@stage-labs/metro 0.1.0-beta.27 → 0.1.0-beta.271

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/connector-oauth.ts → daemon/src/connectors/oauth.ts}

@@ -1,53 +1,82 @@
-import { publicBaseOrDefault } from './attach-serve.js';
+import { publicBaseOrDefault } from '../files/attach-serve.js';
 import {
-  ConnectorVerifyError,
+  refused,
   type OAuthAuth,
   type OAuthTokens,
-} from './connector-verify.js';
-import { validateReturnTo } from './google-oauth.js';
+} from './verify.js';
+import { validateReturnTo } from '@metro-labs/http/return-to';
 import {
   authorizeUrl,
   exchangeCode,
   newVerifier,
   refreshTokens,
   registerClient,
+  type OAuthClient,
 } from './oauth-client.js';
-import { discoverOAuth } from './oauth-discovery.js';
-import { startPending, takePending, type PendingAuth } from './oauth-pending.js';
+import { discoverOAuth, type OAuthServer } from './oauth-discovery.js';
+import { ticketStore } from '@metro-labs/core/tickets';
 
-export { takePending, type PendingAuth };
+export interface PendingAuth {
+  name: string;
+  url: string;
+  resource: string;
+  returnTo: string;
+  verifier: string;
+  server: OAuthServer;
+  client: OAuthClient;
+  connectorId: string;
+}
+
+const pending = ticketStore<PendingAuth>(10 * 60_000, 100);
+
+export const startPending = (entry: PendingAuth, now = Date.now()): string => pending.mint(entry, now).ticket;
+
+export const takePending = (state: string, now = Date.now()): PendingAuth | undefined => pending.take(state, now);
+
+export const pendingCount = (): number => pending.size();
 
 const REFRESH_SKEW_MS = 300_000;
 
-export const CALLBACK_PATH = '/api/connectors/callback';
+const CALLBACK_PATH = '/api/connectors/callback';
 
-export const callbackUri = (): string =>
+const callbackUri = (): string =>
   `${publicBaseOrDefault()}${CALLBACK_PATH}`;
 
-function refused(message: string): ConnectorVerifyError {
-  return new ConnectorVerifyError(message, 400);
-}
-
 const resourceOf = (url: URL): string => url.toString();
 
-export interface BeginInput {
-  connectorId: string;
-  email: string;
-  name: string;
+export interface PrepareInput {
   url: URL;
+  client: OAuthClient | null;
   returnTo: string;
 }
 
-export async function beginOAuth(input: BeginInput): Promise<string> {
+export interface PreparedOAuth {
+  server: OAuthServer;
+  client: OAuthClient;
+  redirectUri: string;
+}
+
+export async function prepareOAuth(input: PrepareInput): Promise<PreparedOAuth> {
   if (!validateReturnTo(input.returnTo))
     throw refused('that return address is not one Metro will send you back to');
   const server = await discoverOAuth(input.url);
   const redirectUri = callbackUri();
-  const client = await registerClient(server, redirectUri);
+  const client = input.client ?? (await registerClient(server, redirectUri));
+  return { server, client, redirectUri };
+}
+
+export interface BeginInput {
+  connectorId: string;
+  name: string;
+  url: URL;
+  returnTo: string;
+}
+
+export function beginOAuth(prepared: PreparedOAuth, input: BeginInput): string {
+  const { server, client, redirectUri } = prepared;
   const verifier = newVerifier();
   const resource = resourceOf(input.url);
   const state = startPending({
-    email: input.email,
     name: input.name,
     url: input.url.toString(),
     resource,
@@ -76,6 +105,9 @@ function authOf(pendingAuth: PendingAuth, tokens: OAuthTokens): OAuthAuth {
     ...(pendingAuth.client.clientSecret === undefined
       ? {}
       : { clientSecret: pendingAuth.client.clientSecret }),
+    ...(pendingAuth.server.scopes.length === 0
+      ? {}
+      : { scope: pendingAuth.server.scopes.join(' ') }),
     ...tokens,
   };
 }
@@ -109,6 +141,7 @@ export async function refreshOAuth(
     tokenEndpoint: auth.tokenEndpoint,
     registrationEndpoint: null,
     supportsS256: true,
+    scopes: [],
   };
   const client = {
     clientId: auth.clientId,
@@ -116,7 +149,13 @@ export async function refreshOAuth(
       ? {}
       : { clientSecret: auth.clientSecret }),
   };
-  const tokens = await refreshTokens(server, client, auth.refreshToken, resource);
+  const tokens = await refreshTokens(
+    server,
+    client,
+    auth.refreshToken,
+    resource,
+    auth.scope,
+  );
   return {
     ...auth,
     ...tokens,

package/runtime/node_modules/@metro-labs/daemon/src/connectors/plugin-sync.ts

@@ -0,0 +1,131 @@
+import { existsSync, readdirEntries, readFileSync } from '../agent-user/agent-fs.js';
+import { writeHomeInPlace } from '../agent-user/home-fs.js';
+import { agentMarketplaceDir, agentUser } from '../agent-user/user.js';
+import { join } from 'node:path';
+import { errMsg, log } from '@metro-labs/core/log';
+import { claudeDir } from '../claude/files.js';
+import { loopbackBase } from '../files/attach-serve.js';
+
+const MARKER = join('bin', 'metro-plugin.mjs');
+const FILE = '.mcp.json';
+const HELPER = 'node "${CLAUDE_PLUGIN_ROOT}/bin/metro-plugin.mjs" headers';
+const SLUG_MAX = 40;
+
+export interface PluginRow {
+  id: string;
+  name: string;
+}
+
+export interface PluginServer {
+  type: 'http';
+  url: string;
+  headersHelper: string;
+}
+
+export function serverKey(name: string): string {
+  const slug = name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, SLUG_MAX)
+    .replace(/-+$/, '');
+  return slug === '' ? 'connector' : slug;
+}
+
+export function serverKeysOf(rows: PluginRow[]): Map<string, string> {
+  const taken = new Map<string, number>();
+  const keys = new Map<string, string>();
+  for (const row of rows) {
+    const wanted = serverKey(row.name);
+    const seen = taken.get(wanted) ?? 0;
+    taken.set(wanted, seen + 1);
+    keys.set(row.id, seen === 0 ? wanted : `${wanted}-${row.id.toLowerCase().replace(/[^a-z0-9]/g, '').slice(0, 4)}`);
+  }
+  return keys;
+}
+
+export function pluginServers(rows: PluginRow[], base: string): Record<string, PluginServer> {
+  const out: Record<string, PluginServer> = {};
+  for (const [id, key] of serverKeysOf(rows)) out[key] = { type: 'http', url: `${base}/relay/${id}`, headersHelper: HELPER };
+  return out;
+}
+
+const SEARCH_DEPTH = 5;
+
+function pluginRootsUnder(dir: string, depth: number, out: string[]): void {
+  if (depth < 0 || out.length >= 8) return;
+  let entries;
+  try {
+    entries = readdirEntries(dir);
+  } catch {
+    return;
+  }
+  if (entries.some((e) => e.name === 'bin' && e.isDirectory()) && existsSync(join(dir, MARKER))) {
+    out.push(dir);
+    return;
+  }
+  for (const entry of entries)
+    if (entry.isDirectory() && !entry.name.startsWith('.') && entry.name !== 'node_modules')
+      pluginRootsUnder(join(dir, entry.name), depth - 1, out);
+}
+
+function stagedPluginDir(env: NodeJS.ProcessEnv = process.env): string | null {
+  const store = env.METRO_RUNTIME_STORE?.trim() ?? '';
+  if (store === '') return null;
+  const user = agentUser();
+  return join(user === null ? join(store, 'marketplace') : agentMarketplaceDir(user), 'plugin');
+}
+
+export function installedPluginFiles(dir = claudeDir(), staged = stagedPluginDir()): string[] {
+  const roots: string[] = [];
+  const root = join(dir, 'plugins');
+  if (existsSync(root)) pluginRootsUnder(root, SEARCH_DEPTH, roots);
+  if (staged !== null && existsSync(join(staged, MARKER)) && !roots.includes(staged)) roots.push(staged);
+  return roots.map((found) => join(found, FILE));
+}
+
+const readOrNull = (path: string): string | null => {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch {
+    return null;
+  }
+};
+
+function writeIfChanged(path: string, text: string): boolean {
+  if (readOrNull(path) === text) return false;
+  writeHomeInPlace(path, text, 0o644);
+  return true;
+}
+
+export interface PluginSyncOptions {
+  dir?: string;
+  base?: string;
+  staged?: string | null;
+}
+
+function filesFor(opts: PluginSyncOptions): string[] {
+  const staged = opts.staged === undefined ? stagedPluginDir() : opts.staged;
+  return installedPluginFiles(opts.dir ?? claudeDir(), staged);
+}
+
+export function syncPluginServers(rows: PluginRow[], opts: PluginSyncOptions = {}): number {
+  const files = filesFor(opts);
+  if (files.length === 0) return 0;
+  const servers = pluginServers(rows, opts.base ?? loopbackBase());
+  const text = `${JSON.stringify(servers, null, 2)}\n`;
+  let written = 0;
+  for (const file of files) {
+    try {
+      if (writeIfChanged(file, text)) written += 1;
+    } catch (err) {
+      log.warn({ file, err: errMsg(err) }, 'plugin: could not write the connector servers');
+    }
+  }
+  if (written > 0)
+    log.info(
+      { files: written, servers: Object.keys(servers).length },
+      'plugin: connector servers written; run /reload-plugins --force to pick them up in a running session',
+    );
+  return written;
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/reach.ts

@@ -0,0 +1,27 @@
+import { errMsg } from '@metro-labs/core/log';
+
+const HINTS: Record<string, string> = {
+  ENOTFOUND: 'the name does not resolve',
+  EAI_AGAIN: 'the name did not resolve in time',
+  ECONNREFUSED: 'nothing is listening there',
+  ECONNRESET: 'the server dropped the connection',
+  ETIMEDOUT: 'the server did not answer in time',
+  ConnectionRefused: 'nothing is listening there',
+  CERT_HAS_EXPIRED: 'its certificate has expired',
+  DEPTH_ZERO_SELF_SIGNED_CERT: 'its certificate is self-signed',
+  UNABLE_TO_VERIFY_LEAF_SIGNATURE: 'its certificate could not be verified',
+  ERR_TLS_CERT_ALTNAME_INVALID: 'its certificate is for another name',
+  SELF_SIGNED_CERT_IN_CHAIN: 'its certificate chain is not trusted',
+};
+
+const codeOf = (err: unknown): string =>
+  err !== null && typeof err === 'object' && 'code' in err && typeof err.code === 'string' ? err.code : '';
+
+export function whyUnreachable(err: unknown): string {
+  const inner = err instanceof Error && err.cause instanceof Error ? err.cause : err;
+  const message = errMsg(inner).trim();
+  const code = codeOf(inner) || codeOf(err);
+  const said = message !== '' && message !== 'fetch failed' ? message : code || 'no answer';
+  const hint = HINTS[code];
+  return hint === undefined ? said : `${said} (${hint})`;
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay-policy.ts

@@ -0,0 +1,90 @@
+import type { ServerResponse } from 'node:http';
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+
+export type BlockedReason = (connectorId: string, tool: string, args: Record<string, unknown>) => string | null;
+
+export interface Screened {
+  forward: Uint8Array<ArrayBuffer> | null;
+  answers: Record<string, unknown>[];
+  batch: boolean;
+}
+
+const encoder = new TextEncoder();
+
+function parsed(body: Uint8Array): unknown {
+  try {
+    return JSON.parse(new TextDecoder().decode(body));
+  } catch {
+    return undefined;
+  }
+}
+
+function toolOf(message: unknown): string | null {
+  if (!isRecord(message) || message.method !== 'tools/call' || !isRecord(message.params)) return null;
+  const name = message.params.name;
+  return typeof name === 'string' ? name : null;
+}
+
+function blockedAnswer(message: Record<string, unknown>, reason: string): Record<string, unknown> | null {
+  if (!('id' in message)) return null;
+  return { jsonrpc: '2.0', id: message.id, result: { isError: true, content: [{ type: 'text', text: reason }] } };
+}
+
+function argsOf(message: unknown): Record<string, unknown> {
+  if (!isRecord(message) || !isRecord(message.params)) return {};
+  return isRecord(message.params.arguments) ? message.params.arguments : {};
+}
+
+function reasonFor(message: unknown, connectorId: string, blocked: BlockedReason): string | null {
+  const tool = toolOf(message);
+  return tool === null ? null : blocked(connectorId, tool, argsOf(message));
+}
+
+export function screenCalls(body: Uint8Array<ArrayBuffer>, connectorId: string, blocked: BlockedReason): Screened | null {
+  const message = parsed(body);
+  const batch = Array.isArray(message);
+  const list: unknown[] = batch ? message : [message];
+  const answers: Record<string, unknown>[] = [];
+  const kept: unknown[] = [];
+  for (const item of list) {
+    const reason = reasonFor(item, connectorId, blocked);
+    if (reason === null || !isRecord(item)) {
+      kept.push(item);
+      continue;
+    }
+    log.info({ connector: connectorId, tool: toolOf(item) }, 'relay: a call the owner blocked was answered without the connector');
+    const answer = blockedAnswer(item, reason);
+    if (answer !== null) answers.push(answer);
+  }
+  if (kept.length === list.length) return null;
+  const forward = kept.length === 0 ? null : new Uint8Array(encoder.encode(JSON.stringify(kept)));
+  return { forward, answers, batch };
+}
+
+export function answerBlocked(res: ServerResponse, screened: Screened): void {
+  if (res.headersSent) return;
+  if (screened.answers.length === 0) {
+    res.writeHead(202).end();
+    return;
+  }
+  const body = screened.batch ? screened.answers : screened.answers[0];
+  res.writeHead(200, { 'content-type': 'application/json' });
+  res.end(JSON.stringify(body));
+}
+
+const sseFrames = (answers: Record<string, unknown>[]): string =>
+  answers.map((answer) => `event: message\ndata: ${JSON.stringify(answer)}\n\n`).join('');
+
+export async function mergeBlocked(res: ServerResponse, upstream: Response, headers: Record<string, string>, answers: Record<string, unknown>[]): Promise<void> {
+  const text = await upstream.text();
+  if ((headers['content-type'] ?? '').includes('text/event-stream')) {
+    res.writeHead(upstream.status, headers);
+    res.end(`${text}${sseFrames(answers)}`);
+    return;
+  }
+  const theirs = text.trim() === '' ? [] : parsed(encoder.encode(text));
+  const list: unknown[] = Array.isArray(theirs) ? theirs : theirs === undefined || theirs === null ? [] : [theirs];
+  res.writeHead(200, { ...headers, 'content-type': 'application/json' });
+  res.end(JSON.stringify([...list, ...answers]));
+}

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/connectors}/relay.ts

@@ -1,15 +1,16 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { RelayTarget } from '../db/connector-relay.js';
-import { cliIdentity } from './api-http.js';
-import { ApiError } from './api-error.js';
-import { errMsg, log } from './log.js';
+import { whyUnreachable } from './reach.js';
+import { noteHealth } from './health.js';
+import type { RelayTarget } from './store.js';
+import { ApiError } from '@metro-labs/http/api-error';
+import { errMsg, log } from '@metro-labs/core/log';
+import { answerBlocked, mergeBlocked, screenCalls, type BlockedReason } from './relay-policy.js';
 
 export interface RelayApiDeps {
-  target: (
-    collectionId: string,
-    connectorId: string,
-    force: boolean,
-  ) => Promise<RelayTarget>;
+  target: (connectorId: string, force: boolean) => Promise<RelayTarget>;
+  identify: (req: IncomingMessage) => { subject: string; agentId: string } | null;
+  signedOut: (connectorId: string) => void;
+  blocked?: BlockedReason;
 }
 
 const ID_PATH_RE = /^\/relay\/([A-Za-z0-9][A-Za-z0-9_-]{10})$/;
@@ -146,6 +147,18 @@ function startKeepalive(res: ServerResponse): Keepalive {
   };
 }
 
+function drainedOrClosed(res: ServerResponse): Promise<void> {
+  return new Promise((resolve) => {
+    const done = (): void => {
+      res.off('drain', done);
+      res.off('close', done);
+      resolve();
+    };
+    res.once('drain', done);
+    res.once('close', done);
+  });
+}
+
 async function pumpBody(
   res: ServerResponse,
   body: ReadableStream<Uint8Array>,
@@ -156,20 +169,25 @@ async function pumpBody(
     const { done, value } = await reader.read();
     if (done) return;
     touch();
-    const ok = res.write(value);
-    if (!ok)
-      await new Promise((resolve) => {
-        res.once('drain', resolve);
-      });
+    if (!res.write(value)) await drainedOrClosed(res);
   }
 }
 
-async function pipe(res: ServerResponse, upstream: Response): Promise<void> {
+function passedHeaders(upstream: Response): Record<string, string> {
   const headers: Record<string, string> = {};
   for (const name of PASS_RES) {
     const value = upstream.headers.get(name);
     if (value !== null) headers[name] = value;
   }
+  return headers;
+}
+
+async function pipe(res: ServerResponse, upstream: Response, answers: Record<string, unknown>[]): Promise<void> {
+  const headers = passedHeaders(upstream);
+  if (answers.length > 0 && (upstream.status === 200 || upstream.status === 202)) {
+    await mergeBlocked(res, upstream, headers, answers);
+    return;
+  }
   const sse = (headers['content-type'] ?? '').includes('text/event-stream');
   if (sse) headers['x-accel-buffering'] = 'no';
   res.writeHead(upstream.status, headers);
@@ -196,18 +214,17 @@ type Exchanged =
 
 async function exchange(
   req: IncomingMessage,
-  collectionId: string,
   connectorId: string,
   deps: RelayApiDeps,
   body: Uint8Array<ArrayBuffer> | null,
   signal: AbortSignal,
 ): Promise<Exchanged> {
-  const target = await deps.target(collectionId, connectorId, false);
+  const target = await deps.target(connectorId, false);
   if (target.kind !== 'ok') return { kind: target.kind };
   let upstream = await forward(req, target, body, signal);
   if (!authFailed(upstream.status)) return { kind: 'response', upstream };
   await upstream.body?.cancel();
-  const fresh = await deps.target(collectionId, connectorId, true);
+  const fresh = await deps.target(connectorId, true);
   if (fresh.kind !== 'ok') return { kind: 'signin' };
   upstream = await forward(req, fresh, body, signal);
   if (!authFailed(upstream.status)) return { kind: 'response', upstream };
@@ -218,7 +235,6 @@ async function exchange(
 async function relayExchange(
   req: IncomingMessage,
   res: ServerResponse,
-  collectionId: string,
   connectorId: string,
   deps: RelayApiDeps,
 ): Promise<void> {
@@ -231,29 +247,58 @@ async function relayExchange(
   res.once('finish', () => {
     res.socket?.removeListener('close', bail);
   });
-  const body = req.method === 'POST' ? await readCapped(req) : null;
-  const out = await exchange(
-    req,
-    collectionId,
-    connectorId,
-    deps,
-    body,
-    control.signal,
-  );
+  try {
+    await relayOnce(req, res, connectorId, deps, control.signal);
+  } catch (err) {
+    if (!control.signal.aborted) throw err;
+    log.debug({ connector: connectorId }, 'relay: the client left before the answer ended');
+    if (!res.writableEnded) res.end();
+  }
+}
+
+async function deliver(
+  res: ServerResponse,
+  connectorId: string,
+  deps: RelayApiDeps,
+  out: Exchanged,
+  answers: Record<string, unknown>[],
+): Promise<void> {
   if (out.kind === 'missing') {
     answer(res, 404, { error: 'no such connector' });
     return;
   }
   if (out.kind === 'signin') {
+    noteHealth(connectorId, false, 'the sign-in has expired, connect it again');
+    deps.signedOut(connectorId);
     signinAnswer(res, connectorId);
     return;
   }
   if (out.upstream.status >= 300 && out.upstream.status < 400) {
     await out.upstream.body?.cancel();
+    noteHealth(connectorId, false, 'the connector redirected; metro does not follow');
     answer(res, 502, { error: 'the connector redirected; metro does not follow' });
     return;
   }
-  await pipe(res, out.upstream);
+  const { status } = out.upstream;
+  noteHealth(connectorId, status < 400, status < 400 ? null : `the connector answered ${String(status)}`);
+  await pipe(res, out.upstream, answers);
+}
+
+async function relayOnce(
+  req: IncomingMessage,
+  res: ServerResponse,
+  connectorId: string,
+  deps: RelayApiDeps,
+  signal: AbortSignal,
+): Promise<void> {
+  const read = req.method === 'POST' ? await readCapped(req) : null;
+  const screened = read === null || deps.blocked === undefined ? null : screenCalls(read, connectorId, deps.blocked);
+  if (screened?.forward === null) {
+    answerBlocked(res, screened);
+    return;
+  }
+  const out = await exchange(req, connectorId, deps, screened === null ? read : screened.forward, signal);
+  await deliver(res, connectorId, deps, out, screened?.answers ?? []);
 }
 
 function dispatch(
@@ -262,23 +307,23 @@ function dispatch(
   connectorId: string,
   deps: RelayApiDeps,
 ): void {
-  const who = cliIdentity(req);
+  const who = deps.identify(req);
   if (who === null) {
     answer(res, 401, { error: 'unauthorized' });
     return;
   }
-  relayExchange(req, res, who.collectionId, connectorId, deps).catch(
-    (err: unknown) => {
+  relayExchange(req, res, connectorId, deps)
+    .catch((err: unknown) => {
       if (err instanceof ApiError) {
         answer(res, err.status, { error: err.message });
       } else {
         log.warn({ err: errMsg(err), connector: connectorId }, 'relay: failed');
-        answer(res, 502, { error: 'metro could not reach the connector' });
+        noteHealth(connectorId, false, `metro could not reach the connector: ${whyUnreachable(err)}`);
+        answer(res, 502, { error: `metro could not reach the connector: ${whyUnreachable(err)}` });
         if (!res.writableEnded) res.end();
       }
       closeIfBodyUnread(req, res);
-    },
-  );
+    });
 }
 
 export function handleRelayRequest(