@stage-labs/metro 0.1.0-beta.30 → 0.1.0-beta.32

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-connectors.ts

@@ -0,0 +1,143 @@
+import { and, asc, eq, inArray, ne } from 'drizzle-orm';
+import { getDb } from './client.js';
+import { newId } from './ids.js';
+import { isUniqueViolation } from './users.js';
+import { ownedAgentOrThrow } from './agent-admin.js';
+import { ConnectorError } from './connector-config.js';
+import { agentConnectors, agents, connectors } from './schema.js';
+
+export interface AgentConnectors {
+  id: string;
+  name: string;
+  connectorIds: string[];
+}
+
+const nameClash = (name: string, agent: string): ConnectorError =>
+  new ConnectorError(
+    `the agent '${agent}' already has a connector named '${name}'`,
+    409,
+  );
+
+async function collidingAgent(
+  agentIds: string[],
+  name: string,
+  exceptConnectorId: string,
+): Promise<string | null> {
+  if (agentIds.length === 0) return null;
+  const rows = await getDb()
+    .select({ agent: agents.name })
+    .from(agentConnectors)
+    .innerJoin(connectors, eq(connectors.id, agentConnectors.connectorId))
+    .innerJoin(agents, eq(agents.id, agentConnectors.agentId))
+    .where(
+      and(
+        inArray(agentConnectors.agentId, agentIds),
+        eq(connectors.name, name),
+        ne(connectors.id, exceptConnectorId),
+      ),
+    )
+    .limit(1);
+  return rows[0]?.agent ?? null;
+}
+
+export async function assertRenameFreeOfClash(
+  connectorId: string,
+  name: string,
+): Promise<void> {
+  const rows = await getDb()
+    .select({ agentId: agentConnectors.agentId })
+    .from(agentConnectors)
+    .where(eq(agentConnectors.connectorId, connectorId));
+  const clash = await collidingAgent(
+    rows.map((r) => r.agentId),
+    name,
+    connectorId,
+  );
+  if (clash !== null) throw nameClash(name, clash);
+}
+
+export async function connectorIdsOfAgent(agentId: string): Promise<string[]> {
+  const rows = await getDb()
+    .select({ connectorId: agentConnectors.connectorId })
+    .from(agentConnectors)
+    .where(eq(agentConnectors.agentId, agentId))
+    .orderBy(asc(agentConnectors.id));
+  return rows.map((r) => r.connectorId);
+}
+
+export async function connectorIdsByAgent(
+  agentIds: string[],
+): Promise<Map<string, string[]>> {
+  const out = new Map<string, string[]>();
+  if (agentIds.length === 0) return out;
+  const rows = await getDb()
+    .select({
+      agentId: agentConnectors.agentId,
+      connectorId: agentConnectors.connectorId,
+    })
+    .from(agentConnectors)
+    .where(inArray(agentConnectors.agentId, agentIds))
+    .orderBy(asc(agentConnectors.id));
+  for (const row of rows) {
+    const list = out.get(row.agentId) ?? [];
+    list.push(row.connectorId);
+    out.set(row.agentId, list);
+  }
+  return out;
+}
+
+export async function agentConnectorsForUser(
+  subject: string,
+  agentId: string,
+): Promise<AgentConnectors> {
+  const { agent } = await ownedAgentOrThrow(subject, agentId);
+  return { ...agent, connectorIds: await connectorIdsOfAgent(agent.id) };
+}
+
+async function connectorNameIn(
+  projectId: string,
+  connectorId: string,
+): Promise<string | null> {
+  const rows = await getDb()
+    .select({ name: connectors.name })
+    .from(connectors)
+    .where(and(eq(connectors.id, connectorId), eq(connectors.projectId, projectId)));
+  return rows[0]?.name ?? null;
+}
+
+export async function addConnectorToAgentForUser(
+  subject: string,
+  agentId: string,
+  connectorId: string,
+): Promise<AgentConnectors> {
+  const { agent, projectId } = await ownedAgentOrThrow(subject, agentId);
+  const name = await connectorNameIn(projectId, connectorId);
+  if (name === null) throw new ConnectorError('no such connector', 404);
+  const clash = await collidingAgent([agent.id], name, connectorId);
+  if (clash !== null) throw nameClash(name, clash);
+  try {
+    await getDb()
+      .insert(agentConnectors)
+      .values({ id: newId(), agentId: agent.id, connectorId });
+  } catch (err) {
+    if (!isUniqueViolation(err)) throw err;
+  }
+  return { ...agent, connectorIds: await connectorIdsOfAgent(agent.id) };
+}
+
+export async function removeConnectorFromAgentForUser(
+  subject: string,
+  agentId: string,
+  connectorId: string,
+): Promise<AgentConnectors> {
+  const { agent } = await ownedAgentOrThrow(subject, agentId);
+  await getDb()
+    .delete(agentConnectors)
+    .where(
+      and(
+        eq(agentConnectors.agentId, agent.id),
+        eq(agentConnectors.connectorId, connectorId),
+      ),
+    );
+  return { ...agent, connectorIds: await connectorIdsOfAgent(agent.id) };
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/connector-relay.ts

@@ -8,7 +8,7 @@ import {
 import { errMsg, log } from '../daemon/log.js';
 import { readConfig, type ConnectorConfig } from './connector-config.js';
 import { getDb } from './client.js';
-import { collectionItems, connectors } from './schema.js';
+import { agentConnectors, connectors } from './schema.js';
 
 export type RelayTarget =
   | { kind: 'ok'; url: string; headers: Record<string, string> }
@@ -32,17 +32,17 @@ export function headerAuthHeaders(
 }
 
 async function memberRow(
-  collectionId: string,
+  agentId: string,
   connectorId: string,
 ): Promise<ConnectorRow | undefined> {
   const rows = await getDb()
     .select({ connector: connectors })
-    .from(collectionItems)
-    .innerJoin(connectors, eq(collectionItems.connectorId, connectors.id))
+    .from(agentConnectors)
+    .innerJoin(connectors, eq(agentConnectors.connectorId, connectors.id))
     .where(
       and(
-        eq(collectionItems.collectionId, collectionId),
-        eq(collectionItems.connectorId, connectorId),
+        eq(agentConnectors.agentId, agentId),
+        eq(agentConnectors.connectorId, connectorId),
       ),
     );
   return rows[0]?.connector;
@@ -112,11 +112,11 @@ export function fixedTarget(
 }
 
 export async function relayTarget(
-  collectionId: string,
+  agentId: string,
   connectorId: string,
   force: boolean,
 ): Promise<RelayTarget> {
-  const row = await memberRow(collectionId, connectorId);
+  const row = await memberRow(agentId, connectorId);
   if (row === undefined) return { kind: 'missing' };
   parseConnectorUrl(row.url);
   const config = readConfig(row.config);

package/runtime/node_modules/@metro-labs/mcp/src/db/connectors.ts

@@ -1,4 +1,4 @@
-import { assertRenameFreeOfClash } from './connector-collections.js';
+import { assertRenameFreeOfClash } from './agent-connectors.js';
 import { projectIdOrThrow } from './projects.js';
 import { and, asc, eq, inArray } from 'drizzle-orm';
 import {
@@ -80,7 +80,7 @@ const missing = (): ConnectorError =>
   new ConnectorError('no such connector', 404);
 
 async function ownedConnectorOrThrow(
-  email: string,
+  subject: string,
   id: string,
 ): Promise<ConnectorRow> {
   const rows = await getDb()
@@ -90,7 +90,7 @@ async function ownedConnectorOrThrow(
   const row = rows[0];
   if (row === undefined) throw missing();
   try {
-    await projectIdOrThrow(email, row.projectId);
+    await projectIdOrThrow(subject, row.projectId);
   } catch {
     throw missing();
   }
@@ -112,10 +112,10 @@ async function saveConfig(
 }
 
 async function connectorRowsFor(
-  email: string,
+  subject: string,
   project: string,
 ): Promise<ConnectorRow[]> {
-  const projectId = await projectIdOrThrow(email, project);
+  const projectId = await projectIdOrThrow(subject, project);
   return getDb()
     .select()
     .from(connectors)
@@ -123,11 +123,11 @@ async function connectorRowsFor(
     .orderBy(asc(connectors.id));
 }
 
-export async function listConnectorsForEmail(
-  email: string,
+export async function listConnectorsForUser(
+  subject: string,
   project: string,
 ): Promise<Connector[]> {
-  return (await connectorRowsFor(email, project)).map(toConnector);
+  return (await connectorRowsFor(subject, project)).map(toConnector);
 }
 
 async function rowsByIds(ids: string[]): Promise<ConnectorRow[]> {
@@ -145,11 +145,11 @@ export async function connectorNamesByIds(
   return (await rowsByIds(ids)).map((row) => ({ id: row.id, name: row.name }));
 }
 
-export async function getConnectorForEmail(
-  email: string,
+export async function getConnectorForUser(
+  subject: string,
   id: string,
 ): Promise<Connector> {
-  return toConnector(await ownedConnectorOrThrow(email, id));
+  return toConnector(await ownedConnectorOrThrow(subject, id));
 }
 
 async function insertConnector(
@@ -185,14 +185,14 @@ const UNVERIFIED = {
   catalog: [],
 };
 
-export async function createPendingConnectorForEmail(
-  email: string,
+export async function createPendingConnectorForUser(
+  subject: string,
   project: string,
   input: { name: unknown; url: unknown },
 ): Promise<Connector> {
   const name = connectorName(input.name);
   const url = parseConnectorUrl(input.url);
-  const projectId = await projectIdOrThrow(email, project);
+  const projectId = await projectIdOrThrow(subject, project);
   return insertConnector(projectId, name, url, {
     auth: { kind: 'none' },
     createdAt: new Date().toISOString(),
@@ -201,15 +201,15 @@ export async function createPendingConnectorForEmail(
   });
 }
 
-export async function createConnectorForEmail(
-  email: string,
+export async function createConnectorForUser(
+  subject: string,
   project: string,
   input: ConnectorInput,
 ): Promise<Connector> {
   const name = connectorName(input.name);
   const url = parseConnectorUrl(input.url);
   const auth = connectorAuth(input.header, input.value);
-  const projectId = await projectIdOrThrow(email, project);
+  const projectId = await projectIdOrThrow(subject, project);
   const verified = stamp(await verifyRemoteMcp(url, auth));
   return insertConnector(projectId, name, url, {
     auth,
@@ -233,34 +233,34 @@ async function freshAuth(
   return refreshOAuth(auth, resource);
 }
 
-export async function reconnectConnectorForEmail(
-  email: string,
+export async function reconnectConnectorForUser(
+  subject: string,
   id: string,
   auth: OAuthAuth,
 ): Promise<Connector> {
-  const row = await ownedConnectorOrThrow(email, id);
+  const row = await ownedConnectorOrThrow(subject, id);
   const config = readConfig(row.config);
   const url = parseConnectorUrl(row.url);
   const verified = stamp(await verifyRemoteMcp(url, auth));
   return saveConfig(row, { ...config, auth, verified, oauth: true });
 }
 
-export async function disconnectConnectorForEmail(
-  email: string,
+export async function disconnectConnectorForUser(
+  subject: string,
   id: string,
 ): Promise<Connector> {
-  const row = await ownedConnectorOrThrow(email, id);
+  const row = await ownedConnectorOrThrow(subject, id);
   const config = readConfig(row.config);
   if (config.auth.kind !== 'oauth')
     throw new ConnectorError('that connector is not signed in', 400);
   return saveConfig(row, { ...config, auth: { kind: 'none' }, oauth: true });
 }
 
-export async function verifyConnectorForEmail(
-  email: string,
+export async function verifyConnectorForUser(
+  subject: string,
   id: string,
 ): Promise<ConnectorCheck> {
-  const row = await ownedConnectorOrThrow(email, id);
+  const row = await ownedConnectorOrThrow(subject, id);
   const config = readConfig(row.config);
   try {
     const url = parseConnectorUrl(row.url);
@@ -275,13 +275,13 @@ export async function verifyConnectorForEmail(
   }
 }
 
-export async function renameConnectorForEmail(
-  email: string,
+export async function renameConnectorForUser(
+  subject: string,
   id: string,
   raw: string,
 ): Promise<Connector> {
   const name = connectorName(raw);
-  const row = await ownedConnectorOrThrow(email, id);
+  const row = await ownedConnectorOrThrow(subject, id);
   await assertRenameFreeOfClash(row.id, name);
   const rows = await getDb()
     .update(connectors)
@@ -293,11 +293,11 @@ export async function renameConnectorForEmail(
   return toConnector(saved);
 }
 
-export async function deleteConnectorForEmail(
-  email: string,
+export async function deleteConnectorForUser(
+  subject: string,
   id: string,
 ): Promise<DeletedConnector> {
-  const row = await ownedConnectorOrThrow(email, id);
+  const row = await ownedConnectorOrThrow(subject, id);
   const gone = await getDb()
     .delete(connectors)
     .where(eq(connectors.id, row.id))

package/runtime/node_modules/@metro-labs/mcp/src/db/file-admin.ts

@@ -0,0 +1,250 @@
+import {
+  closeSync,
+  existsSync,
+  openSync,
+  readFileSync,
+  rmdirSync,
+  rmSync,
+  writeSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import { ApiError } from '../daemon/api-error.js';
+import { ensureSecureDir, writeSecure } from '../daemon/secure-fs.js';
+import {
+  AgentAdminError,
+  newApiKey,
+  normalizeAgentName,
+  type AgentSummary,
+  type CreatedAgent,
+  type DeletedAgent,
+  type OwnedAgent,
+  type ResetAgentKey,
+} from './agent-admin.js';
+import type { AccountRef } from './account-attach.js';
+import {
+  AGENT_FILE,
+  agentsDir,
+  listAgentFiles,
+  readAgentFile,
+  type AgentFile,
+} from './file-source.js';
+import { newId } from './ids.js';
+import { registerKey, rotateAgentKey, unregisterAgentKey } from './key-map.js';
+import { MOVABLE_STATIONS } from './materialize.js';
+import type { StationName } from './schema.js';
+import { normalizeAddress } from './users.js';
+
+export const LOCAL_PROJECT_ID = 'localdaemon';
+const OWNER_FILE = '.owner';
+
+interface Stored {
+  path: string;
+  file: AgentFile;
+}
+
+const missing = (): AgentAdminError => new AgentAdminError('no such agent', 404);
+
+export function localOwner(dir = agentsDir()): string | null {
+  try {
+    return normalizeAddress(readFileSync(join(dir, OWNER_FILE), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function writeOwnerOnce(path: string, address: string): boolean {
+  let fd: number;
+  try {
+    fd = openSync(path, 'wx', 0o600);
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === 'EEXIST') return false;
+    throw err;
+  }
+  writeSync(fd, `${address}\n`);
+  closeSync(fd);
+  return true;
+}
+
+export function claimLocalOwner(raw: string, dir = agentsDir()): Promise<string> {
+  const address = normalizeAddress(raw);
+  if (address === null)
+    return Promise.reject(new ApiError('an Ethereum address is required', 400));
+  ensureSecureDir(dir);
+  if (writeOwnerOnce(join(dir, OWNER_FILE), address))
+    return Promise.resolve(address);
+  if (localOwner(dir) !== address)
+    return Promise.reject(
+      new ApiError('this machine belongs to another wallet', 403),
+    );
+  return Promise.resolve(address);
+}
+
+function isOwner(subject: string, dir: string): boolean {
+  const owner = localOwner(dir);
+  return owner !== null && owner === normalizeAddress(subject);
+}
+
+function storedAgents(dir: string): Stored[] {
+  return listAgentFiles(dir).map((path) => ({ path, file: readAgentFile(path) }));
+}
+
+function save(stored: Stored): void {
+  writeSecure(stored.path, `${JSON.stringify(stored.file, null, 2)}\n`);
+}
+
+function ownedOrThrow(subject: string, id: string, dir: string): Stored {
+  if (!isOwner(subject, dir)) throw missing();
+  const found = storedAgents(dir).find((s) => s.file.id === id);
+  if (found === undefined) throw missing();
+  return found;
+}
+
+export async function localOwnedAgentOrThrow(
+  subject: string,
+  id: string,
+  dir = agentsDir(),
+): Promise<{ agent: OwnedAgent }> {
+  const { file } = ownedOrThrow(subject, id, dir);
+  return Promise.resolve({ agent: { id: file.id, name: file.name } });
+}
+
+export async function localListAgents(
+  subject: string,
+  project: string,
+  dir = agentsDir(),
+): Promise<AgentSummary[]> {
+  if (project !== LOCAL_PROJECT_ID || !isOwner(subject, dir))
+    throw new AgentAdminError('no such project', 404);
+  return Promise.resolve(
+    storedAgents(dir)
+      .map(({ file }) => ({ id: file.id, name: file.name, owned: true, key: file.key }))
+      .sort((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id)),
+  );
+}
+
+function freshId(taken: Set<string>): string {
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    const id = newId();
+    if (!taken.has(id)) return id;
+  }
+  throw new AgentAdminError('could not allocate a free id', 500);
+}
+
+export async function localCreateAgent(
+  subject: string,
+  project: string,
+  rawName: string,
+  dir = agentsDir(),
+): Promise<CreatedAgent> {
+  if (project !== LOCAL_PROJECT_ID || !isOwner(subject, dir))
+    throw new AgentAdminError('no such project', 404);
+  const name = normalizeAgentName(rawName);
+  const folder = join(dir, name);
+  if (existsSync(join(folder, AGENT_FILE)))
+    throw new AgentAdminError(
+      `an agent named '${name}' already exists on this machine`,
+      409,
+    );
+  const existing = storedAgents(dir);
+  const id = freshId(new Set(existing.map((s) => s.file.id)));
+  const key = newApiKey();
+  ensureSecureDir(folder);
+  save({
+    path: join(folder, AGENT_FILE),
+    file: { version: 1, id, name, key, owner: localOwner(dir), stations: [] },
+  });
+  registerKey(key, id);
+  return Promise.resolve({ id, name, key });
+}
+
+export async function localResetAgentKey(
+  subject: string,
+  id: string,
+  dir = agentsDir(),
+): Promise<ResetAgentKey> {
+  const stored = ownedOrThrow(subject, id, dir);
+  const key = newApiKey();
+  stored.file.key = key;
+  save(stored);
+  rotateAgentKey(id, key);
+  return Promise.resolve({ id, name: stored.file.name, key });
+}
+
+export async function localDeleteAgent(
+  subject: string,
+  id: string,
+  dir = agentsDir(),
+): Promise<DeletedAgent> {
+  const stored = ownedOrThrow(subject, id, dir);
+  const attached = stored.file.stations.length;
+  if (attached > 0)
+    throw new AgentAdminError(
+      `agent '${stored.file.name}' still has ${String(attached)} station account(s) attached — detach them first`,
+      409,
+    );
+  rmSync(stored.path);
+  removeIfEmpty(join(stored.path, '..'));
+  unregisterAgentKey(id);
+  return Promise.resolve({ id, name: stored.file.name });
+}
+
+function removeIfEmpty(folder: string): void {
+  try {
+    rmdirSync(folder);
+  } catch {
+    return;
+  }
+}
+
+function assertTokenFree(all: Stored[], station: StationName, token: string): void {
+  const taken = all.some((s) =>
+    s.file.stations.some(
+      (a) => a.station === station && a.config.token === token,
+    ),
+  );
+  if (taken)
+    throw new AgentAdminError(
+      'that bot token is already attached to an agent on this machine',
+      409,
+    );
+}
+
+export async function localAttachAccount(
+  subject: string,
+  agentId: string,
+  station: StationName,
+  config: Record<string, unknown>,
+  dir = agentsDir(),
+): Promise<AccountRef> {
+  const stored = ownedOrThrow(subject, agentId, dir);
+  if (!MOVABLE_STATIONS.has(station))
+    throw new AgentAdminError(
+      `a ${station} endpoint needs a public url and cannot live on a local daemon`,
+      400,
+    );
+  const token = config.token;
+  if (typeof token === 'string') assertTokenFree(storedAgents(dir), station, token);
+  const taken = new Set(stored.file.stations.map((a) => a.id));
+  const accountId = freshId(taken);
+  stored.file.stations.push({ station, id: accountId, allowlist: ['*'], config });
+  save(stored);
+  return Promise.resolve({ agentId, station, accountId });
+}
+
+export async function localDetachAccount(
+  subject: string,
+  agentId: string,
+  station: StationName,
+  accountId: string,
+  dir = agentsDir(),
+): Promise<AccountRef> {
+  const stored = ownedOrThrow(subject, agentId, dir);
+  const before = stored.file.stations.length;
+  stored.file.stations = stored.file.stations.filter(
+    (a) => !(a.station === station && a.id === accountId),
+  );
+  if (stored.file.stations.length === before)
+    throw new AgentAdminError('no such account on this agent', 404);
+  save(stored);
+  return Promise.resolve({ agentId, station, accountId });
+}