@stage-labs/metro 0.1.0-beta.2 → 0.1.0-beta.200

package/runtime/node_modules/@metro-labs/daemon/src/vault/store.ts

@@ -0,0 +1,130 @@
+import { existsSync, rmSync } from 'node:fs';
+import { ApiError } from '@metro-labs/http/api-error';
+import { isRecord } from '@metro-labs/core/is-record';
+import { newId } from '@metro-labs/core/ids';
+import { ensureSecureDir, readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { stateFile, valueFile, valuesDir, vaultDir } from './paths.js';
+
+export interface VaultSecret {
+  id: string;
+  name: string;
+  env: string;
+  hosts: string[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface VaultState {
+  version: 1;
+  enabled: boolean;
+  secrets: VaultSecret[];
+}
+
+export interface SecretInput {
+  name?: unknown;
+  env?: unknown;
+  hosts?: unknown;
+  value?: unknown;
+}
+
+const ENV_RE = /^[A-Z][A-Z0-9_]{2,63}$/;
+const HOST_RE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+const RESERVED_ENV = new Set(['HOME', 'PATH', 'USER', 'SHELL', 'LANG', 'TERM', 'LOGNAME', 'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'ALL_PROXY']);
+const MAX_SECRETS = 100;
+const MAX_HOSTS = 20;
+const MAX_VALUE = 16 * 1024;
+
+const str = (v: unknown): string => (typeof v === 'string' ? v : '');
+
+function secretOf(raw: unknown): VaultSecret | null {
+  if (!isRecord(raw) || typeof raw.id !== 'string' || !ENV_RE.test(str(raw.env))) return null;
+  const hosts = Array.isArray(raw.hosts) ? raw.hosts.filter((h): h is string => typeof h === 'string' && HOST_RE.test(h)) : [];
+  return { id: raw.id, name: str(raw.name) || str(raw.env), env: str(raw.env), hosts, createdAt: str(raw.createdAt), updatedAt: str(raw.updatedAt) };
+}
+
+export function readVault(dir = vaultDir()): VaultState {
+  const raw = readJson<unknown>(stateFile(dir), null);
+  if (!isRecord(raw)) return { version: 1, enabled: false, secrets: [] };
+  const secrets = Array.isArray(raw.secrets) ? raw.secrets.map(secretOf).filter((s): s is VaultSecret => s !== null) : [];
+  return { version: 1, enabled: raw.enabled === true, secrets };
+}
+
+export function writeVault(state: VaultState, dir = vaultDir()): void {
+  ensureSecureDir(dir);
+  writeSecure(stateFile(dir), `${JSON.stringify(state, null, 2)}\n`);
+}
+
+export function normalizeName(raw: unknown): string {
+  const name = str(raw).trim();
+  if (name === '' || name.length > 80) throw new ApiError('a name of 1 to 80 characters is required', 400);
+  return name;
+}
+
+export function normalizeEnv(raw: unknown): string {
+  const env = str(raw).trim();
+  if (!ENV_RE.test(env) || RESERVED_ENV.has(env))
+    throw new ApiError('the variable name must be capital letters, digits and _, 3 to 64 long, like OPENAI_API_KEY', 400);
+  return env;
+}
+
+export function normalizeHosts(raw: unknown): string[] {
+  if (!Array.isArray(raw)) throw new ApiError('hosts must be a list of websites, like api.openai.com', 400);
+  const hosts = [...new Set(raw.map((h) => str(h).trim().toLowerCase().replace(/^https?:\/\//, '').replace(/\/.*$/, '')).filter((h) => h !== ''))];
+  if (hosts.length === 0 || hosts.length > MAX_HOSTS) throw new ApiError(`a secret needs 1 to ${String(MAX_HOSTS)} websites`, 400);
+  const bad = hosts.find((h) => !HOST_RE.test(h));
+  if (bad !== undefined) throw new ApiError(`'${bad}' is not a website name; write it as api.example.com or *.example.com`, 400);
+  return hosts;
+}
+
+export function normalizeValue(raw: unknown): string {
+  const value = str(raw).trim();
+  if (value === '' || value.length > MAX_VALUE) throw new ApiError('a value of 1 to 16384 characters is required', 400);
+  return value;
+}
+
+function saveValue(id: string, value: string, dir: string): void {
+  ensureSecureDir(valuesDir(dir));
+  writeSecure(valueFile(id, dir), value);
+}
+
+export function addSecret(input: SecretInput, dir = vaultDir(), now = new Date()): VaultSecret {
+  const state = readVault(dir);
+  if (state.secrets.length >= MAX_SECRETS) throw new ApiError(`at most ${String(MAX_SECRETS)} secrets`, 400);
+  const env = normalizeEnv(input.env);
+  if (state.secrets.some((s) => s.env === env)) throw new ApiError(`${env} is already a secret`, 409);
+  const at = now.toISOString();
+  const secret: VaultSecret = { id: newId(), name: normalizeName(input.name ?? env), env, hosts: normalizeHosts(input.hosts), createdAt: at, updatedAt: at };
+  saveValue(secret.id, normalizeValue(input.value), dir);
+  writeVault({ ...state, secrets: [...state.secrets, secret] }, dir);
+  return secret;
+}
+
+export function updateSecret(id: string, input: SecretInput, dir = vaultDir(), now = new Date()): VaultSecret {
+  const state = readVault(dir);
+  const found = state.secrets.find((s) => s.id === id);
+  if (found === undefined) throw new ApiError('no such secret', 404);
+  const next: VaultSecret = {
+    ...found,
+    ...(input.name === undefined ? {} : { name: normalizeName(input.name) }),
+    ...(input.hosts === undefined ? {} : { hosts: normalizeHosts(input.hosts) }),
+    updatedAt: now.toISOString(),
+  };
+  if (input.value !== undefined) saveValue(id, normalizeValue(input.value), dir);
+  writeVault({ ...state, secrets: state.secrets.map((s) => (s.id === id ? next : s)) }, dir);
+  return next;
+}
+
+export function removeSecret(id: string, dir = vaultDir()): void {
+  const state = readVault(dir);
+  if (!state.secrets.some((s) => s.id === id)) throw new ApiError('no such secret', 404);
+  writeVault({ ...state, secrets: state.secrets.filter((s) => s.id !== id) }, dir);
+  rmSync(valueFile(id, dir), { force: true });
+}
+
+export function setVaultEnabled(enabled: boolean, dir = vaultDir()): VaultState {
+  const next = { ...readVault(dir), enabled };
+  writeVault(next, dir);
+  return next;
+}
+
+export const hasValue = (id: string, dir = vaultDir()): boolean => existsSync(valueFile(id, dir));

package/runtime/node_modules/@metro-labs/daemon/src/vault/trust.ts

@@ -0,0 +1,61 @@
+import { spawnSync } from 'node:child_process';
+import { copyFileSync, chmodSync, existsSync, readFileSync, rmSync } from 'node:fs';
+import { errMsg, log } from '@metro-labs/core/log';
+import { asUser, type AgentUser } from '../agent-user/user.js';
+import { TRUSTED_CA } from './paths.js';
+import { mustHelper, rootHelper, runningAsMetro } from '../metro-user/privilege.js';
+
+const has = (bin: string): boolean => spawnSync('sh', ['-c', `command -v ${bin}`], { stdio: 'ignore' }).status === 0;
+
+export function trustSystem(caFile: string): void {
+  const same = existsSync(TRUSTED_CA) && readFileSync(TRUSTED_CA, 'utf8') === readFileSync(caFile, 'utf8');
+  if (same) return;
+  if (runningAsMetro()) {
+    mustHelper(['trust-ca']);
+    return;
+  }
+  copyFileSync(caFile, TRUSTED_CA);
+  chmodSync(TRUSTED_CA, 0o644);
+  const run = spawnSync('update-ca-certificates', [], { encoding: 'utf8' });
+  if (run.status !== 0) throw new Error(`update-ca-certificates failed: ${run.stderr.trim()}`);
+}
+
+export function untrustSystem(): void {
+  if (!existsSync(TRUSTED_CA)) return;
+  if (runningAsMetro()) {
+    mustHelper(['untrust-ca']);
+    return;
+  }
+  rmSync(TRUSTED_CA, { force: true });
+  spawnSync('update-ca-certificates', ['--fresh'], { stdio: 'ignore' });
+}
+
+const NSS_SCRIPT = [
+  'set -e',
+  'db="$HOME/.pki/nssdb"',
+  'mkdir -p "$db"',
+  '[ -f "$db/cert9.db" ] || certutil -d "sql:$db" -N --empty-password',
+  'certutil -d "sql:$db" -D -n "Metro vault" >/dev/null 2>&1 || true',
+  'certutil -d "sql:$db" -A -t "C,," -n "Metro vault" -i "$1"',
+].join('\n');
+
+function ensureCertutil(): boolean {
+  if (has('certutil')) return true;
+  if (runningAsMetro()) return rootHelper(['install-nss-tools']).status === 0 && has('certutil');
+  if (!has('apt-get')) return false;
+  const run = spawnSync('apt-get', ['install', '-y', '-q', 'libnss3-tools'], { stdio: 'ignore', timeout: 180_000, env: { ...process.env, DEBIAN_FRONTEND: 'noninteractive' } });
+  return run.status === 0 && has('certutil');
+}
+
+export function trustBrowsers(user: AgentUser): string | null {
+  try {
+    if (!ensureCertutil()) return 'certutil is missing, so browsers the agent starts will not trust the vault (apt-get install libnss3-tools)';
+    const [file, argv] = asUser(user, 'sh', ['-c', NSS_SCRIPT, 'metro', TRUSTED_CA]);
+    const run = spawnSync(file, argv, { encoding: 'utf8', timeout: 30_000 });
+    if (run.status !== 0) return `browsers will not trust the vault: ${run.stderr.trim()}`;
+    return null;
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'vault: could not add the certificate for browsers');
+    return errMsg(err);
+  }
+}

package/runtime/node_modules/@metro-labs/discord-bot/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@metro-labs/discord-bot",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/station.ts",
+    "./train": "./src/index.ts",
+    "./verify": "./src/verify.ts"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "tsc --noEmit && bun test test/"
+  },
+  "dependencies": {
+    "@metro-labs/core": "workspace:*",
+    "discord.js": "^14.26.4"
+  },
+  "devDependencies": {
+    "@stage-labs/config": "0.1.0-beta.2",
+    "eslint": "^10.3.0",
+    "knip": "^6.15.0",
+    "madge": "^8.0.0",
+    "typescript": "^5"
+  }
+}

package/runtime/node_modules/@metro-labs/discord-bot/src/accounts.ts

@@ -0,0 +1,117 @@
+import { Client } from 'discord.js';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import {
+  makeAccountStore,
+  resolveAccountId,
+} from '@metro-labs/core/stations/account-store';
+import { Line } from '@metro-labs/core/lines';
+import { emit } from './wire.js';
+import { API } from './api-base.js';
+
+const ACCOUNTS_FILE =
+  process.env.DISCORD_BOT_ACCOUNTS_FILE ??
+  join(homedir(), '.metro', 'discord-bot-accounts.json');
+
+export interface AccountConfig {
+  id: string;
+  token: string;
+}
+
+export const { loadAccounts } = makeAccountStore<AccountConfig>({
+  prefix: 'discord-bot',
+  file: ACCOUNTS_FILE,
+  validate(raw, die) {
+    const seen = new Set<string>();
+    for (const a of raw) {
+      if (!a.id) die('account missing id');
+      if (!a.token || typeof a.token !== 'string')
+        die(`account '${a.id}' missing token`);
+      if (seen.has(a.id)) die(`duplicate account id '${a.id}'`);
+      seen.add(a.id);
+    }
+  },
+});
+
+export interface Account {
+  cfg: AccountConfig;
+  client: Client;
+}
+export const accounts = new Map<string, Account>();
+
+function restBody(
+  body: unknown,
+  isForm: boolean,
+): RequestInit['body'] | undefined {
+  if (body === undefined) return undefined;
+  return isForm ? (body as RequestInit['body']) : JSON.stringify(body);
+}
+
+async function restResult<T>(res: Response): Promise<T> {
+  if (res.status === 204) return undefined as T;
+  const ctype = res.headers.get('content-type') ?? '';
+  if (ctype.includes('application/json')) return res.json() as Promise<T>;
+  return res.arrayBuffer().then((b) => Buffer.from(b) as unknown as T);
+}
+
+export async function rest<T = unknown>(
+  accountId: string,
+  method: string,
+  path: string,
+  body?: unknown,
+  isForm = false,
+): Promise<T> {
+  const acct = accounts.get(accountId);
+  if (!acct) throw new Error(`unknown account '${accountId}'`);
+  const headers: Record<string, string> = {
+    Authorization: `Bot ${acct.cfg.token}`,
+    'User-Agent': 'metro-discord-bot-train (https://github.com/bonustrack/stage)',
+  };
+  if (body !== undefined && !isForm)
+    headers['Content-Type'] = 'application/json';
+  emit({ op: 'log', text: `discord-bot[${accountId}] api ${method} ${path}` });
+  const res = await fetch(`${API}${path}`, {
+    method,
+    headers,
+    body: restBody(body, isForm),
+    signal: AbortSignal.timeout(30_000),
+  });
+  emit({
+    op: 'log',
+    text: `discord-bot[${accountId}] api ${method} ${path} -> ${res.status}`,
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => '');
+    throw new Error(`discord-bot ${method} ${path}: ${res.status} ${text}`);
+  }
+  return restResult<T>(res);
+}
+
+export function lineOf(accountId: string, channelId: string): string {
+  return `metro://discord-bot/${accountId}/${channelId}`;
+}
+
+export function parseLine(
+  line: string,
+): { accountId: string; channelId: string } | null {
+  const p = Line.parseDiscord(line);
+  return p ? { accountId: p.accountId, channelId: p.resource } : null;
+}
+
+export function accountFor(args: { account?: string; line?: string }): string {
+  return resolveAccountId(accounts, args, (line) => parseLine(line)?.accountId);
+}
+
+export function routeOf(
+  line: string,
+  account?: string,
+): { accountId: string; channelId: string } {
+  const parsed = parseLine(line);
+  if (!parsed) throw new Error(`bad discord-bot line: ${line}`);
+  const accountId = account ?? parsed.accountId;
+  if (!accounts.has(accountId))
+    throw new Error(`unknown account '${accountId}' in line ${line}`);
+  return { accountId, channelId: parsed.channelId };
+}
+
+export const encodeEmoji = (e: string): string => encodeURIComponent(e);

package/runtime/node_modules/@metro-labs/discord-bot/src/actions.ts

@@ -0,0 +1,240 @@
+import type { Message } from 'discord.js';
+import {
+  accounts,
+  encodeEmoji,
+  rest,
+  routeOf,
+} from './accounts.js';
+import { emitOutbound, emitOutboundEdit, emitOutboundReact } from './format.js';
+import { respond } from './wire.js';
+import { normalizeDiscord } from '@metro-labs/core/stations/messaging-normalize';
+import {
+  appendFiles,
+  outgoingFiles,
+  type OutgoingFile,
+} from './send-files.js';
+import {
+  makeStation,
+  type CallMsg,
+  type StationHandler,
+} from '@metro-labs/core/stations/station-runtime';
+import { readProfile, setProfile } from './profile.js';
+import { discordMembers } from './members.js';
+import {
+  groupAddHandler,
+  groupCreateHandler,
+  groupRemoveHandler,
+} from './group-actions.js';
+
+async function sendMessage(
+  accountId: string,
+  channel: string,
+  body: Record<string, unknown>,
+  files: OutgoingFile[],
+): Promise<{ id: string; delivered: string[] }> {
+  if (files.length === 0) {
+    const plain = await rest<{ id: string }>(
+      accountId,
+      'POST',
+      `/channels/${channel}/messages`,
+      body,
+    );
+    return { id: plain.id, delivered: [] };
+  }
+  const form = new FormData();
+  form.append('payload_json', JSON.stringify(body));
+  const delivered = await appendFiles(form, files);
+  const res = await rest<{ id: string }>(
+    accountId,
+    'POST',
+    `/channels/${channel}/messages`,
+    form,
+    true,
+  );
+  return { id: res.id, delivered };
+}
+
+export type { CallMsg };
+
+async function send(id: string, args: Record<string, unknown>): Promise<void> {
+  const {
+    line,
+    text,
+    replyTo,
+    embeds,
+    stickerIds,
+    images,
+    files,
+    account,
+    attachmentKinds,
+    attachmentNames,
+  } = args as {
+    line: string;
+    text?: string;
+    replyTo?: string;
+    embeds?: unknown[];
+    stickerIds?: string[];
+    images?: string[];
+    files?: string[];
+    account?: string;
+    attachmentKinds?: string[];
+    attachmentNames?: string[];
+  };
+  const { accountId, channelId } = routeOf(line, account);
+  const body: Record<string, unknown> = { flags: 4 };
+  if (text !== undefined) body.content = text;
+  if (replyTo) body.message_reference = { message_id: replyTo };
+  if (embeds) body.embeds = embeds;
+  if (stickerIds) body.sticker_ids = stickerIds;
+  const outgoing = outgoingFiles(
+    [...(images ?? []), ...(files ?? [])],
+    attachmentNames,
+    attachmentKinds,
+  );
+  const res = await sendMessage(accountId, channelId, body, outgoing);
+  emitOutbound(accountId, line, res.id, text ?? '', replyTo);
+  respond(id, {
+    result: {
+      messageId: res.id,
+      account: accountId,
+      ...(res.delivered.length ? { attachments: res.delivered } : {}),
+    },
+  });
+}
+
+const profileUrl = (userId?: string): string | null =>
+  userId === undefined ? null : `https://discord.com/users/${userId}`;
+
+function listAccounts(id: string): void {
+  respond(id, {
+    result: {
+      accounts: [...accounts.values()].map((a) => ({
+        id: a.cfg.id,
+        handle: a.client.user?.username ?? null,
+        url: profileUrl(a.client.user?.id),
+        userId: a.client.user?.id ?? null,
+        username: a.client.user?.username ?? null,
+        ready: a.client.isReady(),
+      })),
+    },
+  });
+}
+
+async function react(id: string, args: Record<string, unknown>): Promise<void> {
+  const { line, messageId, emoji, account } = args as {
+    line: string;
+    messageId: string;
+    emoji: string;
+    account?: string;
+  };
+  const { accountId, channelId } = routeOf(line, account);
+  if (emoji) {
+    const e = encodeEmoji(emoji);
+    await rest(
+      accountId,
+      'PUT',
+      `/channels/${channelId}/messages/${messageId}/reactions/${e}/@me`,
+    );
+    emitOutboundReact(accountId, line, messageId, emoji);
+  } else {
+    await rest(
+      accountId,
+      'DELETE',
+      `/channels/${channelId}/messages/${messageId}/reactions/@me`,
+    );
+  }
+  respond(id, { result: { ok: true, account: accountId } });
+}
+
+async function edit(id: string, args: Record<string, unknown>): Promise<void> {
+  const { line, messageId, text, account } = args as {
+    line: string;
+    messageId: string;
+    text: string;
+    account?: string;
+  };
+  const { accountId, channelId } = routeOf(line, account);
+  await rest(accountId, 'PATCH', `/channels/${channelId}/messages/${messageId}`, {
+    content: text,
+  });
+  emitOutboundEdit(accountId, line, messageId, text);
+  respond(id, { result: { ok: true, account: accountId } });
+}
+
+async function remove(
+  id: string,
+  args: Record<string, unknown>,
+): Promise<void> {
+  const { line, messageId, account } = args as {
+    line: string;
+    messageId: string;
+    account?: string;
+  };
+  const { accountId, channelId } = routeOf(line, account);
+  await rest(accountId, 'DELETE', `/channels/${channelId}/messages/${messageId}`);
+  respond(id, { result: { ok: true, account: accountId } });
+}
+
+async function fetchMessages(
+  id: string,
+  args: Record<string, unknown>,
+): Promise<void> {
+  const {
+    line,
+    limit = 20,
+    before,
+    account,
+  } = args as {
+    line: string;
+    limit?: number;
+    before?: string;
+    account?: string;
+  };
+  const { accountId, channelId } = routeOf(line, account);
+  const qs = new URLSearchParams({
+    limit: String(limit),
+    ...(before ? { before } : {}),
+  });
+  const msgs = await rest<Message[]>(
+    accountId,
+    'GET',
+    `/channels/${channelId}/messages?${qs}`,
+  );
+  respond(id, { result: { messages: msgs, account: accountId } });
+}
+
+async function listMembers(
+  id: string,
+  args: Record<string, unknown>,
+): Promise<void> {
+  const { line, limit, account } = args as {
+    line: string;
+    limit?: number;
+    account?: string;
+  };
+  const { accountId, channelId } = routeOf(line, account);
+  const result = await discordMembers(accountId, channelId, limit);
+  respond(id, { result });
+}
+
+const HANDLERS: Record<string, StationHandler> = {
+  accounts: (id) => {
+    listAccounts(id);
+  },
+  groupCreate: groupCreateHandler,
+  groupAddMembers: groupAddHandler,
+  groupRemoveMembers: groupRemoveHandler,
+  send,
+  react,
+  edit,
+  delete: remove,
+  fetch: fetchMessages,
+  listMembers,
+  set_profile: setProfile,
+  profile: readProfile,
+};
+
+export const handleCall = makeStation({
+  handlers: HANDLERS,
+  normalize: normalizeDiscord,
+});

package/runtime/node_modules/@metro-labs/discord-bot/src/api-base.ts

@@ -0,0 +1 @@
+export const API = 'https://discord.com/api/v10';

package/runtime/node_modules/@metro-labs/discord-bot/src/attachments.ts

@@ -0,0 +1,29 @@
+import {
+  saveBufferToCache,
+  assertContentLength,
+} from '@metro-labs/core/stations/attachments';
+import type { SavedAttachment } from '@metro-labs/core/stations/attachments';
+
+export type { SavedAttachment };
+
+export interface DiscordAttachmentRef {
+  url: string;
+  name?: string | null;
+  contentType?: string | null;
+}
+
+export async function saveDiscordAttachment(
+  a: DiscordAttachmentRef,
+  messageId: string,
+  index = 0,
+): Promise<SavedAttachment> {
+  const res = await fetch(a.url, { signal: AbortSignal.timeout(60_000) });
+  if (!res.ok)
+    throw new Error(`discord-bot attachment fetch ${res.status} for ${a.url}`);
+  assertContentLength(res.headers.get('content-length'));
+  const data = new Uint8Array(await res.arrayBuffer());
+  return saveBufferToCache(data, messageId, index, {
+    mime: a.contentType ?? undefined,
+    name: a.name ?? undefined,
+  });
+}