@stage-labs/metro 0.1.0-beta.30 → 0.1.0-beta.32

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-api.ts

@@ -9,9 +9,10 @@ import {
   readJsonBody,
   sendJson,
   type ApiSession,
+  type Fence,
 } from './api-http.js';
 import { parseId } from '../db/ids.js';
-import type { ConnectorCollectionRow } from '../db/connector-collections.js';
+import type { AgentConnectors } from '../db/agent-connectors.js';
 import type { RelayServerEntry } from './connector-json.js';
 import {
   handleCallback,
@@ -34,50 +35,23 @@ const asText = (value: unknown): string =>
   typeof value === 'string' ? value : '';
 
 export interface ConnectorApiDeps extends OAuthRouteDeps {
-  listConnectors: (email: string, project: string) => Promise<Connector[]>;
+  listConnectors: (subject: string, project: string) => Promise<Connector[]>;
   connectorNamesByIds: (ids: string[]) => Promise<RelayServerEntry[]>;
-  listCollections: (
-    email: string,
-    project: string,
-  ) => Promise<ConnectorCollectionRow[]>;
-  getCollection: (email: string, id: string) => Promise<ConnectorCollectionRow>;
-  createCollection: (
-    email: string,
-    project: string,
-    name: string,
-  ) => Promise<ConnectorCollectionRow>;
-  renameCollection: (
-    email: string,
-    id: string,
-    name: string,
-  ) => Promise<ConnectorCollectionRow>;
-  deleteCollection: (
-    email: string,
-    id: string,
-  ) => Promise<{ id: string; name: string }>;
-  addToCollection: (
-    email: string,
-    id: string,
-    connectorId: string,
-  ) => Promise<ConnectorCollectionRow>;
-  removeFromCollection: (
-    email: string,
-    id: string,
-    connectorId: string,
-  ) => Promise<ConnectorCollectionRow>;
+  agentConnectors: (subject: string, agentId: string) => Promise<AgentConnectors>;
+  fenceRuntime: Fence;
   createConnector: (
-    email: string,
+    subject: string,
     project: string,
     input: ConnectorInput,
   ) => Promise<Connector>;
-  verifyConnector: (email: string, id: string) => Promise<ConnectorCheck>;
-  disconnectConnector: (email: string, id: string) => Promise<Connector>;
+  verifyConnector: (subject: string, id: string) => Promise<ConnectorCheck>;
+  disconnectConnector: (subject: string, id: string) => Promise<Connector>;
   renameConnector: (
-    email: string,
+    subject: string,
     id: string,
     name: string,
   ) => Promise<Connector>;
-  deleteConnector: (email: string, id: string) => Promise<DeletedConnector>;
+  deleteConnector: (subject: string, id: string) => Promise<DeletedConnector>;
 }
 
 type Routable =
@@ -141,7 +115,7 @@ async function handleList(
     sendJson(req, res, 400, { error: 'a project is required' });
     return;
   }
-  const rows = await deps.listConnectors(session.email, project);
+  const rows = await deps.listConnectors(session.subject, project);
   sendJson(req, res, 200, {
     connectors: rows.map((row) => connectorPayload(row)),
   });
@@ -161,7 +135,7 @@ async function handleCreate(
   }
   const offered = asText(bodyField(body, 'value')).trim() !== '';
   try {
-    const created = await deps.createConnector(session.email, project, {
+    const created = await deps.createConnector(session.subject, project, {
       name: bodyField(body, 'name'),
       url: bodyField(body, 'url'),
       header: bodyField(body, 'header'),
@@ -187,7 +161,7 @@ async function handleVerify(
   session: ApiSession,
   id: string,
 ): Promise<void> {
-  const check = await deps.verifyConnector(session.email, id);
+  const check = await deps.verifyConnector(session.subject, id);
   log.info(
     { id: check.id, name: check.name, ok: check.ok },
     'connector-api: re-verified connector',
@@ -202,7 +176,7 @@ async function handleDisconnect(
   session: ApiSession,
   id: string,
 ): Promise<void> {
-  const row = await deps.disconnectConnector(session.email, id);
+  const row = await deps.disconnectConnector(session.subject, id);
   log.info(
     { id: row.id, name: row.name },
     'connector-api: signed the connector out',
@@ -217,7 +191,7 @@ async function handleDelete(
   session: ApiSession,
   id: string,
 ): Promise<void> {
-  const gone = await deps.deleteConnector(session.email, id);
+  const gone = await deps.deleteConnector(session.subject, id);
   log.info(
     { id: gone.id, name: gone.name },
     'connector-api: deleted connector',
@@ -236,7 +210,7 @@ async function handleConnector(
     await handleDelete(req, res, deps, session, id);
     return;
   }
-  const row = await deps.getConnector(session.email, id);
+  const row = await deps.getConnector(session.subject, id);
   sendJson(req, res, 200, connectorPayload(row, true));
 }
 
@@ -252,7 +226,7 @@ async function handleRename(
     sendJson(req, res, 400, { error: 'name is required' });
     return;
   }
-  const row = await deps.renameConnector(session.email, id, name);
+  const row = await deps.renameConnector(session.subject, id, name);
   log.info({ id: row.id, name: row.name }, 'connector-api: renamed connector');
   sendJson(req, res, 200, connectorPayload(row));
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-oauth-routes.ts

@@ -24,16 +24,16 @@ export function hostOf(url: string): string {
 
 export interface OAuthRouteDeps {
   createPendingConnector: (
-    email: string,
+    subject: string,
     project: string,
     input: { name: unknown; url: unknown },
   ) => Promise<Connector>;
   reconnectConnector: (
-    email: string,
+    subject: string,
     id: string,
     auth: OAuthAuth,
   ) => Promise<Connector>;
-  getConnector: (email: string, id: string) => Promise<Connector>;
+  getConnector: (subject: string, id: string) => Promise<Connector>;
 }
 
 export async function startOAuth(
@@ -46,12 +46,12 @@ export async function startOAuth(
   payload: (row: Connector) => Record<string, unknown>,
 ): Promise<void> {
   const url = parseConnectorUrl(bodyField(body, 'url'));
-  const row = await deps.createPendingConnector(session.email, project, {
+  const row = await deps.createPendingConnector(session.subject, project, {
     name: bodyField(body, 'name'),
     url: bodyField(body, 'url'),
   });
   const authorize = await beginOAuth({
-    email: session.email,
+    subject: session.subject,
     name: row.name,
     url,
     returnTo: asText(bodyField(body, 'returnTo')),
@@ -71,11 +71,11 @@ export async function handleConnect(
   session: ApiSession,
   id: string,
 ): Promise<void> {
-  const row = await deps.getConnector(session.email, id);
+  const row = await deps.getConnector(session.subject, id);
   const url = parseConnectorUrl(row.url);
   const body = await readJsonBody(req);
   const authorize = await beginOAuth({
-    email: session.email,
+    subject: session.subject,
     name: row.name,
     url,
     returnTo: asText(bodyField(body, 'returnTo')),
@@ -110,7 +110,7 @@ async function saveOAuth(
   entry: PendingAuth,
   auth: OAuthAuth,
 ): Promise<Connector> {
-  return deps.reconnectConnector(entry.email, entry.connectorId, auth);
+  return deps.reconnectConnector(entry.subject, entry.connectorId, auth);
 }
 
 async function settleCallback(

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-oauth.ts

@@ -4,7 +4,7 @@ import {
   type OAuthAuth,
   type OAuthTokens,
 } from './connector-verify.js';
-import { validateReturnTo } from './google-oauth.js';
+import { validateReturnTo } from './session-config.js';
 import {
   authorizeUrl,
   exchangeCode,
@@ -32,7 +32,7 @@ const resourceOf = (url: URL): string => url.toString();
 
 export interface BeginInput {
   connectorId: string;
-  email: string;
+  subject: string;
   name: string;
   url: URL;
   returnTo: string;
@@ -47,7 +47,7 @@ export async function beginOAuth(input: BeginInput): Promise<string> {
   const verifier = newVerifier();
   const resource = resourceOf(input.url);
   const state = startPending({
-    email: input.email,
+    subject: input.subject,
     name: input.name,
     url: input.url.toString(),
     resource,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/http.ts

@@ -27,7 +27,8 @@ import {
 } from './tunnel.js';
 import { attachmentEventUrl, handleAttachRequest } from './attach-serve.js';
 import { webhookEntry } from '@metro-labs/webhook';
-import { handleGoogleAuthRequest } from './google-oauth.js';
+import { handleSiweAuthRequest } from './siwe-routes.js';
+import { handleModeRequest } from './mode-api.js';
 import { handleUploadRequest } from './upload-api.js';
 import {
   handleMonitorRequest,
@@ -323,6 +324,15 @@ async function handleWebhookRoute(
   return true;
 }
 
+function handleSignInRoutes(
+  req: IncomingMessage,
+  res: ServerResponse,
+  apis: SessionApis,
+): boolean {
+  if (handleSiweAuthRequest(req, res, apis.siwe)) return true;
+  return apis.mode !== undefined && handleModeRequest(req, res, apis.mode);
+}
+
 async function handlePreMcpRoutes(
   req: IncomingMessage,
   res: ServerResponse,
@@ -331,7 +341,7 @@ async function handlePreMcpRoutes(
   monitorCall?: MonitorCall,
 ): Promise<boolean> {
   if (handleHealth(req, res)) return true;
-  if (await handleGoogleAuthRequest(req, res)) return true;
+  if (handleSignInRoutes(req, res, apis)) return true;
   if (handleSessionApis(req, res, apis)) return true;
   if (handleUploadRequest(req, res)) return true;
   if (handleAttachRequest(req, res)) return true;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/identity.ts

@@ -71,9 +71,16 @@ export function daemonSelf(): Line {
 }
 
 export function selfLine(): Line | null {
-  if (process.env.CLAUDECODE) {
-    const s = claudeSessionId();
-    return s ? Line.claude(claudeUserId(), s) : null;
+  if (!process.env.CLAUDECODE) return null;
+  const s = claudeSessionId();
+  if (!s) return null;
+  try {
+    return Line.claude(claudeUserId(), s);
+  } catch (e) {
+    log.warn(
+      { reason: errMsg(e) },
+      'could not resolve a Claude account id; relaying with no self line',
+    );
+    return null;
   }
-  return null;
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-mode.ts

@@ -0,0 +1,158 @@
+import { hostname } from 'node:os';
+import { ApiError } from './api-error.js';
+import { errMsg, log } from './log.js';
+import { AttachSessions } from './attach-session.js';
+import type { AgentApiDeps } from './agent-api.js';
+import { ATTACHABLE, type AccountApiDeps } from './account-api.js';
+import type { AgentConnectorApiDeps } from './agent-connector-api.js';
+import type { ProjectApiDeps } from './project-api.js';
+import type { SessionApis } from './session-apis.js';
+import type { ModeInfo } from './mode-api.js';
+import {
+  claimLocalOwner,
+  LOCAL_PROJECT_ID,
+  localAttachAccount,
+  localCreateAgent,
+  localDeleteAgent,
+  localDetachAccount,
+  localListAgents,
+  localOwnedAgentOrThrow,
+  localOwner,
+  localResetAgentKey,
+} from '../db/file-admin.js';
+import { normalizeAddress } from '../db/users.js';
+import type { Project } from '../db/projects.js';
+import type { StationName } from '../db/schema.js';
+
+export interface LocalModeDeps {
+  syncStations: (station: StationName) => Promise<void>;
+  closeAgentSession: (id: string) => Promise<boolean>;
+  gatherAccounts: AgentApiDeps['gatherAccounts'];
+  capabilities: AgentApiDeps['capabilities'];
+  liveness: AgentApiDeps['liveness'];
+  prepareAccount: AccountApiDeps['prepareAccount'];
+}
+
+const notHere = (what: string): Promise<never> =>
+  Promise.reject(
+    new ApiError(`${what} are managed on metro.box, not on a local daemon`, 400),
+  );
+
+function localProject(): Project {
+  return {
+    id: LOCAL_PROJECT_ID,
+    name: hostname(),
+    isDefault: true,
+    owner: true,
+    role: 'admin',
+  };
+}
+
+function attachSessions(deps: LocalModeDeps): AttachSessions {
+  return new AttachSessions({
+    authorize: async (owner) => {
+      await localOwnedAgentOrThrow(owner.subject, owner.agentId);
+    },
+    complete: async (owner, station, config) => {
+      const ref = await localAttachAccount(owner.subject, owner.agentId, station, config);
+      const activated = await deps.syncStations(station).then(
+        () => true,
+        (err: unknown) => {
+          log.warn(
+            { station, err: errMsg(err) },
+            'attach-session: station reload failed, the change lands at the next boot',
+          );
+          return false;
+        },
+      );
+      return { accountId: ref.accountId, activated };
+    },
+  });
+}
+
+function agentApi(deps: LocalModeDeps): AgentApiDeps {
+  return {
+    attachSessions: attachSessions(deps),
+    listAgents: localListAgents,
+    createAgent: localCreateAgent,
+    deleteAgent: localDeleteAgent,
+    resetKey: async (subject, id) => {
+      const reset = await localResetAgentKey(subject, id);
+      const closed = await deps.closeAgentSession(id);
+      log.info({ agent: reset.name, id, sessionClosed: closed }, 'local: key rotated');
+      return reset;
+    },
+    gatherAccounts: deps.gatherAccounts,
+    capabilities: deps.capabilities,
+    attachable: ATTACHABLE.filter((s) => s !== 'webhook'),
+    liveness: deps.liveness,
+    releaseRuntime: () => notHere('runtime leases'),
+    runtimes: () => Promise.resolve(new Map()),
+    connectorIds: () => Promise.resolve(new Map()),
+    prepareAccount: deps.prepareAccount,
+    attachAccount: localAttachAccount,
+    detachAccount: localDetachAccount,
+    syncStations: deps.syncStations,
+  };
+}
+
+const projectApi: ProjectApiDeps = {
+  listProjects: (subject) => {
+    const owner = localOwner();
+    const mine = owner !== null && owner === normalizeAddress(subject);
+    return Promise.resolve(mine ? [localProject()] : []);
+  },
+  createProject: () => notHere('projects'),
+  renameProject: () => notHere('projects'),
+  deleteProject: () => notHere('projects'),
+  listMembers: (subject, id) => {
+    const owner = localOwner();
+    if (id !== LOCAL_PROJECT_ID || owner === null || owner !== normalizeAddress(subject))
+      return Promise.reject(new ApiError('no such project', 404));
+    return Promise.resolve([
+      { id: 'owner', address: owner, email: null, role: 'admin', owner: true },
+    ]);
+  },
+  addMember: () => notHere('members'),
+  setMemberRole: () => notHere('members'),
+  removeMember: () => notHere('members'),
+};
+
+const agentConnectorApi: AgentConnectorApiDeps = {
+  agentConnectors: async (subject, id) => {
+    const { agent } = await localOwnedAgentOrThrow(subject, id);
+    return { ...agent, connectorIds: [] };
+  },
+  addConnector: () => notHere('connectors'),
+  removeConnector: () => notHere('connectors'),
+  mintCode: () =>
+    Promise.reject(new ApiError('a local daemon has no pairing codes', 400)),
+};
+
+export function localConnectHint(port: number): string {
+  const ui = process.env.METRO_UI_URL ?? 'https://metro.box';
+  const here = `http://127.0.0.1:${String(port)}`;
+  const forward = `ssh -L ${String(port)}:127.0.0.1:${String(port)} ${hostname()}`;
+  return [
+    'Manage this machine from the web UI:',
+    '',
+    `  ${ui}/#/connect/${encodeURIComponent(here)}`,
+    '',
+    `From another computer, forward the port first:  ${forward}`,
+    '',
+  ].join('\n');
+}
+
+export function localModeInfo(): ModeInfo {
+  return { mode: 'local', owner: localOwner(), project: LOCAL_PROJECT_ID };
+}
+
+export function localSessionApis(deps: LocalModeDeps): SessionApis {
+  return {
+    agentApi: agentApi(deps),
+    agentConnectorApi,
+    projectApi,
+    siwe: { ensureUser: claimLocalOwner },
+    mode: localModeInfo,
+  };
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-secret.ts

@@ -0,0 +1,21 @@
+import { randomBytes } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { agentsDir } from '../db/file-source.js';
+import { ensureSecureDir, writeSecure } from './secure-fs.js';
+
+const SECRET_FILE = '.session-secret';
+
+export function ensureLocalSessionSecret(dir = agentsDir()): string {
+  const configured = process.env.METRO_SESSION_SECRET?.trim() ?? '';
+  if (configured !== '') return configured;
+  const path = join(dir, SECRET_FILE);
+  let secret = existsSync(path) ? readFileSync(path, 'utf8').trim() : '';
+  if (secret === '') {
+    secret = randomBytes(32).toString('base64url');
+    ensureSecureDir(dir);
+    writeSecure(path, `${secret}\n`);
+  }
+  process.env.METRO_SESSION_SECRET = secret;
+  return secret;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/mode-api.ts

@@ -0,0 +1,31 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { cors, sendJson } from './api-http.js';
+
+const PATH = '/api/mode';
+
+export type DaemonMode = 'hosted' | 'linked' | 'local';
+
+export interface ModeInfo {
+  mode: DaemonMode;
+  owner: string | null;
+  project: string | null;
+}
+
+export function handleModeRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  info: () => ModeInfo,
+): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  sendJson(req, res, 200, info());
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-pending.ts

@@ -7,7 +7,7 @@ const SWEEP_MS = 60_000;
 const MAX_PENDING = 100;
 
 export interface PendingAuth {
-  email: string;
+  subject: string;
   name: string;
   url: string;
   resource: string;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/paths.ts

@@ -10,6 +10,7 @@ import {
 } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { log } from './log.js';
 
 export const STATE_DIR =
@@ -23,6 +24,15 @@ export const CONFIG_ENV_FILE = join(CONFIG_DIR, '.env');
 
 export const TRAINS_ENV_FILE = join(homedir(), '.metro', '.env');
 
+export function trainsDir(): string {
+  const env = process.env.METRO_TRAINS_DIR?.trim();
+  if (env !== undefined && env !== '') return env;
+  return fileURLToPath(new URL('../../trains', import.meta.url));
+}
+
+export const isLocalMode = (): boolean =>
+  process.env.METRO_MODE?.trim() === 'local';
+
 export const envSources = (): readonly string[] => [
   join(process.cwd(), '.env'),
   TRAINS_ENV_FILE,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/project-api.ts

@@ -15,32 +15,32 @@ import type { Member, Project } from '../db/projects.js';
 const PREFIX = '/api/projects';
 
 export interface ProjectApiDeps {
-  listProjects: (email: string) => Promise<Project[]>;
-  createProject: (email: string, name: unknown) => Promise<Project>;
+  listProjects: (subject: string) => Promise<Project[]>;
+  createProject: (subject: string, name: unknown) => Promise<Project>;
   renameProject: (
-    email: string,
+    subject: string,
     id: string,
     name: unknown,
   ) => Promise<Project>;
   deleteProject: (
-    email: string,
+    subject: string,
     id: string,
   ) => Promise<{ id: string; name: string }>;
-  listMembers: (email: string, id: string) => Promise<Member[]>;
+  listMembers: (subject: string, id: string) => Promise<Member[]>;
   addMember: (
-    email: string,
+    subject: string,
     id: string,
     invited: unknown,
     role: unknown,
   ) => Promise<Member[]>;
   setMemberRole: (
-    email: string,
+    subject: string,
     id: string,
     memberId: string,
     role: unknown,
   ) => Promise<Member[]>;
   removeMember: (
-    email: string,
+    subject: string,
     id: string,
     memberId: string,
   ) => Promise<Member[]>;
@@ -98,11 +98,11 @@ async function handleIndex(
   session: ApiSession,
 ): Promise<void> {
   if (req.method === 'GET') {
-    sendJson(req, res, 200, { projects: await deps.listProjects(session.email) });
+    sendJson(req, res, 200, { projects: await deps.listProjects(session.subject) });
     return;
   }
   const made = await deps.createProject(
-    session.email,
+    session.subject,
     bodyField(await readJsonBody(req), 'name'),
   );
   log.info({ id: made.id, name: made.name }, 'project-api: created project');
@@ -117,14 +117,14 @@ async function handleMembers(
   id: string,
 ): Promise<void> {
   if (req.method === 'GET') {
-    sendJson(req, res, 200, { members: await deps.listMembers(session.email, id) });
+    sendJson(req, res, 200, { members: await deps.listMembers(session.subject, id) });
     return;
   }
   const body = await readJsonBody(req);
   const members = await deps.addMember(
-    session.email,
+    session.subject,
     id,
-    bodyField(body, 'email'),
+    bodyField(body, 'address'),
     bodyField(body, 'role'),
   );
   sendJson(req, res, 200, { members });
@@ -138,12 +138,12 @@ async function handleMember(
   tgt: { id: string; memberId: string },
 ): Promise<void> {
   if (req.method === 'DELETE') {
-    const members = await deps.removeMember(session.email, tgt.id, tgt.memberId);
+    const members = await deps.removeMember(session.subject, tgt.id, tgt.memberId);
     sendJson(req, res, 200, { members });
     return;
   }
   const members = await deps.setMemberRole(
-    session.email,
+    session.subject,
     tgt.id,
     tgt.memberId,
     bodyField(await readJsonBody(req), 'role'),
@@ -170,12 +170,12 @@ async function route(
         res,
         200,
         await deps.renameProject(
-          session.email,
+          session.subject,
           tgt.id,
           bodyField(await readJsonBody(req), 'name'),
         ),
       );
-    else sendJson(req, res, 200, await deps.deleteProject(session.email, tgt.id));
+    else sendJson(req, res, 200, await deps.deleteProject(session.subject, tgt.id));
   } catch (err) {
     apiFailure(req, res, err, 'project-api');
   }