@stage-labs/metro 0.1.0-beta.28 → 0.1.0-beta.280

package/runtime/node_modules/@metro-labs/daemon/src/claude/usage-probe.ts

@@ -0,0 +1,128 @@
+import { spawn } from 'node:child_process';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { agentCommand, agentUser, agentUserExpected, claudeBin } from '../agent-user/user.js';
+import { runningAsRoot } from '../metro-user/privilege.js';
+import { PRIVACY_ENV } from './setup.js';
+
+const REQUEST_ID = 'metro-usage';
+const REQUEST = `${JSON.stringify({ type: 'control_request', request_id: REQUEST_ID, request: { subtype: 'get_usage', skip_behaviors: true } })}\n`;
+const ARGS = [
+  '-p',
+  '--setting-sources',
+  'project',
+  '--strict-mcp-config',
+  '--mcp-config',
+  '{"mcpServers":{}}',
+  '--no-session-persistence',
+  '--input-format',
+  'stream-json',
+  '--output-format',
+  'stream-json',
+  '--verbose',
+];
+const BLOCKS_USAGE = 'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC';
+const PROBE_ENV: Record<string, string> = {
+  ...Object.fromEntries(Object.entries(PRIVACY_ENV).filter(([name]) => name !== BLOCKS_USAGE)),
+  DISABLE_AUTOUPDATER: '1',
+  DISABLE_BUG_COMMAND: '1',
+  ENABLE_CLAUDEAI_MCP_SERVERS: 'false',
+};
+const TIMEOUT_MS = 20_000;
+const KILL_GRACE_MS = 2_000;
+const LINE_MAX = 1024 * 1024;
+
+export interface UsageProbeDeps {
+  command?: string[];
+  timeoutMs?: number;
+  env?: Record<string, string>;
+}
+
+export function usageProbeCommand(env: Record<string, string> = {}): string[] | null {
+  if (runningAsRoot() || (agentUserExpected() && agentUser() === null)) return null;
+  return agentCommand([claudeBin(), ...ARGS], { ...PROBE_ENV, ...env });
+}
+
+function answerOf(line: string): Record<string, unknown> | null {
+  try {
+    const parsed: unknown = JSON.parse(line);
+    if (!isRecord(parsed) || parsed.type !== 'control_response' || !isRecord(parsed.response)) return null;
+    return parsed.response.request_id === REQUEST_ID ? parsed.response : null;
+  } catch {
+    return null;
+  }
+}
+
+function limitsOf(answer: Record<string, unknown>): unknown {
+  if (answer.subtype !== 'success') throw new Error(`Claude Code refused the usage request: ${typeof answer.error === 'string' ? answer.error : 'no reason given'}`);
+  return isRecord(answer.response) ? (answer.response.rate_limits ?? null) : null;
+}
+
+export function usageIn(output: string): unknown {
+  const answer = output
+    .split('\n')
+    .map(answerOf)
+    .find((found) => found !== null);
+  if (answer === undefined || answer === null) throw new Error('Claude Code gave no usage answer');
+  return limitsOf(answer);
+}
+
+export function readClaudeUsage(deps: UsageProbeDeps = {}): Promise<unknown> {
+  const command = deps.command ?? usageProbeCommand(deps.env);
+  if (command === null) return Promise.reject(new Error('Claude Code runs only as the agent user, and this box has none'));
+  const [file = '', ...args] = command;
+  return new Promise((resolve, reject) => {
+    const child = spawn(file, args, { cwd: '/', stdio: ['pipe', 'pipe', 'ignore'], env: { ...process.env, ...PROBE_ENV, ...deps.env } });
+    let carry = '';
+    let settled = false;
+    let hardKill: ReturnType<typeof setTimeout> | undefined;
+    const settle = (run: () => void): void => {
+      if (settled) return;
+      settled = true;
+      run();
+    };
+    const overdue = setTimeout(() => {
+      settle(() => {
+        reject(new Error('Claude Code did not report the usage in time'));
+      });
+      child.stdout.destroy();
+      child.kill('SIGTERM');
+      hardKill = setTimeout(() => child.kill('SIGKILL'), KILL_GRACE_MS);
+    }, deps.timeoutMs ?? TIMEOUT_MS);
+    const take = (line: string): void => {
+      const answer = answerOf(line);
+      if (answer === null) return;
+      settle(() => {
+        try {
+          resolve(limitsOf(answer));
+        } catch (err) {
+          reject(err instanceof Error ? err : new Error(errMsg(err)));
+        }
+      });
+    };
+    child.stdout.on('data', (chunk: Buffer) => {
+      const lines = (carry + chunk.toString('utf8')).split('\n');
+      carry = lines.pop() ?? '';
+      if (carry.length > LINE_MAX) carry = '';
+      lines.forEach(take);
+    });
+    child.stdin.on('error', (err) => {
+      log.debug({ err: errMsg(err) }, 'claude-usage: Claude Code closed its input early');
+    });
+    child.on('error', (err) => {
+      clearTimeout(overdue);
+      settle(() => {
+        reject(err);
+      });
+    });
+    child.on('close', () => {
+      clearTimeout(overdue);
+      clearTimeout(hardKill);
+      take(carry);
+      settle(() => {
+        reject(new Error('Claude Code gave no usage answer'));
+      });
+    });
+    child.stdin.end(REQUEST);
+  });
+}

package/runtime/node_modules/@metro-labs/daemon/src/claude/version.ts

@@ -0,0 +1,113 @@
+import { spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ApiError } from '@metro-labs/http/api-error';
+import { errMsg, log } from '@metro-labs/core/log';
+import { isRecord } from '@metro-labs/core/is-record';
+import { sessionRunning, stopSession, type SessionDeps } from './session.js';
+import { agentUser, asAgent, claudeBin } from '../agent-user/user.js';
+
+const LATEST_URL = 'https://registry.npmjs.org/@anthropic-ai/claude-code/latest';
+const VERSION_RE = /(\d+)\.(\d+)\.(\d+)/;
+const CACHE_MS = 10 * 60_000;
+const INSTALL_TIMEOUT_MS = 5 * 60_000;
+const TAIL = 400;
+
+export interface VersionDeps {
+  claude?: string;
+  fetchImpl?: typeof fetch;
+  session?: SessionDeps;
+  now?: () => number;
+}
+
+export interface ClaudeVersion {
+  installed: string | null;
+  latest: string | null;
+  newer: boolean;
+}
+
+let cached: { latest: string | null; at: number } | null = null;
+
+function candidates(deps: VersionDeps): string[] {
+  if (deps.claude !== undefined) return [deps.claude];
+  return agentUser() === null ? ['claude', join(homedir(), '.local', 'bin', 'claude')] : [claudeBin()];
+}
+
+const parse = (text: string): string | null => {
+  const m = VERSION_RE.exec(text);
+  return m === null ? null : `${m[1] ?? ''}.${m[2] ?? ''}.${m[3] ?? ''}`;
+};
+
+function probe(bin: string): string | null {
+  const run = spawnSync(...asAgent(bin, ['--version']), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  return run.error === undefined && run.status === 0 && typeof run.stdout === 'string' ? parse(run.stdout) : null;
+}
+
+function located(deps: VersionDeps): { bin: string; installed: string } | null {
+  for (const bin of candidates(deps)) {
+    const installed = probe(bin);
+    if (installed !== null) return { bin, installed };
+  }
+  return null;
+}
+
+export function newerThan(a: string, b: string): boolean {
+  const left = a.split('.').map(Number);
+  const right = b.split('.').map(Number);
+  for (let i = 0; i < 3; i += 1) {
+    const d = (left[i] ?? 0) - (right[i] ?? 0);
+    if (d !== 0) return d > 0;
+  }
+  return false;
+}
+
+async function latestClaudeVersion(deps: VersionDeps = {}): Promise<string | null> {
+  const now = (deps.now ?? Date.now)();
+  if (cached !== null && now - cached.at < CACHE_MS) return cached.latest;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  let latest: string | null = null;
+  try {
+    const res = await fetchImpl(LATEST_URL, { headers: { accept: 'application/json' }, redirect: 'manual' });
+    const body: unknown = res.ok ? await res.json() : null;
+    latest = isRecord(body) && typeof body.version === 'string' ? parse(body.version) : null;
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'claude-version: could not read the latest version from npm');
+  }
+  cached = { latest, at: now };
+  return latest;
+}
+
+export function forgetClaudeVersion(): void {
+  cached = null;
+}
+
+export async function claudeVersion(deps: VersionDeps = {}): Promise<ClaudeVersion> {
+  const installed = located(deps)?.installed ?? null;
+  const latest = await latestClaudeVersion(deps);
+  return { installed, latest, newer: installed !== null && latest !== null && newerThan(latest, installed) };
+}
+
+function install(bin: string): void {
+  const run = spawnSync(...asAgent(bin, ['install', 'latest']), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: INSTALL_TIMEOUT_MS });
+  if (run.error !== undefined) throw new ApiError(`claude install latest failed: ${errMsg(run.error)}`, 502);
+  if (run.status === 0) return;
+  const said = `${run.stderr ?? ''}${run.stdout ?? ''}`.trim().slice(-TAIL);
+  throw new ApiError(`claude install latest failed: ${said}`, 502);
+}
+
+function restartIfChanged(changed: boolean, session: SessionDeps): boolean {
+  if (!changed || !sessionRunning(session.tmux ?? 'tmux')) return false;
+  stopSession(session);
+  return true;
+}
+
+export async function updateClaude(deps: VersionDeps = {}): Promise<ClaudeVersion & { restarted: boolean }> {
+  const found = located(deps);
+  if (found === null) throw new ApiError('Claude Code is not installed on this machine', 404);
+  install(found.bin);
+  forgetClaudeVersion();
+  const after = await claudeVersion(deps);
+  const restarted = restartIfChanged(after.installed !== null && after.installed !== found.installed, deps.session ?? {});
+  log.info({ from: found.installed, to: after.installed, restarted }, 'claude-version: Claude Code updated');
+  return { ...after, restarted };
+}

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/connector-api.ts → daemon/src/connectors/api.ts}

@@ -1,83 +1,44 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
+import { log } from '@metro-labs/core/log';
+import { healthOf } from './health.js';
+import type { RemoteTool } from './tools.js';
+import { normalizePolicy, type ToolPolicy } from '../policy/policy.js';
 import {
   apiFailure,
   apiSession,
-  projectParam,
   bodyField,
   cors,
   readJsonBody,
   sendJson,
-  type ApiSession,
-} from './api-http.js';
-import { parseId } from '../db/ids.js';
-import type { ConnectorCollectionRow } from '../db/connector-collections.js';
-import type { RelayServerEntry } from './connector-json.js';
+  stringOf,
+} from '@metro-labs/http/api-http';
+import { parseId } from '@metro-labs/core/ids';
 import {
   handleCallback,
   handleConnect,
   hostOf,
   startOAuth,
   type OAuthRouteDeps,
-} from './connector-oauth-routes.js';
-import { ConnectorUnauthorized } from './connector-verify.js';
+} from './oauth-routes.js';
+import { ConnectorUnauthorized } from './verify.js';
 import type {
   Connector,
   ConnectorCheck,
   ConnectorInput,
   DeletedConnector,
-} from '../db/connectors.js';
+} from './store.js';
 
 const PREFIX = '/api/connectors';
 
-const asText = (value: unknown): string =>
-  typeof value === 'string' ? value : '';
-
 export interface ConnectorApiDeps extends OAuthRouteDeps {
-  listConnectors: (email: string, project: string) => Promise<Connector[]>;
-  connectorNamesByIds: (ids: string[]) => Promise<RelayServerEntry[]>;
-  listCollections: (
-    email: string,
-    project: string,
-  ) => Promise<ConnectorCollectionRow[]>;
-  getCollection: (email: string, id: string) => Promise<ConnectorCollectionRow>;
-  createCollection: (
-    email: string,
-    project: string,
-    name: string,
-  ) => Promise<ConnectorCollectionRow>;
-  renameCollection: (
-    email: string,
-    id: string,
-    name: string,
-  ) => Promise<ConnectorCollectionRow>;
-  deleteCollection: (
-    email: string,
-    id: string,
-  ) => Promise<{ id: string; name: string }>;
-  addToCollection: (
-    email: string,
-    id: string,
-    connectorId: string,
-  ) => Promise<ConnectorCollectionRow>;
-  removeFromCollection: (
-    email: string,
-    id: string,
-    connectorId: string,
-  ) => Promise<ConnectorCollectionRow>;
-  createConnector: (
-    email: string,
-    project: string,
-    input: ConnectorInput,
-  ) => Promise<Connector>;
-  verifyConnector: (email: string, id: string) => Promise<ConnectorCheck>;
-  disconnectConnector: (email: string, id: string) => Promise<Connector>;
-  renameConnector: (
-    email: string,
-    id: string,
-    name: string,
-  ) => Promise<Connector>;
-  deleteConnector: (email: string, id: string) => Promise<DeletedConnector>;
+  listConnectors: () => Promise<Connector[]>;
+  createConnector: (input: ConnectorInput) => Promise<Connector>;
+  verifyConnector: (id: string) => Promise<ConnectorCheck>;
+  connectorTools: (id: string) => Promise<RemoteTool[]>;
+  disconnectConnector: (id: string) => Promise<Connector>;
+  renameConnector: (id: string, name: string) => Promise<Connector>;
+  deleteConnector: (id: string) => Promise<DeletedConnector>;
+  setConnectorPolicy: (id: string, policy: ToolPolicy) => Promise<Connector>;
 }
 
 type Routable =
@@ -85,9 +46,11 @@ type Routable =
   | { kind: 'callback' }
   | { kind: 'connector'; id: string }
   | { kind: 'verify'; id: string }
+  | { kind: 'tools'; id: string }
   | { kind: 'connect'; id: string }
   | { kind: 'disconnect'; id: string }
-  | { kind: 'rename'; id: string };
+  | { kind: 'rename'; id: string }
+  | { kind: 'policy'; id: string };
 
 type Target = Routable | { kind: 'unknown' } | null;
 
@@ -96,9 +59,11 @@ function subTarget(id: string, rest: string[]): Target {
   if (rest.length > 1) return { kind: 'unknown' };
   const head = rest[0];
   if (head === 'verify') return { kind: 'verify', id };
+  if (head === 'tools') return { kind: 'tools', id };
   if (head === 'connect') return { kind: 'connect', id };
   if (head === 'disconnect') return { kind: 'disconnect', id };
   if (head === 'rename') return { kind: 'rename', id };
+  if (head === 'policy') return { kind: 'policy', id };
   return { kind: 'unknown' };
 }
 
@@ -113,20 +78,18 @@ function target(path: string): Target {
   return id === null ? { kind: 'unknown' } : subTarget(id, segments.slice(1));
 }
 
-function connectorPayload(
-  row: Connector,
-  detail = false,
-): Record<string, unknown> {
-  const { catalog, ...summary } = row.verified;
+function connectorPayload(row: Connector): Record<string, unknown> {
   return {
     id: row.id,
     name: row.name,
     url: row.url,
-    transport: row.transport,
     auth: row.auth,
     header: row.header,
+    clientId: row.client?.clientId ?? null,
     signIn: row.signIn,
-    verified: detail ? { ...summary, catalog } : summary,
+    verified: row.verified,
+    policy: row.policy,
+    health: healthOf(row.id),
   };
 }
 
@@ -134,14 +97,8 @@ async function handleList(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
 ): Promise<void> {
-  const project = projectParam(req);
-  if (project === null) {
-    sendJson(req, res, 400, { error: 'a project is required' });
-    return;
-  }
-  const rows = await deps.listConnectors(session.email, project);
+  const rows = await deps.listConnectors();
   sendJson(req, res, 200, {
     connectors: rows.map((row) => connectorPayload(row)),
   });
@@ -151,21 +108,17 @@ async function handleCreate(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
 ): Promise<void> {
   const body = await readJsonBody(req);
-  const project = projectParam(req);
-  if (project === null) {
-    sendJson(req, res, 400, { error: 'a project is required' });
-    return;
-  }
-  const offered = asText(bodyField(body, 'value')).trim() !== '';
+  const offered = stringOf(bodyField(body, 'value')).trim() !== '';
   try {
-    const created = await deps.createConnector(session.email, project, {
+    const created = await deps.createConnector({
       name: bodyField(body, 'name'),
       url: bodyField(body, 'url'),
       header: bodyField(body, 'header'),
       value: bodyField(body, 'value'),
+      clientId: bodyField(body, 'clientId'),
+      clientSecret: bodyField(body, 'clientSecret'),
     });
     log.info(
       { id: created.id, name: created.name, host: hostOf(created.url) },
@@ -174,7 +127,7 @@ async function handleCreate(
     sendJson(req, res, 201, connectorPayload(created));
   } catch (err) {
     if (offered || !(err instanceof ConnectorUnauthorized)) throw err;
-    await startOAuth(req, res, deps, session, project, body, (row) =>
+    await startOAuth(req, res, deps, body, (row) =>
       connectorPayload(row),
     );
   }
@@ -184,10 +137,9 @@ async function handleVerify(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   id: string,
 ): Promise<void> {
-  const check = await deps.verifyConnector(session.email, id);
+  const check = await deps.verifyConnector(id);
   log.info(
     { id: check.id, name: check.name, ok: check.ok },
     'connector-api: re-verified connector',
@@ -199,10 +151,9 @@ async function handleDisconnect(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   id: string,
 ): Promise<void> {
-  const row = await deps.disconnectConnector(session.email, id);
+  const row = await deps.disconnectConnector(id);
   log.info(
     { id: row.id, name: row.name },
     'connector-api: signed the connector out',
@@ -214,10 +165,9 @@ async function handleDelete(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   id: string,
 ): Promise<void> {
-  const gone = await deps.deleteConnector(session.email, id);
+  const gone = await deps.deleteConnector(id);
   log.info(
     { id: gone.id, name: gone.name },
     'connector-api: deleted connector',
@@ -229,22 +179,20 @@ async function handleConnector(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   id: string,
 ): Promise<void> {
   if (req.method !== 'GET') {
-    await handleDelete(req, res, deps, session, id);
+    await handleDelete(req, res, deps, id);
     return;
   }
-  const row = await deps.getConnector(session.email, id);
-  sendJson(req, res, 200, connectorPayload(row, true));
+  const row = await deps.getConnector(id);
+  sendJson(req, res, 200, connectorPayload(row));
 }
 
 async function handleRename(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   id: string,
 ): Promise<void> {
   const name = bodyField(await readJsonBody(req), 'name');
@@ -252,32 +200,48 @@ async function handleRename(
     sendJson(req, res, 400, { error: 'name is required' });
     return;
   }
-  const row = await deps.renameConnector(session.email, id, name);
+  const row = await deps.renameConnector(id, name);
   log.info({ id: row.id, name: row.name }, 'connector-api: renamed connector');
   sendJson(req, res, 200, connectorPayload(row));
 }
 
+async function handlePolicy(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ConnectorApiDeps,
+  id: string,
+): Promise<void> {
+  const policy = normalizePolicy(bodyField(await readJsonBody(req), 'policy'));
+  const row = await deps.setConnectorPolicy(id, policy);
+  log.info({ id: row.id, name: row.name, policy: row.policy }, 'connector-api: tool policy set');
+  sendJson(req, res, 200, connectorPayload(row));
+}
+
+type ById = Exclude<Routable['kind'], 'collection' | 'callback'>;
+
+const BY_ID: Record<ById, (req: IncomingMessage, res: ServerResponse, deps: ConnectorApiDeps, id: string) => Promise<void>> = {
+  verify: handleVerify,
+  tools: async (req, res, deps, id) => {
+    sendJson(req, res, 200, { tools: await deps.connectorTools(id) });
+  },
+  connect: handleConnect,
+  disconnect: handleDisconnect,
+  rename: handleRename,
+  policy: handlePolicy,
+  connector: handleConnector,
+};
+
 async function route(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
-  session: ApiSession,
   tgt: Routable,
 ): Promise<void> {
   try {
     if (tgt.kind === 'callback') return;
-    if (tgt.kind === 'verify')
-      await handleVerify(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'connect')
-      await handleConnect(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'disconnect')
-      await handleDisconnect(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'rename')
-      await handleRename(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'connector')
-      await handleConnector(req, res, deps, session, tgt.id);
-    else if (req.method === 'GET') await handleList(req, res, deps, session);
-    else await handleCreate(req, res, deps, session);
+    if (tgt.kind !== 'collection') await BY_ID[tgt.kind](req, res, deps, tgt.id);
+    else if (req.method === 'GET') await handleList(req, res, deps);
+    else await handleCreate(req, res, deps);
   } catch (err) {
     apiFailure(req, res, err, 'connector-api');
   }
@@ -288,12 +252,14 @@ const ALLOWED: Record<Routable['kind'], string[]> = {
   callback: ['GET'],
   connector: ['GET', 'DELETE'],
   verify: ['POST'],
+  tools: ['GET'],
   connect: ['POST'],
   disconnect: ['POST'],
   rename: ['POST'],
+  policy: ['PUT'],
 };
 
-function dispatch(
+async function dispatch(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
@@ -301,14 +267,14 @@ function dispatch(
 ): Promise<void> {
   if (tgt.kind === 'callback') {
     handleCallback(req, res, deps);
-    return Promise.resolve();
+    return;
   }
-  const session = apiSession(req);
+  const session = await apiSession(req);
   if (!session) {
     sendJson(req, res, 401, { error: 'unauthorized' });
-    return Promise.resolve();
+    return;
   }
-  return route(req, res, deps, session, tgt);
+  await route(req, res, deps, tgt);
 }
 
 export function handleConnectorApiRequest(
@@ -331,9 +297,8 @@ export function handleConnectorApiRequest(
     return true;
   }
   dispatch(req, res, deps, tgt).catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'connector-api: unhandled error');
-    if (!res.headersSent)
-      sendJson(req, res, 500, { error: 'connector api failed' });
+    if (res.headersSent) return;
+    apiFailure(req, res, err, 'connector-api');
   });
   return true;
 }