@stage-labs/metro 0.1.0-beta.21 → 0.1.0-beta.210

package/runtime/node_modules/@metro-labs/daemon/src/vault/install.ts

@@ -0,0 +1,56 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { chmodSync, copyFileSync, existsSync, mkdtempSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { ensureSecureDir } from '@metro-labs/core/secure-fs';
+import { binDir, caDir, PROXY_VERSION, proxyBin, vaultDir } from './paths.js';
+
+const RELEASES = `https://github.com/ironsh/iron-proxy/releases/download/v${PROXY_VERSION}`;
+
+export const archiveName = (arch = process.arch): string => `iron-proxy_${PROXY_VERSION}_linux_${arch === 'arm64' ? 'arm64' : 'amd64'}.tar.gz`;
+
+export function expectedSum(checksums: string, file: string): string | null {
+  const line = checksums.split('\n').find((l) => l.trim().endsWith(` ${file}`));
+  const sum = line?.trim().split(/\s+/)[0];
+  return sum !== undefined && /^[0-9a-f]{64}$/.test(sum) ? sum : null;
+}
+
+async function download(url: string): Promise<Buffer> {
+  const res = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(120_000) });
+  if (!res.ok) throw new Error(`${url} answered ${String(res.status)}`);
+  return Buffer.from(await res.arrayBuffer());
+}
+
+export async function ensureProxyBinary(dir = vaultDir()): Promise<string> {
+  const bin = proxyBin(dir);
+  if (existsSync(bin)) return bin;
+  const file = archiveName();
+  const [archive, checksums] = await Promise.all([download(`${RELEASES}/${file}`), download(`${RELEASES}/checksums.txt`)]);
+  const want = expectedSum(checksums.toString('utf8'), file);
+  const got = createHash('sha256').update(archive).digest('hex');
+  if (want === null || want !== got) throw new Error(`the iron-proxy download does not match its checksum (${file})`);
+  const work = mkdtempSync(join(tmpdir(), 'metro-iron-'));
+  try {
+    writeFileSync(join(work, file), archive);
+    const untar = spawnSync('tar', ['-xzf', file, 'iron-proxy'], { cwd: work, encoding: 'utf8' });
+    if (untar.status !== 0) throw new Error(`could not unpack iron-proxy: ${untar.stderr.trim()}`);
+    ensureSecureDir(binDir(dir));
+    copyFileSync(join(work, 'iron-proxy'), `${bin}.part`);
+    chmodSync(`${bin}.part`, 0o755);
+    renameSync(`${bin}.part`, bin);
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+  }
+  return bin;
+}
+
+export function ensureAuthority(bin: string, dir = vaultDir()): string {
+  const cert = join(caDir(dir), 'ca.crt');
+  if (existsSync(cert) && existsSync(join(caDir(dir), 'ca.key'))) return cert;
+  ensureSecureDir(caDir(dir));
+  const made = spawnSync(bin, ['generate-ca', '-outdir', caDir(dir), '-name', 'Metro vault', '-expiry-hours', '87600', '-alg', 'rsa4096'], { encoding: 'utf8' });
+  if (made.status !== 0) throw new Error(`could not create the vault certificate: ${made.stderr.trim()}`);
+  chmodSync(join(caDir(dir), 'ca.key'), 0o600);
+  return cert;
+}

package/runtime/node_modules/@metro-labs/daemon/src/vault/paths.ts

@@ -0,0 +1,26 @@
+import { join } from 'node:path';
+import { agentsDir } from '../agents/files.js';
+
+export const PROXY_VERSION = '0.50.0';
+
+const basePort = (): number => {
+  const raw = Number(process.env.METRO_VAULT_PORT);
+  return Number.isInteger(raw) && raw > 1024 && raw < 65000 ? raw : 8421;
+};
+
+export const ports = (): { tunnel: number; http: number; https: number; management: number; metrics: number } => {
+  const base = basePort();
+  return { tunnel: base, http: base + 1, https: base + 2, management: base + 3, metrics: base + 4 };
+};
+
+export const vaultDir = (dir = agentsDir()): string => join(dir, 'vault');
+export const stateFile = (dir = vaultDir()): string => join(dir, 'vault.json');
+export const valuesDir = (dir = vaultDir()): string => join(dir, 'values');
+export const valueFile = (id: string, dir = vaultDir()): string => join(valuesDir(dir), id);
+export const caDir = (dir = vaultDir()): string => join(dir, 'ca');
+export const binDir = (dir = vaultDir()): string => join(dir, 'bin');
+export const proxyBin = (dir = vaultDir()): string => join(binDir(dir), `iron-proxy-${PROXY_VERSION}`);
+export const configFile = (dir = vaultDir()): string => join(dir, 'iron-proxy.json');
+
+export const TRUSTED_CA = '/usr/local/share/ca-certificates/metro-vault.crt';
+export const SYSTEM_BUNDLE = '/etc/ssl/certs/ca-certificates.crt';

package/runtime/node_modules/@metro-labs/daemon/src/vault/proxy.ts

@@ -0,0 +1,147 @@
+import { spawn, type ChildProcess } from 'node:child_process';
+import { stringOf } from '@metro-labs/http/api-http';
+import { randomBytes } from 'node:crypto';
+import { basename } from 'node:path';
+import { createInterface } from 'node:readline';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { MANAGEMENT_KEY_ENV } from './config.js';
+import { ports } from './paths.js';
+
+export interface ProxyRequest {
+  at: string;
+  method: string;
+  host: string;
+  path: string;
+  status: number | null;
+  action: string;
+  swapped: string[];
+}
+
+const RECENT_MAX = 200;
+const BACKOFF_MAX_MS = 30_000;
+
+const recent: ProxyRequest[] = [];
+const state: { child: ChildProcess | null; wanted: { bin: string; config: string } | null; key: string; backoff: number; lastError: string | null; startedAt: number } = {
+  child: null,
+  wanted: null,
+  key: randomBytes(24).toString('hex'),
+  backoff: 1000,
+  lastError: null,
+  startedAt: 0,
+};
+
+function swappedIds(transforms: unknown): string[] {
+  if (!Array.isArray(transforms)) return [];
+  return transforms.flatMap((t) => {
+    const swapped = isRecord(t) && isRecord(t.annotations) && Array.isArray(t.annotations.swapped) ? t.annotations.swapped : [];
+    return swapped.flatMap((s) => (isRecord(s) && typeof s.secret === 'string' ? [basename(s.secret)] : []));
+  });
+}
+
+export function requestOf(line: string): ProxyRequest | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (!isRecord(parsed) || parsed.msg !== 'request' || !isRecord(parsed.audit)) return null;
+  const audit = parsed.audit;
+  if (audit.method === 'CONNECT') return null;
+  return {
+    at: stringOf(parsed.time),
+    method: stringOf(audit.method),
+    host: stringOf(audit.host),
+    path: stringOf(audit.path),
+    status: typeof audit.status_code === 'number' ? audit.status_code : null,
+    action: stringOf(audit.action),
+    swapped: swappedIds(parsed.request_transforms),
+  };
+}
+
+function noteLine(line: string): void {
+  const request = requestOf(line);
+  if (request !== null) {
+    recent.push(request);
+    if (recent.length > RECENT_MAX) recent.shift();
+    return;
+  }
+  if (/"level":"(WARN|ERROR)"/.test(line)) log.warn({ line: line.slice(0, 500) }, 'vault: iron-proxy');
+}
+
+function launch(): void {
+  const wanted = state.wanted;
+  if (wanted === null || state.child !== null) return;
+  const child = spawn(wanted.bin, ['-config', wanted.config], { stdio: ['ignore', 'pipe', 'pipe'], env: { PATH: process.env.PATH ?? '/usr/bin:/bin', [MANAGEMENT_KEY_ENV]: state.key } });
+  state.child = child;
+  state.startedAt = Date.now();
+  for (const stream of [child.stdout, child.stderr]) if (stream !== null) createInterface({ input: stream }).on('line', noteLine);
+  child.on('error', (err) => {
+    state.lastError = errMsg(err);
+  });
+  child.on('exit', (code) => {
+    state.child = null;
+    if (state.wanted === null) return;
+    state.lastError = `iron-proxy stopped (exit ${String(code)})`;
+    log.warn({ code, retryInMs: state.backoff }, 'vault: iron-proxy stopped, starting it again');
+    const wait = state.backoff;
+    state.backoff = Date.now() - state.startedAt > 60_000 ? 1000 : Math.min(state.backoff * 2, BACKOFF_MAX_MS);
+    setTimeout(launch, wait).unref();
+  });
+}
+
+async function reload(): Promise<boolean> {
+  try {
+    const res = await fetch(`http://127.0.0.1:${String(ports().management)}/v1/reload`, {
+      method: 'POST',
+      headers: { authorization: `Bearer ${state.key}` },
+      signal: AbortSignal.timeout(10_000),
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+async function listening(): Promise<boolean> {
+  try {
+    await fetch(`http://127.0.0.1:${String(ports().management)}/v1/reload`, { method: 'GET', signal: AbortSignal.timeout(2_000) });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function waitListening(ms = 10_000): Promise<boolean> {
+  const until = Date.now() + ms;
+  while (Date.now() < until) {
+    if (await listening()) return true;
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  return false;
+}
+
+export async function runProxy(bin: string, config: string): Promise<void> {
+  const fresh = state.child === null;
+  state.wanted = { bin, config };
+  if (fresh) launch();
+  else if (await reload()) {
+    state.lastError = null;
+    return;
+  } else {
+    state.child?.kill('SIGTERM');
+    await new Promise((r) => setTimeout(r, state.backoff + 500));
+  }
+  if (!(await waitListening())) throw new Error(state.lastError ?? 'iron-proxy did not start');
+  state.lastError = null;
+}
+
+export function stopProxy(): void {
+  state.wanted = null;
+  state.child?.kill('SIGTERM');
+}
+
+export const proxyRunning = (): boolean => state.child !== null;
+export const proxyError = (): string | null => state.lastError;
+export const recentRequests = (): ProxyRequest[] => [...recent].reverse();

package/runtime/node_modules/@metro-labs/daemon/src/vault/store.ts

@@ -0,0 +1,129 @@
+import { existsSync, rmSync } from 'node:fs';
+import { stringOf } from '@metro-labs/http/api-http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { isRecord } from '@metro-labs/core/is-record';
+import { newId } from '@metro-labs/core/ids';
+import { ensureSecureDir, readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { stateFile, valueFile, valuesDir, vaultDir } from './paths.js';
+
+export interface VaultSecret {
+  id: string;
+  name: string;
+  env: string;
+  hosts: string[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface VaultState {
+  version: 1;
+  enabled: boolean;
+  secrets: VaultSecret[];
+}
+
+export interface SecretInput {
+  name?: unknown;
+  env?: unknown;
+  hosts?: unknown;
+  value?: unknown;
+}
+
+const ENV_RE = /^[A-Z][A-Z0-9_]{2,63}$/;
+const HOST_RE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+const RESERVED_ENV = new Set(['HOME', 'PATH', 'USER', 'SHELL', 'LANG', 'TERM', 'LOGNAME', 'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'ALL_PROXY']);
+const MAX_SECRETS = 100;
+const MAX_HOSTS = 20;
+const MAX_VALUE = 16 * 1024;
+
+function secretOf(raw: unknown): VaultSecret | null {
+  if (!isRecord(raw) || typeof raw.id !== 'string' || !ENV_RE.test(stringOf(raw.env))) return null;
+  const hosts = Array.isArray(raw.hosts) ? raw.hosts.filter((h): h is string => typeof h === 'string' && HOST_RE.test(h)) : [];
+  return { id: raw.id, name: stringOf(raw.name) || stringOf(raw.env), env: stringOf(raw.env), hosts, createdAt: stringOf(raw.createdAt), updatedAt: stringOf(raw.updatedAt) };
+}
+
+export function readVault(dir = vaultDir()): VaultState {
+  const raw = readJson<unknown>(stateFile(dir), null);
+  if (!isRecord(raw)) return { version: 1, enabled: false, secrets: [] };
+  const secrets = Array.isArray(raw.secrets) ? raw.secrets.map(secretOf).filter((s): s is VaultSecret => s !== null) : [];
+  return { version: 1, enabled: raw.enabled === true, secrets };
+}
+
+function writeVault(state: VaultState, dir = vaultDir()): void {
+  ensureSecureDir(dir);
+  writeSecure(stateFile(dir), `${JSON.stringify(state, null, 2)}\n`);
+}
+
+function normalizeName(raw: unknown): string {
+  const name = stringOf(raw).trim();
+  if (name === '' || name.length > 80) throw new ApiError('a name of 1 to 80 characters is required', 400);
+  return name;
+}
+
+function normalizeEnv(raw: unknown): string {
+  const env = stringOf(raw).trim();
+  if (!ENV_RE.test(env) || RESERVED_ENV.has(env))
+    throw new ApiError('the variable name must be capital letters, digits and _, 3 to 64 long, like OPENAI_API_KEY', 400);
+  return env;
+}
+
+function normalizeHosts(raw: unknown): string[] {
+  if (!Array.isArray(raw)) throw new ApiError('hosts must be a list of websites, like api.openai.com', 400);
+  const hosts = [...new Set(raw.map((h) => stringOf(h).trim().toLowerCase().replace(/^https?:\/\//, '').replace(/\/.*$/, '')).filter((h) => h !== ''))];
+  if (hosts.length === 0 || hosts.length > MAX_HOSTS) throw new ApiError(`a secret needs 1 to ${String(MAX_HOSTS)} websites`, 400);
+  const bad = hosts.find((h) => !HOST_RE.test(h));
+  if (bad !== undefined) throw new ApiError(`'${bad}' is not a website name; write it as api.example.com or *.example.com`, 400);
+  return hosts;
+}
+
+function normalizeValue(raw: unknown): string {
+  const value = stringOf(raw).trim();
+  if (value === '' || value.length > MAX_VALUE) throw new ApiError('a value of 1 to 16384 characters is required', 400);
+  return value;
+}
+
+function saveValue(id: string, value: string, dir: string): void {
+  ensureSecureDir(valuesDir(dir));
+  writeSecure(valueFile(id, dir), value);
+}
+
+export function addSecret(input: SecretInput, dir = vaultDir(), now = new Date()): VaultSecret {
+  const state = readVault(dir);
+  if (state.secrets.length >= MAX_SECRETS) throw new ApiError(`at most ${String(MAX_SECRETS)} secrets`, 400);
+  const env = normalizeEnv(input.env);
+  if (state.secrets.some((s) => s.env === env)) throw new ApiError(`${env} is already a secret`, 409);
+  const at = now.toISOString();
+  const secret: VaultSecret = { id: newId(), name: normalizeName(input.name ?? env), env, hosts: normalizeHosts(input.hosts), createdAt: at, updatedAt: at };
+  saveValue(secret.id, normalizeValue(input.value), dir);
+  writeVault({ ...state, secrets: [...state.secrets, secret] }, dir);
+  return secret;
+}
+
+export function updateSecret(id: string, input: SecretInput, dir = vaultDir(), now = new Date()): VaultSecret {
+  const state = readVault(dir);
+  const found = state.secrets.find((s) => s.id === id);
+  if (found === undefined) throw new ApiError('no such secret', 404);
+  const next: VaultSecret = {
+    ...found,
+    ...(input.name === undefined ? {} : { name: normalizeName(input.name) }),
+    ...(input.hosts === undefined ? {} : { hosts: normalizeHosts(input.hosts) }),
+    updatedAt: now.toISOString(),
+  };
+  if (input.value !== undefined) saveValue(id, normalizeValue(input.value), dir);
+  writeVault({ ...state, secrets: state.secrets.map((s) => (s.id === id ? next : s)) }, dir);
+  return next;
+}
+
+export function removeSecret(id: string, dir = vaultDir()): void {
+  const state = readVault(dir);
+  if (!state.secrets.some((s) => s.id === id)) throw new ApiError('no such secret', 404);
+  writeVault({ ...state, secrets: state.secrets.filter((s) => s.id !== id) }, dir);
+  rmSync(valueFile(id, dir), { force: true });
+}
+
+export function setVaultEnabled(enabled: boolean, dir = vaultDir()): VaultState {
+  const next = { ...readVault(dir), enabled };
+  writeVault(next, dir);
+  return next;
+}
+
+export const hasValue = (id: string, dir = vaultDir()): boolean => existsSync(valueFile(id, dir));

package/runtime/node_modules/@metro-labs/daemon/src/vault/trust.ts

@@ -0,0 +1,44 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { errMsg, log } from '@metro-labs/core/log';
+import { asUser, type AgentUser } from '../agent-user/user.js';
+import { TRUSTED_CA } from './paths.js';
+import { mustHelper, rootHelper } from '../metro-user/privilege.js';
+
+const has = (bin: string): boolean => spawnSync('sh', ['-c', `command -v ${bin}`], { stdio: 'ignore' }).status === 0;
+
+export function trustSystem(caFile: string): void {
+  const same = existsSync(TRUSTED_CA) && readFileSync(TRUSTED_CA, 'utf8') === readFileSync(caFile, 'utf8');
+  if (!same) mustHelper(['trust-ca']);
+}
+
+export function untrustSystem(): void {
+  if (existsSync(TRUSTED_CA)) mustHelper(['untrust-ca']);
+}
+
+const NSS_SCRIPT = [
+  'set -e',
+  'db="$HOME/.pki/nssdb"',
+  'mkdir -p "$db"',
+  '[ -f "$db/cert9.db" ] || certutil -d "sql:$db" -N --empty-password',
+  'certutil -d "sql:$db" -D -n "Metro vault" >/dev/null 2>&1 || true',
+  'certutil -d "sql:$db" -A -t "C,," -n "Metro vault" -i "$1"',
+].join('\n');
+
+function ensureCertutil(): boolean {
+  if (has('certutil')) return true;
+  return rootHelper(['install-nss-tools']).status === 0 && has('certutil');
+}
+
+export function trustBrowsers(user: AgentUser): string | null {
+  try {
+    if (!ensureCertutil()) return 'certutil is missing, so browsers the agent starts will not trust the vault (apt-get install libnss3-tools)';
+    const [file, argv] = asUser(user, 'sh', ['-c', NSS_SCRIPT, 'metro', TRUSTED_CA]);
+    const run = spawnSync(file, argv, { encoding: 'utf8', timeout: 30_000 });
+    if (run.status !== 0) return `browsers will not trust the vault: ${run.stderr.trim()}`;
+    return null;
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'vault: could not add the certificate for browsers');
+    return errMsg(err);
+  }
+}

package/runtime/node_modules/@metro-labs/{discord → discord-bot}/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@metro-labs/discord",
+  "name": "@metro-labs/discord-bot",
   "version": "0.1.0",
   "private": true,
   "type": "module",
@@ -13,10 +13,8 @@
     "test": "tsc --noEmit && bun test test/"
   },
   "dependencies": {
-    "@metro-labs/mcp": "workspace:*",
-    "@discordjs/voice": "^0.19.2",
-    "discord.js": "^14.26.4",
-    "prism-media": "^1.3.5"
+    "@metro-labs/core": "workspace:*",
+    "discord.js": "^14.26.4"
   },
   "devDependencies": {
     "@stage-labs/config": "0.1.0-beta.2",

package/runtime/node_modules/@metro-labs/{discord → discord-bot}/src/accounts.ts

@@ -1,37 +1,22 @@
 import { Client } from 'discord.js';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
 import {
   makeAccountStore,
   resolveAccountId,
-} from '@metro-labs/mcp/stations/account-store';
-import { Line } from '@metro-labs/mcp/lines';
-import { emit } from './wire.js';
+} from '@metro-labs/core/stations/account-store';
+import { Line } from '@metro-labs/core/lines';
 import { API } from './api-base.js';
 
-const ACCOUNTS_FILE =
-  process.env.DISCORD_ACCOUNTS_FILE ??
-  join(homedir(), '.metro', 'discord-accounts.json');
-
 export interface AccountConfig {
   id: string;
   token: string;
-  owner?: string;
 }
 
 export const { loadAccounts } = makeAccountStore<AccountConfig>({
-  prefix: 'discord',
-  file: ACCOUNTS_FILE,
-  allowlistEnv: ['DISCORD_ONLY_ACCOUNTS', 'DISCORD_ACCOUNTS'],
+  prefix: 'discord-bot',
   validate(raw, die) {
-    const seen = new Set<string>();
-    for (const a of raw) {
-      if (!a.id) die('account missing id');
+    for (const a of raw)
       if (!a.token || typeof a.token !== 'string')
         die(`account '${a.id}' missing token`);
-      if (seen.has(a.id)) die(`duplicate account id '${a.id}'`);
-      seen.add(a.id);
-    }
   },
 });
 
@@ -67,30 +52,25 @@ export async function rest<T = unknown>(
   if (!acct) throw new Error(`unknown account '${accountId}'`);
   const headers: Record<string, string> = {
     Authorization: `Bot ${acct.cfg.token}`,
-    'User-Agent': 'metro-discord-train (https://github.com/bonustrack/stage)',
+    'User-Agent': 'metro-discord-bot-train (https://github.com/bonustrack/stage)',
   };
   if (body !== undefined && !isForm)
     headers['Content-Type'] = 'application/json';
-  emit({ op: 'log', text: `discord[${accountId}] api ${method} ${path}` });
   const res = await fetch(`${API}${path}`, {
     method,
     headers,
     body: restBody(body, isForm),
     signal: AbortSignal.timeout(30_000),
   });
-  emit({
-    op: 'log',
-    text: `discord[${accountId}] api ${method} ${path} -> ${res.status}`,
-  });
   if (!res.ok) {
     const text = await res.text().catch(() => '');
-    throw new Error(`discord ${method} ${path}: ${res.status} ${text}`);
+    throw new Error(`discord-bot ${method} ${path}: ${res.status} ${text}`);
   }
   return restResult<T>(res);
 }
 
 export function lineOf(accountId: string, channelId: string): string {
-  return `metro://discord/${accountId}/${channelId}`;
+  return `metro://discord-bot/${accountId}/${channelId}`;
 }
 
 export function parseLine(
@@ -109,7 +89,7 @@ export function routeOf(
   account?: string,
 ): { accountId: string; channelId: string } {
   const parsed = parseLine(line);
-  if (!parsed) throw new Error(`bad discord line: ${line}`);
+  if (!parsed) throw new Error(`bad discord-bot line: ${line}`);
   const accountId = account ?? parsed.accountId;
   if (!accounts.has(accountId))
     throw new Error(`unknown account '${accountId}' in line ${line}`);