@stage-labs/metro 0.1.0-beta.31 → 0.1.0-beta.310

package/runtime/node_modules/@metro-labs/mcp/src/daemon/project-api.ts

@@ -1,214 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
-import {
-  apiFailure,
-  apiSession,
-  bodyField,
-  cors,
-  readJsonBody,
-  sendJson,
-  type ApiSession,
-} from './api-http.js';
-import { parseId } from '../db/ids.js';
-import type { Member, Project } from '../db/projects.js';
-
-const PREFIX = '/api/projects';
-
-export interface ProjectApiDeps {
-  listProjects: (email: string) => Promise<Project[]>;
-  createProject: (email: string, name: unknown) => Promise<Project>;
-  renameProject: (
-    email: string,
-    id: string,
-    name: unknown,
-  ) => Promise<Project>;
-  deleteProject: (
-    email: string,
-    id: string,
-  ) => Promise<{ id: string; name: string }>;
-  listMembers: (email: string, id: string) => Promise<Member[]>;
-  addMember: (
-    email: string,
-    id: string,
-    invited: unknown,
-    role: unknown,
-  ) => Promise<Member[]>;
-  setMemberRole: (
-    email: string,
-    id: string,
-    memberId: string,
-    role: unknown,
-  ) => Promise<Member[]>;
-  removeMember: (
-    email: string,
-    id: string,
-    memberId: string,
-  ) => Promise<Member[]>;
-}
-
-type Routable =
-  | { kind: 'index' }
-  | { kind: 'project'; id: string }
-  | { kind: 'rename'; id: string }
-  | { kind: 'members'; id: string }
-  | { kind: 'member'; id: string; memberId: string };
-
-type Target = Routable | { kind: 'unknown' } | null;
-
-const ALLOWED: Record<Routable['kind'], string[]> = {
-  index: ['GET', 'POST'],
-  project: ['DELETE'],
-  rename: ['POST'],
-  members: ['GET', 'POST'],
-  member: ['POST', 'DELETE'],
-};
-
-function memberTarget(id: string, rest: string[]): Target {
-  if (rest.length === 1) return { kind: 'members', id };
-  if (rest.length > 2) return { kind: 'unknown' };
-  const memberId = parseId(rest[1] ?? '');
-  return memberId === null
-    ? { kind: 'unknown' }
-    : { kind: 'member', id, memberId };
-}
-
-function subTarget(id: string, rest: string[]): Target {
-  if (rest.length === 0) return { kind: 'project', id };
-  const head = rest[0];
-  if (head === 'members') return memberTarget(id, rest);
-  if (rest.length > 1) return { kind: 'unknown' };
-  if (head === 'rename') return { kind: 'rename', id };
-  return { kind: 'unknown' };
-}
-
-function target(path: string): Target {
-  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'index' };
-  if (!path.startsWith(`${PREFIX}/`)) return null;
-  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
-  const head = segments[0];
-  if (head === undefined) return { kind: 'index' };
-  const id = parseId(head);
-  return id === null ? { kind: 'unknown' } : subTarget(id, segments.slice(1));
-}
-
-async function handleIndex(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ProjectApiDeps,
-  session: ApiSession,
-): Promise<void> {
-  if (req.method === 'GET') {
-    sendJson(req, res, 200, { projects: await deps.listProjects(session.email) });
-    return;
-  }
-  const made = await deps.createProject(
-    session.email,
-    bodyField(await readJsonBody(req), 'name'),
-  );
-  log.info({ id: made.id, name: made.name }, 'project-api: created project');
-  sendJson(req, res, 201, made);
-}
-
-async function handleMembers(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ProjectApiDeps,
-  session: ApiSession,
-  id: string,
-): Promise<void> {
-  if (req.method === 'GET') {
-    sendJson(req, res, 200, { members: await deps.listMembers(session.email, id) });
-    return;
-  }
-  const body = await readJsonBody(req);
-  const members = await deps.addMember(
-    session.email,
-    id,
-    bodyField(body, 'email'),
-    bodyField(body, 'role'),
-  );
-  sendJson(req, res, 200, { members });
-}
-
-async function handleMember(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ProjectApiDeps,
-  session: ApiSession,
-  tgt: { id: string; memberId: string },
-): Promise<void> {
-  if (req.method === 'DELETE') {
-    const members = await deps.removeMember(session.email, tgt.id, tgt.memberId);
-    sendJson(req, res, 200, { members });
-    return;
-  }
-  const members = await deps.setMemberRole(
-    session.email,
-    tgt.id,
-    tgt.memberId,
-    bodyField(await readJsonBody(req), 'role'),
-  );
-  sendJson(req, res, 200, { members });
-}
-
-async function route(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ProjectApiDeps,
-  session: ApiSession,
-  tgt: Routable,
-): Promise<void> {
-  try {
-    if (tgt.kind === 'index') await handleIndex(req, res, deps, session);
-    else if (tgt.kind === 'members')
-      await handleMembers(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'member')
-      await handleMember(req, res, deps, session, tgt);
-    else if (tgt.kind === 'rename')
-      sendJson(
-        req,
-        res,
-        200,
-        await deps.renameProject(
-          session.email,
-          tgt.id,
-          bodyField(await readJsonBody(req), 'name'),
-        ),
-      );
-    else sendJson(req, res, 200, await deps.deleteProject(session.email, tgt.id));
-  } catch (err) {
-    apiFailure(req, res, err, 'project-api');
-  }
-}
-
-export function handleProjectApiRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ProjectApiDeps,
-): boolean {
-  const tgt = target((req.url ?? '').split('?')[0] ?? '');
-  if (tgt === null) return false;
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (tgt.kind === 'unknown') {
-    sendJson(req, res, 404, { error: 'no such project' });
-    return true;
-  }
-  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
-  route(req, res, deps, session, tgt).catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'project-api: unhandled error');
-    if (!res.headersSent)
-      sendJson(req, res, 500, { error: 'project api failed' });
-  });
-  return true;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/relay.ts

@@ -1,303 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { RelayTarget } from '../db/connector-relay.js';
-import { agentIdentity, assertLease, type Fence } from './api-http.js';
-import { ApiError } from './api-error.js';
-import { errMsg, log } from './log.js';
-
-export interface RelayApiDeps {
-  target: (
-    agentId: string,
-    connectorId: string,
-    force: boolean,
-  ) => Promise<RelayTarget>;
-  fence: Fence;
-}
-
-const ID_PATH_RE = /^\/relay\/([A-Za-z0-9][A-Za-z0-9_-]{10})$/;
-const METHODS = new Set(['POST', 'GET', 'DELETE']);
-const RELAY_BODY_MAX = 8 * 1024 * 1024;
-const FIRST_BYTE_MS = 120_000;
-const PASS_REQ = [
-  'accept',
-  'content-type',
-  'mcp-session-id',
-  'mcp-protocol-version',
-  'last-event-id',
-] as const;
-const PASS_RES = [
-  'content-type',
-  'mcp-session-id',
-  'mcp-protocol-version',
-  'cache-control',
-] as const;
-
-const keepaliveMs = (): number =>
-  Number(process.env.METRO_RELAY_KEEPALIVE_MS) || 25_000;
-
-const reconnectUrl = (id: string): string =>
-  `https://metro.box/#/connector/${id}`;
-
-function answer(
-  res: ServerResponse,
-  status: number,
-  body: Record<string, unknown>,
-): void {
-  if (res.headersSent) return;
-  res.writeHead(status, { 'content-type': 'application/json' });
-  res.end(JSON.stringify(body));
-}
-
-const signinAnswer = (res: ServerResponse, id: string): void => {
-  answer(res, 424, {
-    error: 'this connector needs signing in again',
-    reconnect: reconnectUrl(id),
-  });
-};
-
-function closeIfBodyUnread(req: IncomingMessage, res: ServerResponse): void {
-  if (req.readableEnded) return;
-  const drop = (): void => {
-    req.socket?.destroy();
-  };
-  if (res.writableFinished) drop();
-  else res.once('finish', drop);
-}
-
-async function readCapped(req: IncomingMessage): Promise<Uint8Array<ArrayBuffer>> {
-  const declared = Number(req.headers['content-length']);
-  if (Number.isFinite(declared) && declared > RELAY_BODY_MAX)
-    throw new ApiError('relay body exceeds 8 MiB', 413);
-  const chunks: Buffer[] = [];
-  let total = 0;
-  for await (const chunk of req) {
-    const buf = chunk as Buffer;
-    total += buf.length;
-    if (total > RELAY_BODY_MAX)
-      throw new ApiError('relay body exceeds 8 MiB', 413);
-    chunks.push(buf);
-  }
-  const merged = Buffer.concat(chunks);
-  const out = new Uint8Array(new ArrayBuffer(merged.byteLength));
-  out.set(merged);
-  return out;
-}
-
-function upstreamHeaders(
-  req: IncomingMessage,
-  injected: Record<string, string>,
-): Record<string, string> {
-  const out: Record<string, string> = {};
-  for (const name of PASS_REQ) {
-    const value = req.headers[name];
-    if (typeof value === 'string') out[name] = value;
-  }
-  return { ...out, ...injected };
-}
-
-async function forward(
-  req: IncomingMessage,
-  target: { url: string; headers: Record<string, string> },
-  body: Uint8Array<ArrayBuffer> | null,
-  signal: AbortSignal,
-): Promise<Response> {
-  const firstByte = setTimeout(() => {
-    log.warn({ url: target.url }, 'relay: upstream sent no response in time');
-  }, FIRST_BYTE_MS);
-  firstByte.unref?.();
-  try {
-    return await fetch(target.url, {
-      method: req.method,
-      headers: upstreamHeaders(req, target.headers),
-      ...(body === null ? {} : { body }),
-      signal,
-      redirect: 'manual',
-    });
-  } finally {
-    clearTimeout(firstByte);
-  }
-}
-
-interface Keepalive {
-  touch: () => void;
-  stop: () => void;
-}
-
-function startKeepalive(res: ServerResponse): Keepalive {
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const arm = (): void => {
-    timer = setTimeout(() => {
-      try {
-        res.write(': keepalive\n\n');
-      } catch {
-        log.debug('relay: keepalive write failed');
-      }
-      arm();
-    }, keepaliveMs());
-    timer.unref?.();
-  };
-  arm();
-  return {
-    touch: (): void => {
-      if (timer) clearTimeout(timer);
-      arm();
-    },
-    stop: (): void => {
-      if (timer) clearTimeout(timer);
-    },
-  };
-}
-
-async function pumpBody(
-  res: ServerResponse,
-  body: ReadableStream<Uint8Array>,
-  touch: () => void,
-): Promise<void> {
-  const reader = body.getReader();
-  for (;;) {
-    const { done, value } = await reader.read();
-    if (done) return;
-    touch();
-    const ok = res.write(value);
-    if (!ok)
-      await new Promise((resolve) => {
-        res.once('drain', resolve);
-      });
-  }
-}
-
-async function pipe(res: ServerResponse, upstream: Response): Promise<void> {
-  const headers: Record<string, string> = {};
-  for (const name of PASS_RES) {
-    const value = upstream.headers.get(name);
-    if (value !== null) headers[name] = value;
-  }
-  const sse = (headers['content-type'] ?? '').includes('text/event-stream');
-  if (sse) headers['x-accel-buffering'] = 'no';
-  res.writeHead(upstream.status, headers);
-  if (upstream.body === null) {
-    res.end();
-    return;
-  }
-  const keepalive = sse ? startKeepalive(res) : null;
-  try {
-    await pumpBody(res, upstream.body, () => keepalive?.touch());
-  } finally {
-    keepalive?.stop();
-  }
-  res.end();
-}
-
-const authFailed = (status: number): boolean =>
-  status === 401 || status === 403;
-
-type Exchanged =
-  | { kind: 'response'; upstream: Response }
-  | { kind: 'missing' }
-  | { kind: 'signin' };
-
-async function exchange(
-  req: IncomingMessage,
-  agentId: string,
-  connectorId: string,
-  deps: RelayApiDeps,
-  body: Uint8Array<ArrayBuffer> | null,
-  signal: AbortSignal,
-): Promise<Exchanged> {
-  const target = await deps.target(agentId, connectorId, false);
-  if (target.kind !== 'ok') return { kind: target.kind };
-  let upstream = await forward(req, target, body, signal);
-  if (!authFailed(upstream.status)) return { kind: 'response', upstream };
-  await upstream.body?.cancel();
-  const fresh = await deps.target(agentId, connectorId, true);
-  if (fresh.kind !== 'ok') return { kind: 'signin' };
-  upstream = await forward(req, fresh, body, signal);
-  if (!authFailed(upstream.status)) return { kind: 'response', upstream };
-  await upstream.body?.cancel();
-  return { kind: 'signin' };
-}
-
-async function relayExchange(
-  req: IncomingMessage,
-  res: ServerResponse,
-  agentId: string,
-  connectorId: string,
-  deps: RelayApiDeps,
-): Promise<void> {
-  const control = new AbortController();
-  const bail = (): void => {
-    if (!res.writableEnded) control.abort();
-  };
-  res.once('close', bail);
-  res.socket?.once('close', bail);
-  res.once('finish', () => {
-    res.socket?.removeListener('close', bail);
-  });
-  const body = req.method === 'POST' ? await readCapped(req) : null;
-  const out = await exchange(
-    req,
-    agentId,
-    connectorId,
-    deps,
-    body,
-    control.signal,
-  );
-  if (out.kind === 'missing') {
-    answer(res, 404, { error: 'no such connector' });
-    return;
-  }
-  if (out.kind === 'signin') {
-    signinAnswer(res, connectorId);
-    return;
-  }
-  if (out.upstream.status >= 300 && out.upstream.status < 400) {
-    await out.upstream.body?.cancel();
-    answer(res, 502, { error: 'the connector redirected; metro does not follow' });
-    return;
-  }
-  await pipe(res, out.upstream);
-}
-
-function dispatch(
-  req: IncomingMessage,
-  res: ServerResponse,
-  connectorId: string,
-  deps: RelayApiDeps,
-): void {
-  const who = agentIdentity(req);
-  if (who === null) {
-    answer(res, 401, { error: 'unauthorized' });
-    return;
-  }
-  assertLease(who, deps.fence)
-    .then(() => relayExchange(req, res, who.agentId, connectorId, deps))
-    .catch((err: unknown) => {
-      if (err instanceof ApiError) {
-        answer(res, err.status, { error: err.message });
-      } else {
-        log.warn({ err: errMsg(err), connector: connectorId }, 'relay: failed');
-        answer(res, 502, { error: 'metro could not reach the connector' });
-        if (!res.writableEnded) res.end();
-      }
-      closeIfBodyUnread(req, res);
-    });
-}
-
-export function handleRelayRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: RelayApiDeps,
-): boolean {
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  if (path !== '/relay' && !path.startsWith('/relay/')) return false;
-  const match = ID_PATH_RE.exec(path);
-  if (match?.[1] === undefined) {
-    answer(res, 404, { error: 'no such connector' });
-    return true;
-  }
-  if (!METHODS.has(req.method ?? '')) {
-    answer(res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  dispatch(req, res, match[1], deps);
-  return true;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/run-api.ts

@@ -1,139 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { log } from './log.js';
-import {
-  apiFailure,
-  bodyField,
-  cors,
-  readJsonBody,
-  runIdentity,
-  sendJson,
-} from './api-http.js';
-import { AGENT_CODE_RE, takeAgentCode } from './agent-pair.js';
-import { sessionTtlFromEnv } from './google-oauth.js';
-import { signRunToken } from './session.js';
-import type { LoadedAgent } from '../db/materialize.js';
-import type { RuntimeLease } from '../db/runtimes.js';
-
-const CLAIM_PATH = '/api/run/claim';
-const CONFIG_PATH = '/api/run/config';
-
-const ALLOWED: Record<string, string> = {
-  [CLAIM_PATH]: 'POST',
-  [CONFIG_PATH]: 'GET',
-};
-
-export interface RunApiDeps {
-  claimRuntime: (agentId: string, label: string) => Promise<RuntimeLease>;
-  fenceRuntime: (runtimeId: string, agentId: string) => Promise<void>;
-  touchRuntime: (runtimeId: string) => Promise<void>;
-  loadAgent: (agentId: string) => Promise<LoadedAgent>;
-  blockedStations: (agentId: string) => Promise<string[]>;
-}
-
-function secretOrNull(): string | null {
-  const secret = process.env.METRO_SESSION_SECRET?.trim() ?? '';
-  return secret === '' ? null : secret;
-}
-
-function labelOf(body: unknown): string {
-  const raw = bodyField(body, 'label');
-  const label = typeof raw === 'string' ? raw.trim().slice(0, 64) : '';
-  return label === '' ? 'unnamed machine' : label;
-}
-
-async function handleClaim(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: RunApiDeps,
-): Promise<void> {
-  const secret = secretOrNull();
-  if (secret === null) {
-    sendJson(req, res, 503, { error: 'sign-in is not configured' });
-    return;
-  }
-  const body = await readJsonBody(req);
-  const raw = bodyField(body, 'code');
-  const code = typeof raw === 'string' ? raw.trim() : '';
-  if (!AGENT_CODE_RE.test(code)) {
-    sendJson(req, res, 400, {
-      error:
-        'that does not look like an agent code — metro start wants the ma_… code from the agent page',
-    });
-    return;
-  }
-  const taken = takeAgentCode(code);
-  if (taken === undefined) {
-    sendJson(req, res, 400, {
-      error: 'that code has expired or was already used',
-    });
-    return;
-  }
-  const blocked = await deps.blockedStations(taken.agentId);
-  if (blocked.length > 0) {
-    sendJson(req, res, 409, {
-      error:
-        `this agent holds ${blocked.join(', ')}, which only runs on metro because a webhook url has to be publicly reachable. Detach it, or move it to a second agent that stays on metro, then start this one.`,
-    });
-    return;
-  }
-  const lease = await deps.claimRuntime(taken.agentId, labelOf(body));
-  const token = signRunToken(
-    { email: taken.email, agentId: lease.agentId, runtimeId: lease.runtimeId },
-    secret,
-    { ttlSec: sessionTtlFromEnv() },
-  );
-  log.info(
-    { agent: lease.agentId, runtime: lease.runtimeId, label: lease.label },
-    'run: agent claimed by a local runtime',
-  );
-  sendJson(req, res, 200, {
-    token,
-    agent: lease.agentId,
-    label: lease.label,
-  });
-}
-
-async function handleConfig(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: RunApiDeps,
-): Promise<void> {
-  const who = runIdentity(req);
-  if (who === null) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return;
-  }
-  await deps.fenceRuntime(who.runtimeId, who.agentId);
-  await deps.touchRuntime(who.runtimeId);
-  sendJson(req, res, 200, { agent: await deps.loadAgent(who.agentId) });
-}
-
-export function handleRunApiRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: RunApiDeps,
-): boolean {
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  const method = ALLOWED[path];
-  if (method === undefined) {
-    if (!path.startsWith('/api/run/') && path !== '/api/run') return false;
-    sendJson(req, res, 404, { error: 'no such route' });
-    return true;
-  }
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (req.method !== method) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  const work =
-    path === CLAIM_PATH
-      ? handleClaim(req, res, deps)
-      : handleConfig(req, res, deps);
-  work.catch((err: unknown) => {
-    apiFailure(req, res, err, 'run-api');
-  });
-  return true;
-}