@stage-labs/metro 0.1.0-beta.21 → 0.1.0-beta.210

package/runtime/node_modules/@metro-labs/mcp/src/daemon/identity.ts

@@ -1,79 +0,0 @@
-import { execFileSync } from 'node:child_process';
-import { errMsg, log } from './log.js';
-import { Line } from '../stations/lines.js';
-
-const TTL_MS = 5_000;
-type Cache = { id: string; at: number } | null;
-
-function memo(loader: () => string): () => string {
-  let cache: Cache = null;
-  return () => {
-    if (cache && Date.now() - cache.at < TTL_MS) return cache.id;
-    const id = loader();
-    cache = { id, at: Date.now() };
-    return id;
-  };
-}
-
-const claudeAccountId = memo(() => {
-  let raw: string;
-  try {
-    raw = execFileSync('claude', ['auth', 'status', '--json'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-  } catch (e) {
-    throw new Error(
-      `metro: failed to run 'claude auth status --json' — is Claude Code installed? (${errMsg(e)})`,
-    );
-  }
-  let p: { loggedIn?: boolean; orgId?: string };
-  try {
-    p = JSON.parse(raw) as { loggedIn?: boolean; orgId?: string };
-  } catch {
-    throw new Error(
-      `metro: 'claude auth status --json' returned non-JSON: ${raw.slice(0, 200)}`,
-    );
-  }
-  if (!p.loggedIn || !p.orgId)
-    throw new Error(
-      "metro: Claude Code is not logged in — run 'claude auth login'",
-    );
-  return p.orgId;
-});
-
-export const claudeUserId = (): string =>
-  process.env.METRO_USER_ID ?? claudeAccountId();
-
-export const claudeSessionId = (): string | null =>
-  process.env.METRO_USER_SESSION_ID ??
-  process.env.CLAUDE_CODE_SESSION_ID ??
-  null;
-
-export function userSelf(): Line {
-  const explicit = process.env.METRO_FROM;
-  if (explicit) return explicit as Line;
-  if (!process.env.CLAUDECODE) return 'metro://user' as Line;
-  try {
-    return Line.user('claude', claudeUserId());
-  } catch (e) {
-    log.warn(
-      { reason: errMsg(e) },
-      'could not resolve a Claude account id; relaying as metro://user',
-    );
-    return 'metro://user' as Line;
-  }
-}
-
-export function daemonSelf(): Line {
-  const explicit = process.env.METRO_FROM ?? process.env.METRO_SELF_URI;
-  return (explicit ?? 'metro://user') as Line;
-}
-
-export function selfLine(): Line | null {
-  if (process.env.CLAUDECODE) {
-    const s = claudeSessionId();
-    return s ? Line.claude(claudeUserId(), s) : null;
-  }
-  return null;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-pending.ts

@@ -1,65 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import type { OAuthClient } from './oauth-client.js';
-import type { OAuthServer } from './oauth-discovery.js';
-
-const TTL_MS = 10 * 60_000;
-const SWEEP_MS = 60_000;
-const MAX_PENDING = 100;
-
-export interface PendingAuth {
-  email: string;
-  name: string;
-  url: string;
-  resource: string;
-  returnTo: string;
-  verifier: string;
-  server: OAuthServer;
-  client: OAuthClient;
-  connectorId: string;
-}
-
-interface Entry extends PendingAuth {
-  expiresAt: number;
-}
-
-const pending = new Map<string, Entry>();
-let sweeper: ReturnType<typeof setInterval> | null = null;
-
-function sweep(now = Date.now()): void {
-  for (const [state, entry] of pending)
-    if (entry.expiresAt <= now) pending.delete(state);
-}
-
-function ensureSweeper(): void {
-  if (sweeper !== null) return;
-  sweeper = setInterval(sweep, SWEEP_MS);
-  sweeper.unref?.();
-}
-
-export function startPending(entry: PendingAuth, now = Date.now()): string {
-  sweep(now);
-  while (pending.size >= MAX_PENDING) {
-    const oldest = pending.keys().next();
-    if (oldest.done) break;
-    pending.delete(oldest.value);
-  }
-  const state = randomBytes(32).toString('base64url');
-  pending.set(state, { ...entry, expiresAt: now + TTL_MS });
-  ensureSweeper();
-  return state;
-}
-
-export function takePending(
-  state: string,
-  now = Date.now(),
-): PendingAuth | undefined {
-  const entry = pending.get(state);
-  if (entry === undefined) return undefined;
-  pending.delete(state);
-  return entry.expiresAt > now ? entry : undefined;
-}
-
-export function pendingCount(): number {
-  sweep();
-  return pending.size;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/pair-codes.ts

@@ -1,58 +0,0 @@
-import { randomBytes } from 'node:crypto';
-
-const TTL_MS = 10 * 60_000;
-const SWEEP_MS = 60_000;
-const MAX_CODES = 100;
-
-export interface CodeStore<T> {
-  pattern: RegExp;
-  mint(entry: T, now?: number): { code: string; expiresAt: number };
-  take(code: string, now?: number): T | undefined;
-  count(): number;
-}
-
-export function makeCodeStore<T extends object>(prefix: string): CodeStore<T> {
-  const codes = new Map<string, T & { expiresAt: number }>();
-  let sweeper: ReturnType<typeof setInterval> | null = null;
-
-  const sweep = (now = Date.now()): void => {
-    for (const [code, entry] of codes)
-      if (entry.expiresAt <= now) codes.delete(code);
-  };
-
-  const ensureSweeper = (): void => {
-    if (sweeper !== null) return;
-    sweeper = setInterval(sweep, SWEEP_MS);
-    sweeper.unref?.();
-  };
-
-  return {
-    pattern: new RegExp(`^${prefix}_[A-Za-z0-9_-]{16}$`),
-    mint(entry, now = Date.now()) {
-      sweep(now);
-      while (codes.size >= MAX_CODES) {
-        const oldest = codes.keys().next();
-        if (oldest.done) break;
-        codes.delete(oldest.value);
-      }
-      const code = `${prefix}_${randomBytes(12).toString('base64url')}`;
-      const expiresAt = now + TTL_MS;
-      codes.set(code, { ...entry, expiresAt });
-      ensureSweeper();
-      return { code, expiresAt };
-    },
-    take(code, now = Date.now()) {
-      const entry = codes.get(code);
-      if (entry === undefined) return undefined;
-      codes.delete(code);
-      if (entry.expiresAt <= now) return undefined;
-      const rest: Record<string, unknown> = { ...entry };
-      delete rest.expiresAt;
-      return rest as T;
-    },
-    count() {
-      sweep();
-      return codes.size;
-    },
-  };
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/project-api.ts

@@ -1,214 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
-import {
-  apiFailure,
-  apiSession,
-  bodyField,
-  cors,
-  readJsonBody,
-  sendJson,
-  type ApiSession,
-} from './api-http.js';
-import { parseId } from '../db/ids.js';
-import type { Member, Project } from '../db/projects.js';
-
-const PREFIX = '/api/projects';
-
-export interface ProjectApiDeps {
-  listProjects: (email: string) => Promise<Project[]>;
-  createProject: (email: string, name: unknown) => Promise<Project>;
-  renameProject: (
-    email: string,
-    id: string,
-    name: unknown,
-  ) => Promise<Project>;
-  deleteProject: (
-    email: string,
-    id: string,
-  ) => Promise<{ id: string; name: string }>;
-  listMembers: (email: string, id: string) => Promise<Member[]>;
-  addMember: (
-    email: string,
-    id: string,
-    invited: unknown,
-    role: unknown,
-  ) => Promise<Member[]>;
-  setMemberRole: (
-    email: string,
-    id: string,
-    memberId: string,
-    role: unknown,
-  ) => Promise<Member[]>;
-  removeMember: (
-    email: string,
-    id: string,
-    memberId: string,
-  ) => Promise<Member[]>;
-}
-
-type Routable =
-  | { kind: 'index' }
-  | { kind: 'project'; id: string }
-  | { kind: 'rename'; id: string }
-  | { kind: 'members'; id: string }
-  | { kind: 'member'; id: string; memberId: string };
-
-type Target = Routable | { kind: 'unknown' } | null;
-
-const ALLOWED: Record<Routable['kind'], string[]> = {
-  index: ['GET', 'POST'],
-  project: ['DELETE'],
-  rename: ['POST'],
-  members: ['GET', 'POST'],
-  member: ['POST', 'DELETE'],
-};
-
-function memberTarget(id: string, rest: string[]): Target {
-  if (rest.length === 1) return { kind: 'members', id };
-  if (rest.length > 2) return { kind: 'unknown' };
-  const memberId = parseId(rest[1] ?? '');
-  return memberId === null
-    ? { kind: 'unknown' }
-    : { kind: 'member', id, memberId };
-}
-
-function subTarget(id: string, rest: string[]): Target {
-  if (rest.length === 0) return { kind: 'project', id };
-  const head = rest[0];
-  if (head === 'members') return memberTarget(id, rest);
-  if (rest.length > 1) return { kind: 'unknown' };
-  if (head === 'rename') return { kind: 'rename', id };
-  return { kind: 'unknown' };
-}
-
-function target(path: string): Target {
-  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'index' };
-  if (!path.startsWith(`${PREFIX}/`)) return null;
-  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
-  const head = segments[0];
-  if (head === undefined) return { kind: 'index' };
-  const id = parseId(head);
-  return id === null ? { kind: 'unknown' } : subTarget(id, segments.slice(1));
-}
-
-async function handleIndex(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ProjectApiDeps,
-  session: ApiSession,
-): Promise<void> {
-  if (req.method === 'GET') {
-    sendJson(req, res, 200, { projects: await deps.listProjects(session.email) });
-    return;
-  }
-  const made = await deps.createProject(
-    session.email,
-    bodyField(await readJsonBody(req), 'name'),
-  );
-  log.info({ id: made.id, name: made.name }, 'project-api: created project');
-  sendJson(req, res, 201, made);
-}
-
-async function handleMembers(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ProjectApiDeps,
-  session: ApiSession,
-  id: string,
-): Promise<void> {
-  if (req.method === 'GET') {
-    sendJson(req, res, 200, { members: await deps.listMembers(session.email, id) });
-    return;
-  }
-  const body = await readJsonBody(req);
-  const members = await deps.addMember(
-    session.email,
-    id,
-    bodyField(body, 'email'),
-    bodyField(body, 'role'),
-  );
-  sendJson(req, res, 200, { members });
-}
-
-async function handleMember(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ProjectApiDeps,
-  session: ApiSession,
-  tgt: { id: string; memberId: string },
-): Promise<void> {
-  if (req.method === 'DELETE') {
-    const members = await deps.removeMember(session.email, tgt.id, tgt.memberId);
-    sendJson(req, res, 200, { members });
-    return;
-  }
-  const members = await deps.setMemberRole(
-    session.email,
-    tgt.id,
-    tgt.memberId,
-    bodyField(await readJsonBody(req), 'role'),
-  );
-  sendJson(req, res, 200, { members });
-}
-
-async function route(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ProjectApiDeps,
-  session: ApiSession,
-  tgt: Routable,
-): Promise<void> {
-  try {
-    if (tgt.kind === 'index') await handleIndex(req, res, deps, session);
-    else if (tgt.kind === 'members')
-      await handleMembers(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'member')
-      await handleMember(req, res, deps, session, tgt);
-    else if (tgt.kind === 'rename')
-      sendJson(
-        req,
-        res,
-        200,
-        await deps.renameProject(
-          session.email,
-          tgt.id,
-          bodyField(await readJsonBody(req), 'name'),
-        ),
-      );
-    else sendJson(req, res, 200, await deps.deleteProject(session.email, tgt.id));
-  } catch (err) {
-    apiFailure(req, res, err, 'project-api');
-  }
-}
-
-export function handleProjectApiRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ProjectApiDeps,
-): boolean {
-  const tgt = target((req.url ?? '').split('?')[0] ?? '');
-  if (tgt === null) return false;
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (tgt.kind === 'unknown') {
-    sendJson(req, res, 404, { error: 'no such project' });
-    return true;
-  }
-  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
-  route(req, res, deps, session, tgt).catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'project-api: unhandled error');
-    if (!res.headersSent)
-      sendJson(req, res, 500, { error: 'project api failed' });
-  });
-  return true;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/run-api.ts

@@ -1,125 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { log } from './log.js';
-import {
-  apiFailure,
-  bodyField,
-  cors,
-  readJsonBody,
-  runIdentity,
-  sendJson,
-} from './api-http.js';
-import { RUN_CODE_RE, takeRunCode } from './run-pair.js';
-import { sessionTtlFromEnv } from './google-oauth.js';
-import { signRunToken } from './session.js';
-import type { LoadedAgent } from '../db/materialize.js';
-import type { RuntimeLease } from '../db/runtimes.js';
-
-const CLAIM_PATH = '/api/run/claim';
-const CONFIG_PATH = '/api/run/config';
-
-const ALLOWED: Record<string, string> = {
-  [CLAIM_PATH]: 'POST',
-  [CONFIG_PATH]: 'GET',
-};
-
-export interface RunApiDeps {
-  claimRuntime: (agentId: string, label: string) => Promise<RuntimeLease>;
-  fenceRuntime: (runtimeId: string, agentId: string) => Promise<void>;
-  touchRuntime: (runtimeId: string) => Promise<void>;
-  loadAgent: (agentId: string) => Promise<LoadedAgent>;
-}
-
-function secretOrNull(): string | null {
-  const secret = process.env.METRO_SESSION_SECRET?.trim() ?? '';
-  return secret === '' ? null : secret;
-}
-
-function labelOf(body: unknown): string {
-  const raw = bodyField(body, 'label');
-  const label = typeof raw === 'string' ? raw.trim().slice(0, 64) : '';
-  return label === '' ? 'unnamed machine' : label;
-}
-
-async function handleClaim(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: RunApiDeps,
-): Promise<void> {
-  const secret = secretOrNull();
-  if (secret === null) {
-    sendJson(req, res, 503, { error: 'sign-in is not configured' });
-    return;
-  }
-  const body = await readJsonBody(req);
-  const code = bodyField(body, 'code');
-  const taken =
-    typeof code === 'string' && RUN_CODE_RE.test(code)
-      ? takeRunCode(code)
-      : undefined;
-  if (taken === undefined) {
-    sendJson(req, res, 400, {
-      error: 'that code has expired or was already used',
-    });
-    return;
-  }
-  const lease = await deps.claimRuntime(taken.agentId, labelOf(body));
-  const token = signRunToken(
-    { email: taken.email, agentId: lease.agentId, runtimeId: lease.runtimeId },
-    secret,
-    { ttlSec: sessionTtlFromEnv() },
-  );
-  log.info(
-    { agent: lease.agentId, runtime: lease.runtimeId, label: lease.label },
-    'run: agent claimed by a local runtime',
-  );
-  sendJson(req, res, 200, {
-    token,
-    agent: lease.agentId,
-    label: lease.label,
-  });
-}
-
-async function handleConfig(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: RunApiDeps,
-): Promise<void> {
-  const who = runIdentity(req);
-  if (who === null) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return;
-  }
-  await deps.fenceRuntime(who.runtimeId, who.agentId);
-  await deps.touchRuntime(who.runtimeId);
-  sendJson(req, res, 200, { agent: await deps.loadAgent(who.agentId) });
-}
-
-export function handleRunApiRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: RunApiDeps,
-): boolean {
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  const method = ALLOWED[path];
-  if (method === undefined) {
-    if (!path.startsWith('/api/run/') && path !== '/api/run') return false;
-    sendJson(req, res, 404, { error: 'no such route' });
-    return true;
-  }
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (req.method !== method) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  const work =
-    path === CLAIM_PATH
-      ? handleClaim(req, res, deps)
-      : handleConfig(req, res, deps);
-  work.catch((err: unknown) => {
-    apiFailure(req, res, err, 'run-api');
-  });
-  return true;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/run-pair.ts

@@ -1,18 +0,0 @@
-import { makeCodeStore } from './pair-codes.js';
-
-export interface RunCode {
-  email: string;
-  agentId: string;
-}
-
-const store = makeCodeStore<RunCode>('mr');
-
-export const RUN_CODE_RE = store.pattern;
-
-export const mintRunCode = (
-  entry: RunCode,
-  now?: number,
-): { code: string; expiresAt: number } => store.mint(entry, now);
-
-export const takeRunCode = (code: string, now?: number): RunCode | undefined =>
-  store.take(code, now);

package/runtime/node_modules/@metro-labs/mcp/src/daemon/runtime-source.ts

@@ -1,105 +0,0 @@
-import { errMsg, log } from './log.js';
-import type { LoadedAgent, StationSource } from '../db/materialize.js';
-
-const POLL_MS = 30_000;
-const BACKOFF_MS = 5 * 60_000;
-const FETCH_TIMEOUT_MS = 15_000;
-
-export class RuntimeRevoked extends Error {}
-
-const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);
-
-export function carriesSecretsSafely(base: string): boolean {
-  let url: URL;
-  try {
-    url = new URL(base);
-  } catch {
-    return false;
-  }
-  if (url.protocol === 'https:') return true;
-  return url.protocol === 'http:' && LOOPBACK.has(url.hostname);
-}
-
-export interface RuntimeConfig {
-  url: string;
-  token: string;
-}
-
-export function runtimeConfigFromEnv(): RuntimeConfig | null {
-  const token = process.env.METRO_RUN_TOKEN?.trim() ?? '';
-  if (token === '') return null;
-  const raw = (process.env.METRO_URL?.trim() ?? '').replace(/\/+$/, '');
-  const url = raw === '' ? 'https://mcp.metro.box' : raw;
-  if (!carriesSecretsSafely(url))
-    throw new Error(
-      `refusing to fetch station credentials from ${url} in the clear — ` +
-        'use https, or a loopback address',
-    );
-  return { url, token };
-}
-
-export function httpSource(cfg: RuntimeConfig): StationSource {
-  return async () => {
-    const res = await fetch(`${cfg.url}/api/run/config`, {
-      headers: { authorization: `Bearer ${cfg.token}` },
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      redirect: 'manual',
-    });
-    if (res.status === 401 || res.status === 403 || res.status === 409)
-      throw new RuntimeRevoked(
-        `metro no longer recognises this machine as the holder (${String(res.status)})`,
-      );
-    if (!res.ok)
-      throw new Error(`metro answered ${String(res.status)} for the run config`);
-    const body = (await res.json()) as { agent?: LoadedAgent };
-    if (!body.agent) throw new Error('metro returned no agent');
-    return [body.agent];
-  };
-}
-
-export interface PollerDeps {
-  sync: () => Promise<void>;
-  stopAll: () => Promise<void>;
-  everyMs?: number;
-  backoffMs?: number;
-}
-
-export function startRuntimePoller(deps: PollerDeps): () => void {
-  const everyMs = deps.everyMs ?? POLL_MS;
-  const backoffMs = deps.backoffMs ?? BACKOFF_MS;
-  let stopped = false;
-  let timer: ReturnType<typeof setTimeout> | null = null;
-
-  const arm = (ms: number): void => {
-    if (stopped) return;
-    timer = setTimeout(() => {
-      tick().catch((err: unknown) => {
-        log.error({ err: errMsg(err) }, 'runtime: poller failed');
-      });
-    }, ms);
-    timer.unref?.();
-  };
-
-  async function tick(): Promise<void> {
-    if (stopped) return;
-    try {
-      await deps.sync();
-      arm(everyMs);
-    } catch (err) {
-      if (err instanceof RuntimeRevoked) {
-        stopped = true;
-        log.error({ reason: err.message }, 'runtime: revoked — stopping stations');
-        await deps.stopAll();
-        return;
-      }
-      log.warn({ err: errMsg(err) }, 'runtime: could not reach metro; retrying');
-      arm(backoffMs);
-    }
-  }
-
-  arm(everyMs);
-  return () => {
-    stopped = true;
-    if (timer !== null) clearTimeout(timer);
-  };
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-apis.ts

@@ -1,41 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { handleSessionApiRequest } from './session-api.js';
-import { handleAgentApiRequest, type AgentApiDeps } from './agent-api.js';
-import {
-  handleConnectorApiRequest,
-  type ConnectorApiDeps,
-} from './connector-api.js';
-import { handleCollectionApiRequest } from './collection-api.js';
-import { handleCliPairRequest } from './cli-pair-api.js';
-import { handleRunApiRequest, type RunApiDeps } from './run-api.js';
-import {
-  handleProjectApiRequest,
-  type ProjectApiDeps,
-} from './project-api.js';
-
-export interface SessionApis {
-  agentApi?: AgentApiDeps;
-  connectorApi?: ConnectorApiDeps;
-  projectApi?: ProjectApiDeps;
-  runApi?: RunApiDeps;
-}
-
-export function handleSessionApis(
-  req: IncomingMessage,
-  res: ServerResponse,
-  apis: SessionApis,
-): boolean {
-  const { agentApi, connectorApi, projectApi, runApi } = apis;
-  const routes: (() => boolean)[] = [() => handleSessionApiRequest(req, res)];
-  if (runApi) routes.push(() => handleRunApiRequest(req, res, runApi));
-  if (projectApi)
-    routes.push(() => handleProjectApiRequest(req, res, projectApi));
-  if (connectorApi)
-    routes.push(
-      () => handleCliPairRequest(req, res, connectorApi),
-      () => handleCollectionApiRequest(req, res, connectorApi),
-      () => handleConnectorApiRequest(req, res, connectorApi),
-    );
-  if (agentApi) routes.push(() => handleAgentApiRequest(req, res, agentApi));
-  return routes.some((run) => run());
-}