@stage-labs/metro 0.1.0-beta.223 → 0.1.0-beta.225

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.223",
+  "version": "0.1.0-beta.225",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.223",
+  "version": "0.1.0-beta.225",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -50,7 +50,7 @@ import { materializeFrom, reloadFrom } from '../stations/materialize.js';
 import type { StationName } from '@metro-labs/core/station-names';
 import { startUploadReaper } from '../files/upload-store.js';
 import { startAttachReaper } from '../files/attach-reaper.js';
-import { startResourceSampler } from '../server/resources.js';
+import { startCloudWatchPublisher } from '../server/cloudwatch.js';
 
 installCrashGuard();
 acquireLock(join(STATE_DIR, '.tail-lock'));
@@ -143,7 +143,7 @@ installBearerSessions(agentsDir(), localOwner);
   syncPluginServers(readLocalConnectors());
   startUploadReaper();
   startAttachReaper();
-  startResourceSampler();
+  startCloudWatchPublisher();
   announceLocalEndpoint();
   tunnel?.start();
   log.info(

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -44,7 +44,6 @@ import {
   readLocalAgentFile,
 } from '../agents/file-admin.js';
 import { readModelConfig } from '../gateway/model-config.js';
-import { resourcesFor } from '../server/resources.js';
 import type { StationName } from '@metro-labs/core/station-names';
 
 export interface LocalModeDeps {
@@ -198,7 +197,7 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
     updateApi: { restart: deps.restart },
     controlApi: { restart: deps.restart, stop: deps.stop },
     ownerApi: { setOwner: (owner) => setLocalOwner(owner) },
-    machineApi: { resources: resourcesFor },
+    machineApi: {},
     modelApi: {},
     gateway: { config: readModelConfig },
     terminalApi: {},

package/runtime/node_modules/@metro-labs/daemon/src/server/cloudwatch.ts

@@ -0,0 +1,178 @@
+import { readFile, statfs } from 'node:fs/promises';
+import { uptime } from 'node:os';
+import { errMsg, log } from '@metro-labs/core/log';
+import { isRecord } from '@metro-labs/core/is-record';
+import { signV4 } from '@metro-labs/http/sigv4';
+
+const IMDS = 'http://169.254.169.254/latest';
+const EVERY_MS = 60_000;
+const FIRST_MS = 15_000;
+const IMDS_TIMEOUT_MS = 2_000;
+const SEND_TIMEOUT_MS = 15_000;
+const NAMESPACE = 'CWAgent';
+const CONTENT_TYPE = 'application/x-www-form-urlencoded; charset=utf-8';
+const BOOT_WINDOW_S = 300;
+const SENT = 'sending memory and disk to CloudWatch every minute';
+
+export interface Readings {
+  memory: number;
+  disk: number;
+}
+
+export interface Started {
+  name: 'server_booted' | 'metro_started';
+  at: number;
+}
+
+interface RoleKeys {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken: string;
+}
+
+interface Instance {
+  instanceId: string;
+  region: string;
+  keys: RoleKeys | null;
+}
+
+export interface PublisherDeps {
+  fetch: (url: string, init: RequestInit) => Promise<Response>;
+  readings: () => Promise<Readings | null>;
+}
+
+export function memoryPercent(meminfo: string): number | null {
+  const kb = (name: string): number | null => {
+    const match = new RegExp(`^${name}:\\s+(\\d+) kB`, 'm').exec(meminfo);
+    return match === null ? null : Number(match[1]);
+  };
+  const total = kb('MemTotal');
+  const available = kb('MemAvailable');
+  if (total === null || available === null || total <= 0) return null;
+  return ((total - available) / total) * 100;
+}
+
+export function diskPercent(fs: { blocks: number; bfree: number; bavail: number }): number | null {
+  const used = fs.blocks - fs.bfree;
+  const room = used + fs.bavail;
+  return room > 0 ? (used / room) * 100 : null;
+}
+
+async function liveReadings(): Promise<Readings | null> {
+  const memory = memoryPercent(await readFile('/proc/meminfo', 'utf8'));
+  const disk = diskPercent(await statfs('/'));
+  return memory === null || disk === null ? null : { memory, disk };
+}
+
+const LIVE: PublisherDeps = { fetch: (url, init) => fetch(url, init), readings: liveReadings };
+
+async function imdsGet(deps: PublisherDeps, token: string, path: string): Promise<string> {
+  const res = await deps.fetch(`${IMDS}/${path}`, { headers: { 'x-aws-ec2-metadata-token': token }, signal: AbortSignal.timeout(IMDS_TIMEOUT_MS) });
+  return res.ok ? (await res.text()).trim() : '';
+}
+
+async function imdsToken(deps: PublisherDeps): Promise<string> {
+  try {
+    const res = await deps.fetch(`${IMDS}/api/token`, {
+      method: 'PUT',
+      headers: { 'x-aws-ec2-metadata-token-ttl-seconds': '300' },
+      signal: AbortSignal.timeout(IMDS_TIMEOUT_MS),
+    });
+    return res.ok ? (await res.text()).trim() : '';
+  } catch {
+    return '';
+  }
+}
+
+function keysOf(raw: string): RoleKeys | null {
+  const parsed: unknown = JSON.parse(raw);
+  if (!isRecord(parsed)) return null;
+  const { AccessKeyId: accessKeyId, SecretAccessKey: secretAccessKey, Token: sessionToken } = parsed;
+  if (typeof accessKeyId !== 'string' || typeof secretAccessKey !== 'string' || typeof sessionToken !== 'string') return null;
+  return { accessKeyId, secretAccessKey, sessionToken };
+}
+
+export async function thisInstance(deps: PublisherDeps): Promise<Instance | null> {
+  const token = await imdsToken(deps);
+  if (token === '') return null;
+  const instanceId = await imdsGet(deps, token, 'meta-data/instance-id');
+  const region = await imdsGet(deps, token, 'meta-data/placement/region');
+  if (instanceId === '' || region === '') return null;
+  const role = (await imdsGet(deps, token, 'meta-data/iam/security-credentials/')).split('\n')[0] ?? '';
+  if (role === '') return { instanceId, region, keys: null };
+  return { instanceId, region, keys: keysOf(await imdsGet(deps, token, `meta-data/iam/security-credentials/${role}`)) };
+}
+
+export function startedOf(nowMs: number, processSeconds: number, bootSeconds: number): Started {
+  const at = (secondsAgo: number): number => Math.round(nowMs / 1000 - secondsAgo);
+  return bootSeconds < BOOT_WINDOW_S ? { name: 'server_booted', at: at(bootSeconds) } : { name: 'metro_started', at: at(processSeconds) };
+}
+
+export function readingParams(instanceId: string, readings: Readings, started: Started | null = null): Record<string, string> {
+  const datum = (at: number, name: string, value: number, dims: [string, string][], unit = 'Percent'): [string, string][] => [
+    [`MetricData.member.${String(at)}.MetricName`, name],
+    [`MetricData.member.${String(at)}.Unit`, unit],
+    [`MetricData.member.${String(at)}.Value`, value.toFixed(2)],
+    ...dims.flatMap(([key, v], i): [string, string][] => [
+      [`MetricData.member.${String(at)}.Dimensions.member.${String(i + 1)}.Name`, key],
+      [`MetricData.member.${String(at)}.Dimensions.member.${String(i + 1)}.Value`, v],
+    ]),
+  ];
+  return Object.fromEntries([
+    ['Action', 'PutMetricData'],
+    ['Version', '2010-08-01'],
+    ['Namespace', NAMESPACE],
+    ...datum(1, 'mem_used_percent', readings.memory, [['InstanceId', instanceId]]),
+    ...datum(2, 'disk_used_percent', readings.disk, [
+      ['InstanceId', instanceId],
+      ['path', '/'],
+    ]),
+    ...(started === null ? [] : datum(3, started.name, started.at, [['InstanceId', instanceId]], 'Seconds')),
+  ]);
+}
+
+async function send(deps: PublisherDeps, instance: Instance, keys: RoleKeys, readings: Readings, started: Started | null): Promise<void> {
+  const url = `https://monitoring.${instance.region}.amazonaws.com/`;
+  const body = new URLSearchParams(readingParams(instance.instanceId, readings, started)).toString();
+  const signed = await signV4({ method: 'POST', url, headers: { 'content-type': CONTENT_TYPE }, body, region: instance.region, service: 'monitoring', ...keys });
+  const res = await deps.fetch(url, { method: 'POST', headers: signed.headers, body, signal: AbortSignal.timeout(SEND_TIMEOUT_MS) });
+  if (res.ok) return;
+  const text = await res.text();
+  const code = /<Code>([^<]+)<\/Code>/.exec(text)?.[1] ?? `HTTP ${String(res.status)}`;
+  const message = /<Message>([^<]+)<\/Message>/.exec(text)?.[1];
+  throw new Error(`CloudWatch refused the readings: ${code}${message === undefined ? '' : ` (${message})`}`);
+}
+
+export async function publishOnce(deps: PublisherDeps = LIVE, started: Started | null = null): Promise<string> {
+  const instance = await thisInstance(deps);
+  if (instance === null) return 'off: this server is not an EC2 instance';
+  if (instance.keys === null) return `waiting: instance ${instance.instanceId} has no IAM role, so memory and disk are not sent`;
+  const readings = await deps.readings();
+  if (readings === null) return 'skipped: could not read memory or disk';
+  await send(deps, instance, instance.keys, readings, started);
+  return SENT;
+}
+
+export function startCloudWatchPublisher(): void {
+  if (process.platform !== 'linux') return;
+  let started: Started | null = startedOf(Date.now(), process.uptime(), uptime());
+  let last = '';
+  const note = (status: string, warn: boolean): void => {
+    if (status === last) return;
+    last = status;
+    if (warn) log.warn({ status }, 'cloudwatch: could not send memory and disk');
+    else log.info({ status }, 'cloudwatch');
+  };
+  const run = (): void => {
+    publishOnce(LIVE, started)
+      .then((status) => {
+        if (status === SENT) started = null;
+        note(status, false);
+      })
+      .catch((err: unknown) => {
+        note(errMsg(err), true);
+      });
+  };
+  setTimeout(run, FIRST_MS).unref?.();
+  setInterval(run, EVERY_MS).unref?.();
+}

package/runtime/node_modules/@metro-labs/daemon/src/server/machine.ts

@@ -13,7 +13,6 @@ const PATH = '/api/server';
 
 export interface MachineApiDeps {
   startedAt?: string;
-  resources?: (range: string) => unknown;
 }
 
 const bootedAt = new Date(Date.now() - process.uptime() * 1000).toISOString();
@@ -24,7 +23,7 @@ interface Disk {
   freeBytes: number;
 }
 
-export async function diskInfo(path = homedir()): Promise<Disk | null> {
+async function diskInfo(path = homedir()): Promise<Disk | null> {
   try {
     const s = await statfs(path);
     return { path, totalBytes: s.bsize * s.blocks, freeBytes: s.bsize * s.bavail };
@@ -55,9 +54,5 @@ export async function machineInfo(startedAt = bootedAt): Promise<Record<string,
 }
 
 export function handleMachineRequest(req: IncomingMessage, res: ServerResponse, deps: MachineApiDeps): boolean {
-  return sessionRoute(req, res, { methods: { [PATH]: ['GET'] }, admin: false, label: 'machine-api' }, async () => {
-    const info = await machineInfo(deps.startedAt);
-    const range = new URL(req.url ?? '', 'http://localhost').searchParams.get('range');
-    return range === null || deps.resources === undefined ? info : { ...info, resources: deps.resources(range) };
-  });
+  return sessionRoute(req, res, { methods: { [PATH]: ['GET'] }, admin: false, label: 'machine-api' }, () => machineInfo(deps.startedAt));
 }

package/runtime/node_modules/@metro-labs/http/package.json

@@ -2,7 +2,7 @@
   "name": "@metro-labs/http",
   "version": "0.1.0",
   "private": true,
-  "description": "How a metro server authenticates and answers a request: CORS, the JSON helpers, ApiError, the signed-identity header and the identity registry. Shared by the daemon and api.metro.box, never by a station.",
+  "description": "How a metro server authenticates and answers a request: CORS, the JSON helpers, ApiError, the signed-identity header, the identity registry and AWS request signing. Shared by the daemon and api.metro.box, never by a station.",
   "type": "module",
   "exports": {
     "./cors": "./src/cors.ts",
@@ -10,7 +10,8 @@
     "./api-error": "./src/api-error.ts",
     "./return-to": "./src/return-to.ts",
     "./mode-api": "./src/mode-api.ts",
-    "./workos-token": "./src/workos-token.ts"
+    "./workos-token": "./src/workos-token.ts",
+    "./sigv4": "./src/sigv4.ts"
   },
   "scripts": {
     "build": "tsc",

package/runtime/node_modules/@metro-labs/http/src/sigv4.ts

@@ -0,0 +1,90 @@
+const enc = new TextEncoder();
+
+const hex = (bytes: Uint8Array): string =>
+  [...bytes].map((b) => b.toString(16).padStart(2, '0')).join('');
+
+export async function sha256Hex(data: string | Uint8Array<ArrayBuffer>): Promise<string> {
+  const bytes = typeof data === 'string' ? enc.encode(data) : data;
+  return hex(new Uint8Array(await crypto.subtle.digest('SHA-256', bytes)));
+}
+
+async function hmac(key: Uint8Array<ArrayBuffer>, data: string): Promise<Uint8Array<ArrayBuffer>> {
+  const cryptoKey = await crypto.subtle.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  return new Uint8Array(await crypto.subtle.sign('HMAC', cryptoKey, enc.encode(data)));
+}
+
+const encodeRfc3986 = (value: string): string =>
+  encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+
+const byPair = (a: [string, string], b: [string, string]): number =>
+  a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0;
+
+function canonicalQuery(url: URL): string {
+  const pairs: [string, string][] = [];
+  url.searchParams.forEach((value, key) => {
+    pairs.push([encodeRfc3986(key), encodeRfc3986(value)]);
+  });
+  return pairs.sort(byPair).map(([k, v]) => `${k}=${v}`).join('&');
+}
+
+export const amzDate = (date: Date): string =>
+  date.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}Z$/, 'Z');
+
+export interface SignInput {
+  method: string;
+  url: string;
+  headers: Record<string, string>;
+  body: string;
+  region: string;
+  service: string;
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+  date?: Date;
+}
+
+export interface Signed {
+  headers: Record<string, string>;
+  canonicalRequest: string;
+  stringToSign: string;
+  signature: string;
+}
+
+function canonicalHeaders(input: SignInput, url: URL, date: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(input.headers)) out[key.toLowerCase()] = value.trim().replace(/\s+/g, ' ');
+  out.host = url.host;
+  out['x-amz-date'] = date;
+  if (input.sessionToken !== undefined) out['x-amz-security-token'] = input.sessionToken;
+  return out;
+}
+
+async function signingKey(input: SignInput, day: string): Promise<Uint8Array<ArrayBuffer>> {
+  const kDate = await hmac(enc.encode(`AWS4${input.secretAccessKey}`), day);
+  const kRegion = await hmac(kDate, input.region);
+  const kService = await hmac(kRegion, input.service);
+  return hmac(kService, 'aws4_request');
+}
+
+export async function signV4(input: SignInput): Promise<Signed> {
+  const url = new URL(input.url);
+  const date = amzDate(input.date ?? new Date());
+  const day = date.slice(0, 8);
+  const headers = canonicalHeaders(input, url, date);
+  const names = Object.keys(headers).sort();
+  const signedHeaders = names.join(';');
+  const canonicalRequest = [
+    input.method.toUpperCase(),
+    url.pathname === '' ? '/' : url.pathname,
+    canonicalQuery(url),
+    names.map((name) => `${name}:${headers[name] ?? ''}\n`).join(''),
+    signedHeaders,
+    await sha256Hex(input.body),
+  ].join('\n');
+  const scope = `${day}/${input.region}/${input.service}/aws4_request`;
+  const stringToSign = ['AWS4-HMAC-SHA256', date, scope, await sha256Hex(canonicalRequest)].join('\n');
+  const signature = hex(await hmac(await signingKey(input, day), stringToSign));
+  const authorization = `AWS4-HMAC-SHA256 Credential=${input.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  const sendable = Object.fromEntries(Object.entries(headers).filter(([name]) => name !== 'host'));
+  return { headers: { ...sendable, authorization }, canonicalRequest, stringToSign, signature };
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.223"
+  "version": "0.1.0-beta.225"
 }

package/runtime/node_modules/@metro-labs/daemon/src/server/resources.ts

@@ -1,160 +0,0 @@
-import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { cpus, freemem, homedir, totalmem } from 'node:os';
-import { dirname, join } from 'node:path';
-import { errMsg, log } from '@metro-labs/core/log';
-import { ApiError } from '@metro-labs/http/api-error';
-import { diskInfo } from './machine.js';
-
-const SAMPLE_MS = 60_000;
-const HOUR_MS = 3_600_000;
-const KEEP_MS = 7 * 24 * HOUR_MS;
-const POINTS = 240;
-const COMPACT_EVERY = 1_440;
-const RANGES: Readonly<Record<string, number>> = { '1h': HOUR_MS, '24h': 24 * HOUR_MS, '7d': KEEP_MS };
-const FIELDS = ['at', 'cpu', 'memUsed', 'memTotal', 'diskUsed', 'diskTotal'] as const;
-
-export type ResourceSample = Record<(typeof FIELDS)[number], number>;
-
-interface CpuTicks {
-  busy: number;
-  total: number;
-}
-
-const state: { samples: ResourceSample[]; appended: number } = { samples: [], appended: 0 };
-
-const resourcesFile = (): string => join(homedir(), '.metro', 'resources.jsonl');
-
-function cpuTicks(): CpuTicks {
-  let busy = 0;
-  let total = 0;
-  for (const { times } of cpus()) {
-    const sum = times.user + times.nice + times.sys + times.idle + times.irq;
-    total += sum;
-    busy += sum - times.idle;
-  }
-  return { busy, total };
-}
-
-export function cpuPercent(before: CpuTicks, after: CpuTicks): number {
-  const total = after.total - before.total;
-  if (total <= 0) return 0;
-  return Math.min(100, Math.max(0, ((after.busy - before.busy) / total) * 100));
-}
-
-function toSample(value: unknown): ResourceSample | null {
-  if (typeof value !== 'object' || value === null) return null;
-  const out: Partial<ResourceSample> = {};
-  for (const field of FIELDS) {
-    const v: unknown = (value as Record<string, unknown>)[field];
-    if (typeof v !== 'number' || !Number.isFinite(v)) return null;
-    out[field] = v;
-  }
-  return out as ResourceSample;
-}
-
-function parseLine(line: string): ResourceSample | null {
-  if (line.trim() === '') return null;
-  try {
-    return toSample(JSON.parse(line));
-  } catch {
-    return null;
-  }
-}
-
-const toLine = (sample: ResourceSample): string => `${JSON.stringify(sample)}\n`;
-
-export function readSamples(file = resourcesFile(), now = Date.now()): ResourceSample[] {
-  let text: string;
-  try {
-    text = readFileSync(file, 'utf8');
-  } catch {
-    return [];
-  }
-  return text.split('\n').flatMap((line) => parseLine(line) ?? []).filter((s) => s.at > now - KEEP_MS);
-}
-
-function rewrite(file: string): void {
-  mkdirSync(dirname(file), { recursive: true });
-  writeFileSync(file, state.samples.map(toLine).join(''));
-  state.appended = 0;
-}
-
-export function recordSample(sample: ResourceSample, file = resourcesFile()): void {
-  state.samples.push(sample);
-  const first = state.samples.findIndex((s) => s.at > sample.at - KEEP_MS);
-  if (first > 0) state.samples.splice(0, first);
-  if (state.appended >= COMPACT_EVERY) {
-    rewrite(file);
-    return;
-  }
-  mkdirSync(dirname(file), { recursive: true });
-  appendFileSync(file, toLine(sample));
-  state.appended += 1;
-}
-
-export function loadSamples(file = resourcesFile()): void {
-  state.samples = readSamples(file);
-  state.appended = 0;
-}
-
-export async function takeSample(before: CpuTicks): Promise<{ sample: ResourceSample; ticks: CpuTicks }> {
-  const ticks = cpuTicks();
-  const disk = await diskInfo();
-  const memTotal = totalmem();
-  return {
-    ticks,
-    sample: {
-      at: Date.now(),
-      cpu: cpuPercent(before, ticks),
-      memUsed: memTotal - freemem(),
-      memTotal,
-      diskUsed: disk === null ? 0 : disk.totalBytes - disk.freeBytes,
-      diskTotal: disk?.totalBytes ?? 0,
-    },
-  };
-}
-
-export function startResourceSampler(): void {
-  try {
-    loadSamples();
-    rewrite(resourcesFile());
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'resources: could not load the history');
-  }
-  let ticks = cpuTicks();
-  const run = (): void => {
-    takeSample(ticks)
-      .then((next) => {
-        ticks = next.ticks;
-        recordSample(next.sample);
-      })
-      .catch((err: unknown) => {
-        log.warn({ err: errMsg(err) }, 'resources: could not record a sample');
-      });
-  };
-  setInterval(run, SAMPLE_MS).unref?.();
-}
-
-function average(at: number, group: ResourceSample[]): ResourceSample {
-  const mean = (field: (typeof FIELDS)[number]): number => group.reduce((sum, s) => sum + s[field], 0) / group.length;
-  return { at, cpu: mean('cpu'), memUsed: mean('memUsed'), memTotal: mean('memTotal'), diskUsed: mean('diskUsed'), diskTotal: mean('diskTotal') };
-}
-
-export function resourceSeries(samples: ResourceSample[], rangeMs: number, now = Date.now()): { stepMs: number; samples: ResourceSample[] } {
-  const stepMs = Math.max(1, Math.ceil(rangeMs / POINTS / SAMPLE_MS)) * SAMPLE_MS;
-  const buckets = new Map<number, ResourceSample[]>();
-  for (const sample of samples) {
-    if (sample.at <= now - rangeMs || sample.at > now) continue;
-    const key = Math.floor(sample.at / stepMs) * stepMs;
-    const group = buckets.get(key);
-    if (group === undefined) buckets.set(key, [sample]);
-    else group.push(sample);
-  }
-  return { stepMs, samples: [...buckets].map(([at, group]) => average(at, group)) };
-}
-
-export function resourcesFor(range: string): { range: string; sampleMs: number; stepMs: number; samples: ResourceSample[] } {
-  const rangeMs = Object.hasOwn(RANGES, range) ? RANGES[range] : undefined;
-  if (rangeMs === undefined) throw new ApiError('range must be 1h, 24h or 7d', 400);
-  return { range, sampleMs: SAMPLE_MS, ...resourceSeries(state.samples, rangeMs) };
-}