@stage-labs/metro 0.1.0-beta.2 → 0.1.0-beta.21

package/runtime/node_modules/@metro-labs/mcp/src/daemon/http.ts

@@ -0,0 +1,357 @@
+import { handleSessionApis, type SessionApis } from './session-apis.js';
+import {
+  createServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from 'node:http';
+import { Line } from '../stations/lines.js';
+import { errMsg, log } from './log.js';
+import {
+  classifyEvent,
+  formatDisplay,
+  mintId,
+  publishEvent,
+  userSelf,
+  type MetroEvent,
+} from './events.js';
+import type { TrainEvent } from './protocol.js';
+import { agentForLine, agentIdForLine } from '../db/agent-map.js';
+import {
+  findEndpointByWebhookId,
+  listEndpoints,
+  tokenMatches,
+  webhookPort,
+  type Endpoint,
+} from './tunnel.js';
+import { attachmentEventUrl, handleAttachRequest } from './attach-serve.js';
+import { webhookEntry } from '@metro-labs/webhook';
+import { handleGoogleAuthRequest } from './google-oauth.js';
+import { handleUploadRequest } from './upload-api.js';
+import {
+  handleMonitorRequest,
+  type MonitorCall,
+} from '../monitor/api.js';
+import { applyMcpCors, handleMcpPreflight } from './cors.js';
+
+const LRU_CAP = 2_000;
+
+const METRO_VERSION = process.env.npm_package_version ?? '0.1.0-beta.15';
+
+function dedupKey(
+  e: Pick<MetroEvent, 'station' | 'line' | 'messageId'>,
+): string | null {
+  if (!e.messageId) return null;
+  return `${e.station} ${e.line} ${e.messageId}`;
+}
+
+export interface DedupSeq {
+  admit(entry: MetroEvent): number | null;
+}
+
+export function makeDedupSeq(): DedupSeq {
+  const seen = new Map<string, true>();
+  const seqByLine = new Map<string, number>();
+
+  log.info('dedup+seq: live-from-boot (no persisted seed)');
+
+  const isInbound = (e: MetroEvent): boolean => !Line.isLocal(e.from);
+
+  return {
+    admit(entry: MetroEvent): number | null {
+      const key = dedupKey(entry);
+      if (key && isInbound(entry)) {
+        if (seen.has(key)) {
+          log.debug(
+            {
+              station: entry.station,
+              line: entry.line,
+              messageId: entry.messageId,
+            },
+            'dedup: dropped duplicate inbound message',
+          );
+          return null;
+        }
+        seen.set(key, true);
+        while (seen.size > LRU_CAP) {
+          const oldest = seen.keys().next();
+          if (oldest.done) break;
+          seen.delete(oldest.value);
+        }
+      }
+      const next = (seqByLine.get(entry.line) ?? 0) + 1;
+      seqByLine.set(entry.line, next);
+      while (seqByLine.size > LRU_CAP) {
+        const oldest = seqByLine.keys().next();
+        if (oldest.done) break;
+        seqByLine.delete(oldest.value);
+      }
+      return next;
+    },
+  };
+}
+
+function withAttachmentUrl(entry: MetroEvent): MetroEvent {
+  const payload = entry.payload;
+  if (!payload || typeof payload !== 'object') return entry;
+  const agentId = agentIdForLine(entry.line);
+  if (agentId === undefined) return entry;
+  const url = attachmentEventUrl(payload as Record<string, unknown>, agentId);
+  if (!url) return entry;
+  return { ...entry, payload: { ...payload, url } };
+}
+
+type Emit = (entry: MetroEvent) => void;
+
+export function makeEmit(dedupSeq?: DedupSeq): Emit {
+  const tracker = dedupSeq ?? makeDedupSeq();
+  return function emit(entry: MetroEvent): void {
+    const seq = tracker.admit(entry);
+    if (seq === null) return;
+    const enriched: MetroEvent = withAttachmentUrl({
+      ...entry,
+      seq,
+      agent: entry.agent ?? agentForLine(entry.line),
+      display: entry.display ?? formatDisplay(entry),
+      event: entry.event ?? classifyEvent(entry),
+    });
+    process.stdout.write(JSON.stringify(enriched) + '\n');
+    publishEvent(enriched);
+  };
+}
+
+function eventText(env: TrainEvent): string | undefined {
+  if (env.text !== undefined) return env.text;
+  return env.emoji ? `[react ${env.emoji}]` : undefined;
+}
+
+export function trainEventToMetroEvent(
+  env: TrainEvent,
+  trainName: string,
+): MetroEvent | null {
+  const line = env.line;
+  if (typeof line !== 'string') {
+    log.warn({ train: trainName }, 'train: dropped event without `line`');
+    return null;
+  }
+  const station = env.station ?? Line.station(line) ?? trainName;
+  const isPrivate = env.is_private === true;
+  const text = eventText(env);
+  return {
+    event: env.event,
+    agent: agentForLine(line),
+    id: env.id ?? mintId(),
+    ts: env.ts ?? new Date().toISOString(),
+    station,
+    line: line as MetroEvent['line'],
+    lineName: env.line_name,
+    from: (env.from ?? `metro://${station}`) as MetroEvent['from'],
+    fromName: env.from_name,
+    fromDisplayName: env.from_display_name,
+    to: (env.to ?? (isPrivate ? userSelf() : line)) as MetroEvent['to'],
+    text,
+    messageId: env.message_id,
+    replyTo: env.reply_to,
+    payload: env.payload,
+  };
+}
+
+type McpHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+
+export async function startWebhookServer(
+  emit: Emit,
+  apis: SessionApis = {},
+  mcp?: McpHandler,
+  monitorCall?: MonitorCall,
+): Promise<Server> {
+  const port = webhookPort();
+  const server = createServer((req, res) => {
+    handleRequest(req, res, emit, apis, mcp, monitorCall).catch(
+      (err: unknown) => {
+      log.warn({ err: errMsg(err) }, 'webhook handler error');
+      if (!res.headersSent) res.writeHead(500).end();
+    });
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject);
+    const host = process.env.METRO_HTTP_HOST ?? '127.0.0.1';
+    server.listen(port, host, () => {
+      log.info(
+        {
+          host,
+          port,
+          endpoints: listEndpoints().length,
+          mcp: mcp ? '/' : 'off',
+        },
+        'webhook + mcp ready',
+      );
+      resolve();
+    });
+  });
+  return server;
+}
+
+function isMcpPath(req: IncomingMessage): boolean {
+  const path = (req.url ?? '').split('?')[0];
+  return path === '/' || path === '/mcp';
+}
+
+export const WEBHOOK_BODY_MAX = 25 * 1024 * 1024;
+
+export class BodyTooLargeError extends Error {
+  constructor(readonly limit: number) {
+    super(`request body exceeds ${limit} bytes`);
+  }
+}
+
+export async function readBody(
+  req: IncomingMessage,
+  maxBytes: number,
+): Promise<Buffer> {
+  const chunks: Buffer[] = [];
+  let total = 0;
+  for await (const c of req) {
+    const buf = c as Buffer;
+    total += buf.length;
+    if (total > maxBytes) throw new BodyTooLargeError(maxBytes);
+    chunks.push(buf);
+  }
+  return Buffer.concat(chunks);
+}
+
+function flatHeaders(req: IncomingMessage): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(req.headers).map(([k, v]) => [
+      k,
+      Array.isArray(v) ? v.join(',') : (v ?? ''),
+    ]),
+  );
+}
+
+function parseBody(raw: Buffer): unknown {
+  const text = raw.toString('utf8');
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+async function handleWebhookPost(
+  req: IncomingMessage,
+  res: ServerResponse,
+  emit: Emit,
+  endpointId: string,
+  endpoint: Endpoint,
+): Promise<void> {
+  let raw: Buffer;
+  try {
+    raw = await readBody(req, WEBHOOK_BODY_MAX);
+  } catch (err) {
+    if (!(err instanceof BodyTooLargeError)) throw err;
+    log.warn({ endpoint: endpointId, limit: err.limit }, 'webhook body too large — rejecting');
+    res.writeHead(413).end('payload too large');
+    return;
+  }
+  const body = parseBody(raw);
+  emit(
+    webhookEntry(
+      endpoint,
+      flatHeaders(req),
+      body,
+      req.method ?? 'POST',
+      hookPath(endpointId),
+    ),
+  );
+  res.writeHead(200).end('ok');
+}
+
+function handleHealth(req: IncomingMessage, res: ServerResponse): boolean {
+  const reqPath = (req.url ?? '').split('?')[0];
+  if (reqPath !== '/health' && reqPath !== '/healthz') return false;
+  res.writeHead(200, { 'content-type': 'application/json' }).end(
+    JSON.stringify({
+      status: 'ok',
+      version: METRO_VERSION,
+      uptime: Math.round(process.uptime()),
+    }),
+  );
+  return true;
+}
+
+const HOOK_PATH =
+  /^\/api\/webhooks\/([0-9]{17,20})\/([A-Za-z0-9_-]{32,128})$/;
+
+const HOOK_PREFIX = '/api/webhooks/';
+
+const hookPath = (webhookId: string): string => `${HOOK_PREFIX}${webhookId}`;
+
+function hookTarget(
+  path: string,
+): { id: string; endpoint: Endpoint } | null {
+  const m = HOOK_PATH.exec(path);
+  const webhookId = m?.[1];
+  const token = m?.[2];
+  if (webhookId === undefined || token === undefined) return null;
+  const endpoint = findEndpointByWebhookId(webhookId);
+  if (!endpoint?.secret || !tokenMatches(endpoint.secret, token)) return null;
+  return { id: webhookId, endpoint };
+}
+
+async function handleWebhookRoute(
+  req: IncomingMessage,
+  res: ServerResponse,
+  emit: Emit,
+): Promise<boolean> {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (!path.startsWith(HOOK_PREFIX)) return false;
+  const target = hookTarget(path);
+  if (target === null) {
+    res.writeHead(404).end();
+    return true;
+  }
+  if (req.method === 'GET') {
+    res.writeHead(200).end(`metro webhook ${target.id} ready\n`);
+    return true;
+  }
+  if (req.method !== 'POST') {
+    res.writeHead(405).end();
+    return true;
+  }
+  await handleWebhookPost(req, res, emit, target.id, target.endpoint);
+  return true;
+}
+
+async function handlePreMcpRoutes(
+  req: IncomingMessage,
+  res: ServerResponse,
+  emit: Emit,
+  apis: SessionApis,
+  monitorCall?: MonitorCall,
+): Promise<boolean> {
+  if (handleHealth(req, res)) return true;
+  if (await handleGoogleAuthRequest(req, res)) return true;
+  if (handleSessionApis(req, res, apis)) return true;
+  if (handleUploadRequest(req, res)) return true;
+  if (handleAttachRequest(req, res)) return true;
+  if (await handleWebhookRoute(req, res, emit)) return true;
+  return Boolean(monitorCall && handleMonitorRequest(req, res, monitorCall));
+}
+
+async function handleRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  emit: Emit,
+  apis: SessionApis = {},
+  mcp?: McpHandler,
+  monitorCall?: MonitorCall,
+): Promise<void> {
+  if (await handlePreMcpRoutes(req, res, emit, apis, monitorCall)) return;
+  if (mcp && isMcpPath(req)) {
+    applyMcpCors(req, res);
+    if (handleMcpPreflight(req, res)) return;
+    await mcp(req, res);
+    return;
+  }
+  res.writeHead(404).end();
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/identity.ts

@@ -0,0 +1,79 @@
+import { execFileSync } from 'node:child_process';
+import { errMsg, log } from './log.js';
+import { Line } from '../stations/lines.js';
+
+const TTL_MS = 5_000;
+type Cache = { id: string; at: number } | null;
+
+function memo(loader: () => string): () => string {
+  let cache: Cache = null;
+  return () => {
+    if (cache && Date.now() - cache.at < TTL_MS) return cache.id;
+    const id = loader();
+    cache = { id, at: Date.now() };
+    return id;
+  };
+}
+
+const claudeAccountId = memo(() => {
+  let raw: string;
+  try {
+    raw = execFileSync('claude', ['auth', 'status', '--json'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+  } catch (e) {
+    throw new Error(
+      `metro: failed to run 'claude auth status --json' — is Claude Code installed? (${errMsg(e)})`,
+    );
+  }
+  let p: { loggedIn?: boolean; orgId?: string };
+  try {
+    p = JSON.parse(raw) as { loggedIn?: boolean; orgId?: string };
+  } catch {
+    throw new Error(
+      `metro: 'claude auth status --json' returned non-JSON: ${raw.slice(0, 200)}`,
+    );
+  }
+  if (!p.loggedIn || !p.orgId)
+    throw new Error(
+      "metro: Claude Code is not logged in — run 'claude auth login'",
+    );
+  return p.orgId;
+});
+
+export const claudeUserId = (): string =>
+  process.env.METRO_USER_ID ?? claudeAccountId();
+
+export const claudeSessionId = (): string | null =>
+  process.env.METRO_USER_SESSION_ID ??
+  process.env.CLAUDE_CODE_SESSION_ID ??
+  null;
+
+export function userSelf(): Line {
+  const explicit = process.env.METRO_FROM;
+  if (explicit) return explicit as Line;
+  if (!process.env.CLAUDECODE) return 'metro://user' as Line;
+  try {
+    return Line.user('claude', claudeUserId());
+  } catch (e) {
+    log.warn(
+      { reason: errMsg(e) },
+      'could not resolve a Claude account id; relaying as metro://user',
+    );
+    return 'metro://user' as Line;
+  }
+}
+
+export function daemonSelf(): Line {
+  const explicit = process.env.METRO_FROM ?? process.env.METRO_SELF_URI;
+  return (explicit ?? 'metro://user') as Line;
+}
+
+export function selfLine(): Line | null {
+  if (process.env.CLAUDECODE) {
+    const s = claudeSessionId();
+    return s ? Line.claude(claudeUserId(), s) : null;
+  }
+  return null;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/log.ts

@@ -0,0 +1,42 @@
+import { writeSync } from 'node:fs';
+import pino from 'pino';
+import pinoPretty from 'pino-pretty';
+
+const stream = process.stderr.isTTY
+  ? pinoPretty({
+      colorize: true,
+      translateTime: 'HH:MM:ss',
+      ignore: 'pid,hostname,name',
+      destination: 2,
+    })
+  : pino.destination(2);
+
+export const log = pino(
+  { base: { name: 'metro' }, level: process.env.METRO_LOG_LEVEL ?? 'info' },
+  stream,
+);
+
+export const logFatalSync = (
+  fields: Record<string, unknown>,
+  msg: string,
+): void => {
+  const line = JSON.stringify({
+    level: 60,
+    time: Date.now(),
+    name: 'metro',
+    ...fields,
+    msg,
+  });
+  try {
+    writeSync(2, `${line}\n`);
+  } catch {
+    return;
+  }
+};
+
+export const errMsg = (err: unknown): string => {
+  if (err instanceof Error) return err.message;
+  if (err && typeof err === 'object' && 'message' in err)
+    return String(err.message);
+  return String(err);
+};

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-client.ts

@@ -0,0 +1,162 @@
+import { createHash, randomBytes } from 'node:crypto';
+import {
+  ConnectorVerifyError,
+  type OAuthTokens,
+} from './connector-verify.js';
+import type { OAuthServer } from './oauth-discovery.js';
+
+const TOKEN_TIMEOUT_MS = 15_000;
+const CLIENT_NAME = 'Metro';
+
+export interface OAuthClient {
+  clientId: string;
+  clientSecret?: string;
+}
+
+function refused(message: string): ConnectorVerifyError {
+  return new ConnectorVerifyError(message, 400);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+export function newVerifier(): string {
+  return randomBytes(32).toString('base64url');
+}
+
+export function challengeOf(verifier: string): string {
+  return createHash('sha256').update(verifier).digest('base64url');
+}
+
+export async function registerClient(
+  server: OAuthServer,
+  redirectUri: string,
+): Promise<OAuthClient> {
+  if (server.registrationEndpoint === null)
+    throw refused(
+      'That server requires OAuth but does not accept client registration, so Metro cannot sign in to it.',
+    );
+  let res: Response;
+  try {
+    res = await fetch(server.registrationEndpoint, {
+      method: 'POST',
+      redirect: 'manual',
+      signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+      headers: { 'content-type': 'application/json', accept: 'application/json' },
+      body: JSON.stringify({
+        client_name: CLIENT_NAME,
+        redirect_uris: [redirectUri],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+      }),
+    });
+  } catch {
+    throw refused('Metro could not reach that server to register.');
+  }
+  const body: unknown = await res.json().catch(() => null);
+  if (!res.ok || !isRecord(body) || typeof body.client_id !== 'string')
+    throw refused('That server refused to register Metro as a client.');
+  const secret = body.client_secret;
+  return {
+    clientId: body.client_id,
+    ...(typeof secret === 'string' ? { clientSecret: secret } : {}),
+  };
+}
+
+export interface AuthorizeInput {
+  server: OAuthServer;
+  client: OAuthClient;
+  redirectUri: string;
+  state: string;
+  verifier: string;
+  resource: string;
+}
+
+export function authorizeUrl(input: AuthorizeInput): string {
+  const url = new URL(input.server.authorizationEndpoint);
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('client_id', input.client.clientId);
+  url.searchParams.set('redirect_uri', input.redirectUri);
+  url.searchParams.set('state', input.state);
+  url.searchParams.set('code_challenge', challengeOf(input.verifier));
+  url.searchParams.set('code_challenge_method', 'S256');
+  url.searchParams.set('resource', input.resource);
+  return url.toString();
+}
+
+function tokensFrom(body: Record<string, unknown>): OAuthTokens {
+  const access = body.access_token;
+  if (typeof access !== 'string' || access === '')
+    throw refused('That server did not return an access token.');
+  const refresh = body.refresh_token;
+  const expires = body.expires_in;
+  return {
+    accessToken: access,
+    ...(typeof refresh === 'string' ? { refreshToken: refresh } : {}),
+    ...(typeof expires === 'number'
+      ? { expiresAt: Date.now() + expires * 1000 }
+      : {}),
+  };
+}
+
+async function postToken(
+  server: OAuthServer,
+  client: OAuthClient,
+  form: Record<string, string>,
+): Promise<OAuthTokens> {
+  const params = new URLSearchParams({
+    ...form,
+    client_id: client.clientId,
+    ...(client.clientSecret === undefined
+      ? {}
+      : { client_secret: client.clientSecret }),
+  });
+  let res: Response;
+  try {
+    res = await fetch(server.tokenEndpoint, {
+      method: 'POST',
+      redirect: 'manual',
+      signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+      headers: {
+        'content-type': 'application/x-www-form-urlencoded',
+        accept: 'application/json',
+      },
+      body: params.toString(),
+    });
+  } catch {
+    throw refused('Metro could not reach that server to finish signing in.');
+  }
+  const body: unknown = await res.json().catch(() => null);
+  if (!res.ok || !isRecord(body))
+    throw refused('That server refused to complete the sign-in.');
+  return tokensFrom(body);
+}
+
+export function exchangeCode(
+  server: OAuthServer,
+  client: OAuthClient,
+  input: { code: string; redirectUri: string; verifier: string; resource: string },
+): Promise<OAuthTokens> {
+  return postToken(server, client, {
+    grant_type: 'authorization_code',
+    code: input.code,
+    redirect_uri: input.redirectUri,
+    code_verifier: input.verifier,
+    resource: input.resource,
+  });
+}
+
+export function refreshTokens(
+  server: OAuthServer,
+  client: OAuthClient,
+  refreshToken: string,
+  resource: string,
+): Promise<OAuthTokens> {
+  return postToken(server, client, {
+    grant_type: 'refresh_token',
+    refresh_token: refreshToken,
+    resource,
+  });
+}