@stage-labs/metro 0.1.0-beta.30 → 0.1.0-beta.32

package/runtime/node_modules/@metro-labs/mcp/src/daemon/api-http.ts

@@ -2,10 +2,10 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import { ApiError } from './api-error.js';
 import { errMsg, log } from './log.js';
 import {
-  verifyCliToken,
+  verifyAgentToken,
   verifyRunToken,
   verifySession,
-  type CliClaims,
+  type AgentClaims,
   type RunClaims,
 } from './session.js';
 import { extractToken } from '../mcp/request-identity.js';
@@ -14,7 +14,7 @@ const BODY_MAX = 4 * 1024;
 const DRAIN_MAX = 2 * BODY_MAX;
 
 export interface ApiSession {
-  email: string;
+  subject: string;
 }
 
 export function cors(req: IncomingMessage): Record<string, string> {
@@ -22,6 +22,7 @@ export function cors(req: IncomingMessage): Record<string, string> {
     'access-control-allow-origin': req.headers.origin ?? '*',
     'access-control-allow-methods': 'GET, POST, PUT, DELETE, OPTIONS',
     'access-control-allow-headers': 'Authorization, Content-Type',
+    'access-control-allow-private-network': 'true',
     'access-control-max-age': '86400',
     vary: 'Origin',
   };
@@ -47,8 +48,8 @@ export function apiSession(req: IncomingMessage): ApiSession | null {
   const token = extractToken(req) ?? '';
   if (token === '') return null;
   try {
-    const { email } = verifySession(token, secret);
-    return { email: email.toLowerCase() };
+    const { subject } = verifySession(token, secret);
+    return { subject: subject.toLowerCase() };
   } catch {
     return null;
   }
@@ -61,22 +62,45 @@ export function runIdentity(req: IncomingMessage): RunClaims | null {
   if (token === '') return null;
   try {
     const claims = verifyRunToken(token, secret);
-    return { ...claims, email: claims.email.toLowerCase() };
+    return { ...claims, subject: claims.subject.toLowerCase() };
   } catch {
     return null;
   }
 }
 
-export function cliIdentity(req: IncomingMessage): CliClaims | null {
+export interface AgentIdentity extends AgentClaims {
+  runtimeId?: string;
+}
+
+export function agentIdentity(req: IncomingMessage): AgentIdentity | null {
   const secret = process.env.METRO_SESSION_SECRET?.trim() ?? '';
   if (secret === '') return null;
   const token = extractToken(req) ?? '';
   if (token === '') return null;
   try {
-    const { email, collectionId } = verifyCliToken(token, secret);
-    return { email: email.toLowerCase(), collectionId };
+    const { subject, agentId } = verifyAgentToken(token, secret);
+    return { subject: subject.toLowerCase(), agentId };
   } catch {
-    return null;
+    const run = runIdentity(req);
+    if (run === null) return null;
+    return { subject: run.subject, agentId: run.agentId, runtimeId: run.runtimeId };
+  }
+}
+
+export type Fence = (runtimeId: string, agentId: string) => Promise<void>;
+
+const RELEASED = 'this machine no longer holds the agent';
+
+export async function assertLease(
+  who: AgentIdentity,
+  fence: Fence,
+): Promise<void> {
+  if (who.runtimeId === undefined) return;
+  try {
+    await fence(who.runtimeId, who.agentId);
+  } catch (err) {
+    if (err instanceof ApiError) throw new ApiError(RELEASED, 401);
+    throw err;
   }
 }
 

package/runtime/node_modules/@metro-labs/mcp/src/daemon/attach-serve.ts

@@ -15,6 +15,7 @@ import { attachmentOwner, recordAttachmentOwner } from './attach-owner.js';
 import { grantAllows, issueAttachmentGrant } from './attach-grant.js';
 import { errMsg, log } from './log.js';
 import { loadTunnelConfig, webhookPort } from './tunnel.js';
+import { isLocalMode } from './paths.js';
 
 function authorized(req: IncomingMessage, name: string): boolean {
   const owner = attachmentOwner(name);
@@ -34,10 +35,11 @@ export function publicBaseUrl(): string | null {
   return host ? `https://${host}` : null;
 }
 
+const servesLocally = (): boolean =>
+  (process.env.METRO_RUN_TOKEN?.trim() ?? '') !== '' || isLocalMode();
+
 const localBase = (): string | null =>
-  (process.env.METRO_RUN_TOKEN?.trim() ?? '') === ''
-    ? null
-    : `http://127.0.0.1:${String(webhookPort())}`;
+  servesLocally() ? `http://127.0.0.1:${String(webhookPort())}` : null;
 
 export const publicBaseOrDefault = (): string =>
   publicBaseUrl() ?? localBase() ?? DEFAULT_PUBLIC_BASE;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/attach-session.ts

@@ -28,7 +28,7 @@ const MAX_PER_AGENT = 2;
 const MAX_TOTAL = 40;
 
 export interface AttachOwner {
-  email: string;
+  subject: string;
   agentId: string;
 }
 
@@ -109,7 +109,7 @@ export class AttachSessions {
   private own(owner: AttachOwner, attachId: string): Session {
     const session = this.sessions.get(attachId);
     if (
-      session?.owner.email !== owner.email ||
+      session?.owner.subject !== owner.subject ||
       session.owner.agentId !== owner.agentId
     )
       throw missing();

package/runtime/node_modules/@metro-labs/mcp/src/daemon/boot.ts

@@ -4,7 +4,13 @@ import { type Server } from 'node:http';
 import { selfLine, userSelf } from './events.js';
 import { setTrainCallBackend } from './train-call.js';
 import { errMsg, log, logFatalSync } from './log.js';
-import { acquireLock, loadMetroEnv, STATE_DIR } from './paths.js';
+import {
+  acquireLock,
+  isLocalMode,
+  loadMetroEnv,
+  STATE_DIR,
+  trainsDir,
+} from './paths.js';
 import { installCrashGuard, markDaemonReady } from './crash-guard.js';
 import {
   loadTunnelConfig,
@@ -12,7 +18,7 @@ import {
   warnOnLegacyWebhooks,
   webhookPort,
 } from './tunnel.js';
-import { TrainSupervisor, TRAINS_DIR } from './supervisor.js';
+import { TrainSupervisor } from './supervisor.js';
 import {
   makeEmit,
   startWebhookServer,
@@ -26,10 +32,16 @@ import {
   touchRuntime,
 } from '../db/runtimes.js';
 import {
-  mintRuntimeCodeForEmail,
-  releaseRuntimeForEmail,
+  blockedStationsFor,
+  mintAgentCodeForUser,
+  releaseRuntimeForUser,
 } from '../db/runtime-admin.js';
 import { loadAgentForRuntime, localAgentKey } from '../db/materialize.js';
+import { fileSource } from '../db/file-source.js';
+import { ensureLocalSessionSecret } from './local-secret.js';
+import { localConnectHint, localSessionApis } from './local-mode.js';
+import type { ModeInfo } from './mode-api.js';
+import type { SessionApis } from './session-apis.js';
 import {
   agentLiveness,
   closeAgentSession,
@@ -47,49 +59,48 @@ import {
   materializeFromDb,
   reloadAccountsFromDb,
   reloadFrom,
+  type ReloadedStations,
 } from '../db/materialize.js';
 import {
   httpSource,
   runtimeConfigFromEnv,
   startRuntimePoller,
 } from './runtime-source.js';
-import {  createAgentForEmail,  deleteAgentForEmail,  listAgentsForEmail,  ownedAgentOrThrow,  resetAgentKeyForEmail,    type ResetAgentKey,} from '../db/agent-admin.js';
+import {  createAgentForUser,  deleteAgentForUser,  listAgentsForUser,  ownedAgentOrThrow,  resetAgentKeyForUser,    type ResetAgentKey,} from '../db/agent-admin.js';
 import {
   attachAccountToAgent,
   detachAccountFromAgent,
 } from '../db/account-attach.js';
 import {
-  createConnectorForEmail,
-  createPendingConnectorForEmail,
-  deleteConnectorForEmail,
-  disconnectConnectorForEmail,
+  createConnectorForUser,
+  createPendingConnectorForUser,
+  deleteConnectorForUser,
+  disconnectConnectorForUser,
   connectorNamesByIds,
-  getConnectorForEmail,
-  listConnectorsForEmail,
-  renameConnectorForEmail,
-  reconnectConnectorForEmail,
-  verifyConnectorForEmail,
+  getConnectorForUser,
+  listConnectorsForUser,
+  renameConnectorForUser,
+  reconnectConnectorForUser,
+  verifyConnectorForUser,
 } from '../db/connectors.js';
 import { relayTarget } from '../db/connector-relay.js';
 import {
-  addMemberForEmail,
-  createProjectForEmail,
-  deleteProjectForEmail,
-  listMembersForEmail,
-  listProjectsForEmail,
-  removeMemberForEmail,
-  renameProjectForEmail,
-  setMemberRoleForEmail,
+  addMemberForUser,
+  createProjectForUser,
+  deleteProjectForUser,
+  listMembersForUser,
+  listProjectsForUser,
+  removeMemberForUser,
+  renameProjectForUser,
+  setMemberRoleForUser,
 } from '../db/projects.js';
 import {
-  addToCollectionForEmail,
-  createCollectionForEmail,
-  deleteCollectionForEmail,
-  getCollectionForEmail,
-  listCollectionsForEmail,
-  removeFromCollectionForEmail,
-  renameCollectionForEmail,
-} from '../db/connector-collections.js';
+  addConnectorToAgentForUser,
+  agentConnectorsForUser,
+  connectorIdsByAgent,
+  removeConnectorFromAgentForUser,
+} from '../db/agent-connectors.js';
+import type { AgentConnectorApiDeps } from './agent-connector-api.js';
 import type { StationName } from '../db/schema.js';
 import { AttachSessions } from './attach-session.js';
 import { startUploadReaper } from './upload-store.js';
@@ -125,12 +136,15 @@ setTrainCallBackend((train, action, args) =>
 );
 
 const runtime = runtimeConfigFromEnv();
-const localSource = runtime === null ? null : httpSource(runtime);
+const linkedSource = runtime === null ? null : httpSource(runtime);
+const localSource = linkedSource ?? (isLocalMode() ? fileSource : null);
 
 function announceLocalEndpoint(): void {
+  if (isLocalMode()) process.stderr.write(`\n${localConnectHint(webhookPort())}`);
   const key = localAgentKey();
   if (key === null) {
-    log.warn('this agent has no key — reset it in the web UI to connect an agent');
+    if (isLocalMode()) log.info('no agent on this machine yet');
+    else log.warn('this agent has no key — reset it in the web UI to connect an agent');
     return;
   }
   const url = `http://127.0.0.1:${String(webhookPort())}/mcp?token=${key}`;
@@ -154,8 +168,11 @@ async function stopLocalStations(): Promise<void> {
   for (const station of supervisor.running()) await supervisor.stopTrain(station);
 }
 
+const reloadStations = (): Promise<ReloadedStations> =>
+  localSource === null ? reloadAccountsFromDb() : reloadFrom(localSource);
+
 async function syncStations(station: StationName): Promise<void> {
-  const { removed } = await reloadAccountsFromDb();
+  const { removed } = await reloadStations();
   if (stationByName(station)?.hasTrain === false) return;
   if (removed.includes(station)) await supervisor.stopTrain(station);
   else supervisor.requestReload(station);
@@ -163,11 +180,11 @@ async function syncStations(station: StationName): Promise<void> {
 
 const attachSessions = new AttachSessions({
   authorize: async (owner) => {
-    await ownedAgentOrThrow(owner.email, owner.agentId);
+    await ownedAgentOrThrow(owner.subject, owner.agentId);
   },
   complete: async (owner, station, config) => {
     const ref = await attachAccountToAgent(
-      owner.email,
+      owner.subject,
       owner.agentId,
       station,
       config,
@@ -187,10 +204,10 @@ const attachSessions = new AttachSessions({
 });
 
 async function resetAgentKey(
-  email: string,
+  subject: string,
   id: string,
 ): Promise<ResetAgentKey> {
-  const reset = await resetAgentKeyForEmail(email, id);
+  const reset = await resetAgentKeyForUser(subject, id);
   const closed = await closeAgentSession(id);
   log.info(
     { agent: reset.name, id: reset.id, sessionClosed: closed },
@@ -201,15 +218,15 @@ async function resetAgentKey(
 
 const agentApi: AgentApiDeps = {
   attachSessions,
-  listAgents: listAgentsForEmail,
-  createAgent: createAgentForEmail,
-  deleteAgent: deleteAgentForEmail,
+  listAgents: listAgentsForUser,
+  createAgent: createAgentForUser,
+  deleteAgent: deleteAgentForUser,
   resetKey: resetAgentKey,
   gatherAccounts: gatherAccountsForAgents,
   capabilities: accountStationCapabilities,
   liveness: agentLiveness,
-  mintRuntimeCode: mintRuntimeCodeForEmail,
-  releaseRuntime: releaseRuntimeForEmail,
+  releaseRuntime: releaseRuntimeForUser,
+  connectorIds: connectorIdsByAgent,
   runtimes: runtimeLabels,
   prepareAccount,
   attachAccount: attachAccountToAgent,
@@ -222,60 +239,90 @@ const runApi: RunApiDeps = {
   fenceRuntime,
   touchRuntime,
   loadAgent: loadAgentForRuntime,
+  blockedStations: blockedStationsFor,
+};
+
+const agentConnectorApi: AgentConnectorApiDeps = {
+  agentConnectors: agentConnectorsForUser,
+  addConnector: addConnectorToAgentForUser,
+  removeConnector: removeConnectorFromAgentForUser,
+  mintCode: mintAgentCodeForUser,
 };
 
 const projectApi: ProjectApiDeps = {
-  listProjects: listProjectsForEmail,
-  createProject: createProjectForEmail,
-  renameProject: renameProjectForEmail,
-  deleteProject: deleteProjectForEmail,
-  listMembers: listMembersForEmail,
-  addMember: addMemberForEmail,
-  setMemberRole: setMemberRoleForEmail,
-  removeMember: removeMemberForEmail,
+  listProjects: listProjectsForUser,
+  createProject: createProjectForUser,
+  renameProject: renameProjectForUser,
+  deleteProject: deleteProjectForUser,
+  listMembers: listMembersForUser,
+  addMember: addMemberForUser,
+  setMemberRole: setMemberRoleForUser,
+  removeMember: removeMemberForUser,
 };
 
 const connectorApi: ConnectorApiDeps = {
-  listConnectors: listConnectorsForEmail,
+  listConnectors: listConnectorsForUser,
   connectorNamesByIds,
-  listCollections: listCollectionsForEmail,
-  getCollection: getCollectionForEmail,
-  createCollection: createCollectionForEmail,
-  renameCollection: renameCollectionForEmail,
-  deleteCollection: deleteCollectionForEmail,
-  addToCollection: addToCollectionForEmail,
-  removeFromCollection: removeFromCollectionForEmail,
-  renameConnector: renameConnectorForEmail,
-  createConnector: createConnectorForEmail,
-  createPendingConnector: createPendingConnectorForEmail,
-  reconnectConnector: reconnectConnectorForEmail,
-  getConnector: getConnectorForEmail,
-  verifyConnector: verifyConnectorForEmail,
-  disconnectConnector: disconnectConnectorForEmail,
-  deleteConnector: deleteConnectorForEmail,
+  agentConnectors: agentConnectorsForUser,
+  fenceRuntime,
+  renameConnector: renameConnectorForUser,
+  createConnector: createConnectorForUser,
+  createPendingConnector: createPendingConnectorForUser,
+  reconnectConnector: reconnectConnectorForUser,
+  getConnector: getConnectorForUser,
+  verifyConnector: verifyConnectorForUser,
+  disconnectConnector: disconnectConnectorForUser,
+  deleteConnector: deleteConnectorForUser,
 };
 
+const hostedMode = (): ModeInfo => ({
+  mode: linkedSource === null ? 'hosted' : 'linked',
+  owner: null,
+  project: null,
+});
+
+function sessionApis(): SessionApis {
+  if (isLocalMode())
+    return localSessionApis({
+      syncStations,
+      closeAgentSession,
+      gatherAccounts: gatherAccountsForAgents,
+      capabilities: accountStationCapabilities,
+      liveness: agentLiveness,
+      prepareAccount,
+    });
+  return {
+    agentApi,
+    agentConnectorApi,
+    connectorApi,
+    projectApi,
+    runApi,
+    relayApi: { target: relayTarget, fence: fenceRuntime },
+    mode: hostedMode,
+  };
+}
+
 async function main(): Promise<void> {
+  if (isLocalMode()) ensureLocalSessionSecret();
   if (localSource === null) await materializeFromDb();
-  else await materializeFrom(localSource);
+  else await materializeFrom(localSource, { allowEmpty: linkedSource === null });
   warnOnLegacyWebhooks();
   supervisor.start();
   const metroMcp = await createMetroMcp();
   webhookServer = await startWebhookServer(
     emit,
-    { agentApi, connectorApi, projectApi, runApi, relayApi: { target: relayTarget } },
+    sessionApis(),
     metroMcp.httpHandler,
     metroCall,
   );
   metroMcp.startInbound();
   startUploadReaper();
-  if (localSource !== null) {
+  if (linkedSource !== null)
     startRuntimePoller({ sync: syncLocal, stopAll: stopLocalStations });
-    announceLocalEndpoint();
-  }
+  if (localSource !== null) announceLocalEndpoint();
   tunnel?.start();
   log.info(
-    { tunnel: !!tunnel, trainsDir: TRAINS_DIR, mcp: '/' },
+    { tunnel: !!tunnel, trainsDir: trainsDir(), mcp: '/' },
     'dispatcher ready',
   );
   markDaemonReady();

package/runtime/node_modules/@metro-labs/mcp/src/daemon/cli-pair-api.ts

@@ -1,18 +1,20 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
+import { log } from './log.js';
 import {
+  agentIdentity,
+  apiFailure,
+  assertLease,
   bodyField,
-  cliIdentity,
   cors,
   readJsonBody,
   sendJson,
 } from './api-http.js';
 import { extractToken } from '../mcp/request-identity.js';
 import { publicBaseOrDefault } from './attach-serve.js';
-import { CLI_CODE_RE, takeCliCode } from './cli-pair.js';
+import { AGENT_CODE_RE, takeAgentCode } from './agent-pair.js';
 import { relayServersJson } from './connector-json.js';
-import { sessionTtlFromEnv } from './google-oauth.js';
-import { signCliToken } from './session.js';
+import { sessionTtlFromEnv } from './session-config.js';
+import { signAgentToken } from './session.js';
 import type { ConnectorApiDeps } from './connector-api.js';
 
 const CLAIM_PATH = '/api/cli/claim';
@@ -42,28 +44,33 @@ async function handleClaim(
   }
   const raw = bodyField(await readJsonBody(req), 'code');
   const code = typeof raw === 'string' ? raw.trim() : '';
-  if (!CLI_CODE_RE.test(code)) {
+  if (!AGENT_CODE_RE.test(code)) {
     sendJson(req, res, 400, {
       error:
-        'that does not look like a collection code — metro login wants the mc_… code from metro.box/#/authorize',
+        'that does not look like an agent code — metro login wants the ma_… code from the agent page',
     });
     return;
   }
-  const taken = takeCliCode(code);
+  const taken = takeAgentCode(code);
   if (taken === undefined) {
     sendJson(req, res, 400, {
       error: 'that code has expired or was already used',
     });
     return;
   }
-  const collection = await deps.getCollection(taken.email, taken.collectionId);
-  const token = signCliToken(
-    { email: taken.email, collectionId: collection.id },
+  const agent = await deps.agentConnectors(taken.subject, taken.agentId);
+  const token = signAgentToken(
+    { subject: taken.subject, agentId: agent.id },
     secret,
     { ttlSec: sessionTtlFromEnv() },
   );
-  log.info({ email: taken.email, collection: collection.id }, 'cli: code claimed');
-  sendJson(req, res, 200, { token, email: taken.email, collection: collection.name });
+  log.info({ subject: taken.subject, agent: agent.id }, 'cli: code claimed');
+  sendJson(req, res, 200, {
+    token,
+    email: taken.subject,
+    subject: taken.subject,
+    agent: agent.name,
+  });
 }
 
 async function handleRead(
@@ -72,23 +79,28 @@ async function handleRead(
   deps: ConnectorApiDeps,
   path: string,
 ): Promise<void> {
-  const who = cliIdentity(req);
+  const who = agentIdentity(req);
   if (who === null) {
     sendJson(req, res, 401, { error: 'unauthorized' });
     return;
   }
-  const collection = await deps.getCollection(who.email, who.collectionId);
+  await assertLease(who, deps.fenceRuntime);
+  const agent = await deps.agentConnectors(who.subject, who.agentId);
   if (path === SESSION_PATH) {
-    sendJson(req, res, 200, { email: who.email, collection: collection.name });
+    sendJson(req, res, 200, {
+      email: who.subject,
+      subject: who.subject,
+      agent: agent.name,
+    });
     return;
   }
-  const entries = await deps.connectorNamesByIds(collection.connectorIds);
+  const entries = await deps.connectorNamesByIds(agent.connectorIds);
   const json = relayServersJson(
     entries,
     publicBaseOrDefault(),
     extractToken(req) ?? '',
   );
-  sendJson(req, res, 200, { json, collection: collection.name });
+  sendJson(req, res, 200, { json, agent: agent.name });
 }
 
 export function handleCliPairRequest(
@@ -116,8 +128,7 @@ export function handleCliPairRequest(
       ? handleClaim(req, res, deps)
       : handleRead(req, res, deps, path);
   work.catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'cli: unhandled error');
-    if (!res.headersSent) sendJson(req, res, 500, { error: 'cli api failed' });
+    apiFailure(req, res, err, 'cli');
   });
   return true;
 }