+import type { CodexTokens } from './codex-auth.js';
+
+export const GATEWAY_PREFIX = '/gateway';
+export const ANTHROPIC_BASE = 'https://api.anthropic.com';
+const MESSAGES = '/v1/messages';
+const COUNT = '/v1/messages/count_tokens';
+const MODELS = '/v1/models';
+const HELLO = '/api/hello';
+
+export interface GatewayDeps {
+  config: () => ModelConfig;
+  identify?: (key: string) => boolean;
+  anthropicBase?: string;
+  bedrockBase?: string;
+  openrouterBase?: string;
+  codex?: Partial<CodexDeps>;
+}
+
+const learned: Adaptations = freshAdaptations();
+const codexState = freshCodexState();
+
+export function resetGatewayState(): void {
+  forgetServed();
+  forgetUsage();
+  learned.fields.clear();
+  learned.dropBetas = false;
+  Object.assign(codexState, freshCodexState());
+}
+
+const saveCodexTokens = (tokens: CodexTokens): void => {
+  writeModelConfig(setCodexAuth(readModelConfig(), tokens));
+};
+
+const keyOf = (req: IncomingMessage): string => {
+  const raw = req.headers['x-metro-key'];
+  return (Array.isArray(raw) ? raw[0] : raw)?.trim() ?? '';
+};
+
+const defaultIdentify = (key: string): boolean => key !== '' && agentIdForKey(key) !== undefined;
+
+function modelsBody(cfg: ModelConfig): Record<string, unknown> {
+  const data: Record<string, string>[] = [];
+  if (cfg.bedrock.model !== '')
+    data.push({ id: `bedrock:${cfg.bedrock.model}`, display_name: `Bedrock · ${cfg.bedrock.model}`, description: 'Through metro, billed to Amazon Bedrock' });
+  if (cfg.openrouter.model !== '')
+    data.push({ id: `openrouter:${cfg.openrouter.model}`, display_name: `OpenRouter · ${cfg.openrouter.model}`, description: 'Through metro, billed to OpenRouter' });
+  if (cfg.codex.model !== '')
+    data.push({ id: `codex:${cfg.codex.model}`, display_name: `Codex · ${cfg.codex.model}`, description: 'Through metro, on your ChatGPT subscription' });
+  return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
+}
+
+function requestedModel(body: Record<string, unknown>): string {
+  const model = body.model;
+  if (typeof model !== 'string' || model === '') throw new GatewayError(400, 'invalid_request_error', 'model is required');
+  return model;
+}
+
+const standsInFor = (req: IncomingMessage): boolean => {
+  const metroKey = req.headers['x-metro-key'];
+  return typeof metroKey === 'string' && metroKey !== '' && req.headers.authorization === `Bearer ${metroKey}`;
+};
+
+async function toAnthropic(
+  req: IncomingMessage,
+  res: ServerResponse,
+  raw: Buffer,
+  body: Record<string, unknown>,
+  route: Route,
+  deps: GatewayDeps,
+): Promise<void> {
+  const explicit = typeof body.model === 'string' && body.model !== route.model;
+  const payload = explicit ? Buffer.from(JSON.stringify({ ...body, model: route.model })) : raw;
+  const url = `${deps.anthropicBase ?? ANTHROPIC_BASE}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
+  const key = deps.config().anthropic.apiKey;
+  if (key === '' && standsInFor(req))
+    throw new GatewayError(
+      403,
+      'permission_error',
+      'Claude Code on this machine has no Anthropic login of its own; choose Bedrock, OpenRouter or Codex on the Model page, or sign in on the Claude tab',
+    );
+  const watch = watchUpstream(res);
+  const upstream = await fetch(url, {
+    method: 'POST',
+    headers: key === '' ? forwardedHeaders(req) : anthropicHeaders(req, key),
+    body: new Uint8Array(payload),
+    signal: watch.signal,
+    redirect: 'manual',
+  });
+  noteRefusal('anthropic', route.model, upstream);
+  noteUsageHeaders('anthropic', upstream.headers);
+  const scanner = new UsageScanner('anthropic');
+  await pipeResponse(upstream, res, watch, key === '' ? { scanner } : { ownCredential: true, scanner });
+}
+
+async function toOpenRouter(
+  req: IncomingMessage,
+  res: ServerResponse,
+  body: Record<string, unknown>,
+  route: Route,
+  cfg: ModelConfig,
+  deps: GatewayDeps,
+): Promise<void> {
+  const reason = notReady(cfg, 'openrouter');
+  if (reason !== null) throw new GatewayError(400, 'invalid_request_error', reason);
+  const headers: Record<string, string> = {
+    'content-type': 'application/json',
+    accept: req.headers.accept ?? 'application/json',
+    authorization: `Bearer ${cfg.openrouter.apiKey}`,
+    'anthropic-version': typeof req.headers['anthropic-version'] === 'string' ? req.headers['anthropic-version'] : '2023-06-01',
+    'http-referer': 'https://metro.box',
+    'x-title': 'metro',
+  };
+  const beta = req.headers['anthropic-beta'];
+  if (typeof beta === 'string' && beta !== '') headers['anthropic-beta'] = beta;
+  const watch = watchUpstream(res);
+  const upstream = await fetch(`${deps.openrouterBase ?? OPENROUTER_BASE}${MESSAGES}`, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify(openrouterBody(body, route.model, cfg.openrouter.zdr)),
+    signal: watch.signal,
+    redirect: 'manual',
+  });
+  noteRefusal('openrouter', route.model, upstream);
+  await pipeResponse(upstream, res, watch, { keepalive: true, ownCredential: true, scanner: new UsageScanner('openrouter') });
+}
+
+const thinkingOff = (body: Record<string, unknown>): boolean => isRecord(body.thinking) && body.thinking.type === 'disabled';
+
+export function openrouterBody(body: Record<string, unknown>, model: string, zdr: boolean): Record<string, unknown> {
+  const sent: Record<string, unknown> = { ...body, model };
+  if (thinkingOff(body)) delete sent.thinking;
+  if (!zdr) return sent;
+  const provider = isRecord(body.provider) ? body.provider : {};
+  return { ...sent, provider: { ...provider, zdr: true } };
+}
+
+function noteRefusal(provider: string, model: string, upstream: Response): void {
+  if (!upstream.ok) log.warn({ provider, model, status: upstream.status }, 'gateway: the provider refused the request');
+}
+
+async function dispatch(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): Promise<void> {
+  const cfg = deps.config();
+  const raw = await readBody(req);
+  const body = parseJson(raw);
+  const route = resolveRoute(requestedModel(body), cfg);
+  log.info({ route: routeLabel(route), path }, 'gateway: routing');
+  if (path === MESSAGES) noteServed({ provider: route.provider, model: route.model, at: new Date().toISOString() });
+  if (route.provider === 'bedrock') {
+    assertBedrockReady(cfg.bedrock);
+    const up = { settings: cfg.bedrock, base: deps.bedrockBase ?? bedrockBase(cfg.bedrock.region), learned, watch: watchUpstream(res) };
+    if (path === COUNT) await bedrockCount(req, res, body, route.model, up);
+    else await bedrockMessages(req, res, body, route.model, up);
+    return;
+  }
+  if (route.provider === 'openrouter') {
+    if (path === COUNT) throw new GatewayError(404, 'not_found_error', 'OpenRouter does not count tokens');
+    await toOpenRouter(req, res, body, route, cfg, deps);
+    return;
+  }
+  if (route.provider === 'codex') {
+    if (path === COUNT) {
+      codexCount(res, body);
+      return;
+    }
+    const codexDeps: CodexDeps = { save: saveCodexTokens, ...deps.codex };
+    await codexMessages(req, res, body, route.model, cfg, codexDeps, codexState, watchUpstream(res));
+    return;
+  }
+  await toAnthropic(req, res, raw, body, route, deps);
+}
+
+function failed(res: ServerResponse, err: unknown): void {
+  if (res.headersSent) {
+    res.end();
+    return;
+  }
+  if (err instanceof GatewayError) {
+    sendError(res, err.status, err.kind, err.message);
+    return;
+  }
+  log.warn({ err: errMsg(err) }, 'gateway: request failed');
+  sendError(res, 502, 'api_error', `metro gateway: ${errMsg(err)}`);
+}
+
+function answer(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): void {
+  if (req.method === 'GET' && path === MODELS) {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify(modelsBody(deps.config())));
+    return;
+  }
+  if (req.method === 'POST' && (path === MESSAGES || path === COUNT)) {
+    dispatch(req, res, path, deps).catch((err: unknown) => {
+      failed(res, err);
+    });
+    return;
+  }
+  sendError(res, 404, 'not_found_error', 'not found');
+}
+
+export function handleGatewayRequest(req: IncomingMessage, res: ServerResponse, deps: GatewayDeps): boolean {
+  const full = req.url ?? '';
+  if (full !== GATEWAY_PREFIX && !full.startsWith(`${GATEWAY_PREFIX}/`)) return false;
+  const path = (full.split('?')[0] ?? '').slice(GATEWAY_PREFIX.length);
+  if (req.method === 'HEAD' && path === HELLO) {
+    res.writeHead(200).end();
+    return true;
+  }
+  if ((deps.identify ?? defaultIdentify)(keyOf(req))) answer(req, res, path, deps);
+  else sendError(res, 401, 'authentication_error', 'metro gateway: no agent key (x-metro-key); start Claude Code with metro claude');
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-api.ts

@@ -0,0 +1,269 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { apiFailure, apiSession, cors, readJsonBody, sendJson } from '@metro-labs/http/api-http';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { beginLogin, CodexAuthError, finishLogin, readCodexCliAuth } from './codex-auth.js';
+import { beginDeviceLogin, pollDeviceLogin } from './codex-device.js';
+import { codexModels, currentTokens, freshCodexState } from './codex.js';
+import { openrouterCredits, openrouterModels, openrouterZdrModels } from './openrouter.js';
+import { anthropicModels, bedrockModels } from './provider-models.js';
+import { syncAvailableModelsQuietly, type SetupDeps } from '../claude/setup.js';
+import { lastServed } from './served.js';
+import { noteUsage, openrouterUsage, usageOf, usageSeen } from './usage.js';
+import type { CodexTokens } from './codex-auth.js';
+import { GatewayError } from './forward.js';
+import {
+  applyModelUpdate,
+  ModelConfigError,
+  parseModelConfig,
+  publicModelConfig,
+  readModelConfig,
+  setCodexAuth,
+  writeModelConfig,
+  type ModelConfig,
+} from './model-config.js';
+
+const PATH = '/api/model';
+const CODEX = '/api/model/codex/';
+const OPENROUTER = '/api/model/openrouter/';
+const ANTHROPIC = '/api/model/anthropic/';
+const BEDROCK = '/api/model/bedrock/';
+const BUNDLE = '/api/model/bundle';
+const RESTORE = '/api/model/restore';
+const RESTORE_MAX = 64 * 1024;
+const BODY_MAX = 16 * 1024;
+const DEVICE_PREFIX = 'device/';
+const DEVICE_ID_RE = /^[A-Za-z0-9_-]{16,64}$/;
+
+export interface ModelApiDeps {
+  authorize: (subject: string) => void;
+  read?: () => ModelConfig;
+  write?: (cfg: ModelConfig) => void;
+  issuer?: string;
+  fetchImpl?: typeof fetch;
+  codexHome?: string;
+  codexBase?: string;
+  openrouterBase?: string;
+  anthropicBase?: string;
+  bedrockControlBase?: string;
+  setup?: SetupDeps;
+}
+
+interface Store {
+  read: () => ModelConfig;
+  write: (cfg: ModelConfig) => void;
+}
+
+type Handler = (req: IncomingMessage, deps: ModelApiDeps, store: Store) => Promise<unknown>;
+
+interface Route {
+  method: 'GET' | 'POST';
+  run: Handler;
+}
+
+const settingsBody = (cfg: ModelConfig): Record<string, unknown> => ({
+  ...publicModelConfig(cfg),
+  lastServed: lastServed(),
+  usage: usageSeen(),
+});
+
+const CREDITS_TTL_MS = 5 * 60_000;
+
+async function refreshCredits(cfg: ModelConfig, deps: ModelApiDeps, now = Date.now()): Promise<void> {
+  const key = cfg.openrouter.apiKey;
+  if (key === '') return;
+  const seen = usageOf('openrouter');
+  if (seen !== undefined && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
+  try {
+    const credits = await openrouterCredits(key, deps.openrouterBase, deps.fetchImpl);
+    noteUsage('openrouter', openrouterUsage(credits.total, credits.spent, new Date(now)));
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'model-api: could not read the OpenRouter credits');
+  }
+}
+
+async function settingsWithUsage(cfg: ModelConfig, deps: ModelApiDeps): Promise<Record<string, unknown>> {
+  await refreshCredits(cfg, deps);
+  return settingsBody(cfg);
+}
+
+function asApiError(err: unknown): never {
+  if (err instanceof ModelConfigError || err instanceof CodexAuthError) throw new ApiError(err.message, 400);
+  if (err instanceof GatewayError) throw new ApiError(err.message, err.status >= 400 && err.status < 500 ? 400 : 502);
+  throw err;
+}
+
+async function update(req: IncomingMessage, store: Store, deps: ModelApiDeps): Promise<unknown> {
+  const patch = await readJsonBody(req, BODY_MAX);
+  let next: ModelConfig;
+  try {
+    next = applyModelUpdate(store.read(), patch);
+  } catch (err) {
+    asApiError(err);
+  }
+  store.write(next);
+  syncAvailableModelsQuietly(deps.setup ?? {}, next);
+  log.info({ provider: next.provider }, 'model-api: route updated');
+  return settingsBody(next);
+}
+
+function saveCodex(store: Store, cfg: ModelConfig, note: string): unknown {
+  store.write(cfg);
+  log.info({ signedIn: cfg.codex.auth !== null, plan: cfg.codex.auth?.plan ?? null }, note);
+  return settingsBody(cfg);
+}
+
+const modelApiState = freshCodexState();
+
+async function pollDevice(id: string, deps: ModelApiDeps, store: Store): Promise<unknown> {
+  const result = await pollDeviceLogin(id, deps.fetchImpl).catch(asApiError);
+  if (result.status !== 'done') return result;
+  return { status: 'done', settings: saveCodex(store, setCodexAuth(store.read(), result.tokens), 'model-api: Codex connected by device code') };
+}
+
+const CODEX_ROUTES: Record<string, Route> = {
+  device: {
+    method: 'POST',
+    run: async (_req, deps) => {
+      const login = await beginDeviceLogin(deps.issuer, deps.fetchImpl).catch(asApiError);
+      return { id: login.id, user_code: login.userCode, verify_url: login.verifyUrl, interval: login.interval };
+    },
+  },
+  login: {
+    method: 'POST',
+    run: (_req, deps) => Promise.resolve({ url: beginLogin(deps.issuer).url }),
+  },
+  callback: {
+    method: 'POST',
+    run: async (req, deps, store) => {
+      const body = await readJsonBody(req, BODY_MAX);
+      const raw = isRecord(body) && typeof body.url === 'string' ? body.url : '';
+      const tokens = await finishLogin(raw, deps.issuer, deps.fetchImpl).catch(asApiError);
+      return saveCodex(store, setCodexAuth(store.read(), tokens), 'model-api: Codex connected');
+    },
+  },
+  logout: {
+    method: 'POST',
+    run: (_req, _deps, store) => Promise.resolve(saveCodex(store, setCodexAuth(store.read(), null), 'model-api: Codex disconnected')),
+  },
+  import: {
+    method: 'POST',
+    run: (_req, deps, store) => {
+      let tokens;
+      try {
+        tokens = readCodexCliAuth(deps.codexHome);
+      } catch (err) {
+        asApiError(err);
+      }
+      return Promise.resolve(saveCodex(store, setCodexAuth(store.read(), tokens), 'model-api: Codex CLI login imported'));
+    },
+  },
+  models: {
+    method: 'GET',
+    run: async (_req, deps, store) => {
+      const cfg = store.read();
+      if (cfg.codex.auth === null) throw new ApiError('Codex is not connected: sign in with ChatGPT first', 400);
+      const codexDeps = { issuer: deps.issuer, fetchImpl: deps.fetchImpl, base: deps.codexBase, save: (t: CodexTokens) => { store.write(setCodexAuth(store.read(), t)); } };
+      const auth = await currentTokens(cfg, codexDeps, modelApiState).catch(asApiError);
+      const models = await codexModels(auth, codexDeps).catch(asApiError);
+      return { models };
+    },
+  },
+};
+
+const OPENROUTER_ROUTES: Record<string, Route> = {
+  models: {
+    method: 'GET',
+    run: async (_req, deps) => ({ models: await openrouterModels(deps.openrouterBase, deps.fetchImpl).catch(asApiError) }),
+  },
+  zdr: {
+    method: 'GET',
+    run: async (_req, deps) => ({ models: await openrouterZdrModels(deps.openrouterBase, deps.fetchImpl).catch(asApiError) }),
+  },
+};
+
+const ANTHROPIC_ROUTES: Record<string, Route> = {
+  models: {
+    method: 'GET',
+    run: async (_req, deps, store) => ({ models: await anthropicModels(store.read().anthropic, deps.anthropicBase, deps.fetchImpl).catch(asApiError) }),
+  },
+};
+
+const BEDROCK_ROUTES: Record<string, Route> = {
+  models: {
+    method: 'GET',
+    run: async (_req, deps, store) => ({ models: await bedrockModels(store.read().bedrock, deps.bedrockControlBase, deps.fetchImpl).catch(asApiError) }),
+  },
+};
+
+const named = (table: Record<string, Route>, name: string, method: string | undefined): Route | number => {
+  const route = table[name];
+  if (route === undefined) return 404;
+  return route.method === method ? route : 405;
+};
+
+async function restore(req: IncomingMessage, store: Store, deps: ModelApiDeps): Promise<unknown> {
+  const body = await readJsonBody(req, RESTORE_MAX);
+  if (!isRecord(body)) throw new ApiError('body must be a JSON object', 400);
+  const next = parseModelConfig(body);
+  store.write(next);
+  syncAvailableModelsQuietly(deps.setup ?? {}, next);
+  log.info({ provider: next.provider }, 'model-api: model setup restored from a file');
+  return settingsBody(next);
+}
+
+function bundleRoute(path: string, method: string | undefined): Route | number {
+  if (path === BUNDLE) return method === 'GET' ? { method: 'GET', run: (_req, _deps, store) => Promise.resolve(store.read()) } : 405;
+  return method === 'POST' ? { method: 'POST', run: (req, deps, store) => restore(req, store, deps) } : 405;
+}
+
+function settingsRoute(method: string | undefined): Route | number {
+  if (method === 'GET') return { method: 'GET', run: (_req, deps, store) => settingsWithUsage(store.read(), deps) };
+  if (method === 'PUT') return { method: 'POST', run: (req, deps, store) => update(req, store, deps) };
+  return 405;
+}
+
+function codexRoute(rest: string, method: string | undefined): Route | number {
+  if (rest in CODEX_ROUTES) return named(CODEX_ROUTES, rest, method);
+  const id = rest.startsWith(DEVICE_PREFIX) ? rest.slice(DEVICE_PREFIX.length) : '';
+  if (!DEVICE_ID_RE.test(id)) return 404;
+  return method === 'GET' ? { method: 'GET', run: (_req, deps, store) => pollDevice(id, deps, store) } : 405;
+}
+
+const mine = (path: string): boolean =>
+  path === PATH || path === BUNDLE || path === RESTORE || path.startsWith(CODEX) || path.startsWith(OPENROUTER) || path.startsWith(ANTHROPIC) || path.startsWith(BEDROCK);
+
+function routeFor(path: string, method: string | undefined): Route | number {
+  if (path === PATH) return settingsRoute(method);
+  if (path === BUNDLE || path === RESTORE) return bundleRoute(path, method);
+  if (path.startsWith(OPENROUTER)) return named(OPENROUTER_ROUTES, path.slice(OPENROUTER.length), method);
+  if (path.startsWith(ANTHROPIC)) return named(ANTHROPIC_ROUTES, path.slice(ANTHROPIC.length), method);
+  if (path.startsWith(BEDROCK)) return named(BEDROCK_ROUTES, path.slice(BEDROCK.length), method);
+  return codexRoute(path.slice(CODEX.length), method);
+}
+
+export function handleModelRequest(req: IncomingMessage, res: ServerResponse, deps: ModelApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (!mine(path)) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  const route = routeFor(path, req.method);
+  if (typeof route === 'number') {
+    sendJson(req, res, route, { error: route === 404 ? 'not found' : 'method not allowed' });
+    return true;
+  }
+  const store: Store = { read: deps.read ?? readModelConfig, write: deps.write ?? writeModelConfig };
+  apiSession(req)
+    .then(async (session) => {
+      if (!session) throw new ApiError('unauthorized', 401);
+      deps.authorize(session.subject);
+      sendJson(req, res, 200, await route.run(req, deps, store));
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'model-api');
+    });
+  return true;
+}