@stage-labs/metro 0.1.0-beta.32 → 0.1.0-beta.320

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-tools.ts

@@ -1,100 +0,0 @@
-export const TOOL_KINDS = ['read', 'write'] as const;
-
-export type ToolKind = (typeof TOOL_KINDS)[number];
-
-export interface ToolInfo {
-  name: string;
-  title: string;
-  description: string;
-  kind: ToolKind;
-  annotated: boolean;
-  destructive: boolean;
-  idempotent: boolean;
-  openWorld: boolean;
-}
-
-const MAX_TOOLS = 500;
-const MAX_DESCRIPTION = 400;
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-const str = (value: unknown, cap: number): string =>
-  typeof value === 'string' ? value.slice(0, cap) : '';
-
-const flag = (value: unknown, fallback: boolean): boolean =>
-  typeof value === 'boolean' ? value : fallback;
-
-export function classifyTool(annotations: unknown): ToolKind {
-  return isRecord(annotations) && annotations.readOnlyHint === true
-    ? 'read'
-    : 'write';
-}
-
-export function isDestructive(annotations: unknown): boolean {
-  if (!isRecord(annotations)) return true;
-  if (annotations.readOnlyHint === true) return false;
-  return annotations.destructiveHint !== false;
-}
-
-export function toToolInfo(raw: unknown): ToolInfo | null {
-  if (!isRecord(raw)) return null;
-  const name = str(raw.name, 200);
-  if (name === '') return null;
-  const annotations = isRecord(raw.annotations) ? raw.annotations : undefined;
-  return {
-    name,
-    title: str(annotations?.title ?? raw.title, 200),
-    description: str(raw.description, MAX_DESCRIPTION),
-    kind: classifyTool(raw.annotations),
-    annotated: annotations !== undefined,
-    destructive: isDestructive(raw.annotations),
-    idempotent: flag(annotations?.idempotentHint, false),
-    openWorld: flag(annotations?.openWorldHint, true),
-  };
-}
-
-export function toToolList(raw: unknown): ToolInfo[] {
-  if (!Array.isArray(raw)) return [];
-  const out: ToolInfo[] = [];
-  for (const entry of raw) {
-    if (out.length >= MAX_TOOLS) break;
-    const tool = toToolInfo(entry);
-    if (tool !== null) out.push(tool);
-  }
-  return out;
-}
-
-export function toStoredTool(raw: unknown): ToolInfo | null {
-  if (!isRecord(raw)) return null;
-  const name = str(raw.name, 200);
-  if (name === '') return null;
-  return {
-    name,
-    title: str(raw.title, 200),
-    description: str(raw.description, MAX_DESCRIPTION),
-    kind: raw.kind === 'read' ? 'read' : 'write',
-    annotated: raw.annotated === true,
-    destructive: raw.destructive !== false,
-    idempotent: raw.idempotent === true,
-    openWorld: raw.openWorld !== false,
-  };
-}
-
-export function readStoredTools(raw: unknown): ToolInfo[] {
-  if (!Array.isArray(raw)) return [];
-  const out: ToolInfo[] = [];
-  for (const entry of raw) {
-    if (out.length >= MAX_TOOLS) break;
-    const tool = toStoredTool(entry);
-    if (tool !== null) out.push(tool);
-  }
-  return out;
-}
-
-export function countByKind(tools: ToolInfo[]): Record<ToolKind, number> {
-  const counts: Record<ToolKind, number> = { read: 0, write: 0 };
-  for (const tool of tools) counts[tool.kind] += 1;
-  return counts;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-verify.ts

@@ -1,333 +0,0 @@
-import { errMsg, log } from './log.js';
-import {
-  ConnectorNotMcp,
-  ConnectorUnauthorized,
-  refused,
-  safeIconSrc,
-} from './connector-url.js';
-import { toToolList, type ToolInfo } from './connector-tools.js';
-
-export {
-  ConnectorUnauthorized,
-  ConnectorVerifyError,
-  connectorUrlText,
-  parseConnectorUrl,
-} from './connector-url.js';
-
-export interface OAuthTokens {
-  accessToken: string;
-  refreshToken?: string;
-  expiresAt?: number;
-}
-
-export interface OAuthAuth extends OAuthTokens {
-  kind: 'oauth';
-  issuer: string;
-  tokenEndpoint: string;
-  clientId: string;
-  clientSecret?: string;
-}
-
-export type ConnectorAuth =
-  | { kind: 'none' }
-  | { kind: 'header'; name: string; value: string }
-  | OAuthAuth;
-
-export interface VerifiedServer {
-  server: string;
-  version: string;
-  protocol: string;
-  icon: string;
-  tools: number;
-  catalog: ToolInfo[];
-}
-
-export interface VerifiedRecord extends VerifiedServer {
-  at: string;
-}
-
-const PROTOCOL_VERSIONS = ['2025-11-25', '2025-06-18'] as const;
-const MAX_TOOL_PAGES = 10;
-
-function notMcp(url: URL): ConnectorNotMcp {
-  return new ConnectorNotMcp(
-    `${url.hostname} answered, but it does not speak MCP.`,
-    400,
-  );
-}
-const PROBE_TIMEOUT_MS = 10_000;
-const ACCEPT = 'application/json, text/event-stream';
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-async function discard(res: Response): Promise<void> {
-  await res.body?.cancel().catch((err: unknown) => {
-    log.debug(
-      { err: errMsg(err) },
-      'connector-verify: could not discard a response body',
-    );
-  });
-}
-
-function authHeaders(auth: ConnectorAuth): Record<string, string> {
-  if (auth.kind === 'header') return { [auth.name]: auth.value };
-  if (auth.kind === 'oauth')
-    return { authorization: `Bearer ${auth.accessToken}` };
-  return {};
-}
-
-async function frame(
-  url: URL,
-  auth: ConnectorAuth,
-  extra: Record<string, string>,
-  body: unknown,
-  signal: AbortSignal,
-): Promise<Response> {
-  let res: Response;
-  try {
-    res = await fetch(url, {
-      method: 'POST',
-      redirect: 'manual',
-      signal,
-      headers: {
-        'content-type': 'application/json',
-        accept: ACCEPT,
-        ...authHeaders(auth),
-        ...extra,
-      },
-      body: JSON.stringify(body),
-    });
-  } catch {
-    throw refused(`Metro could not reach ${url.hostname}.`);
-  }
-  if (res.status >= 300 && res.status < 400) {
-    await discard(res);
-    throw refused('that url redirects — use the url it redirects to');
-  }
-  return res;
-}
-
-function sseData(body: string): string {
-  for (const line of body.replace(/\r\n/g, '\n').split('\n'))
-    if (line.startsWith('data:')) return line.slice(5).trim();
-  return '';
-}
-
-async function payloadOf(res: Response): Promise<string> {
-  const contentType = res.headers.get('content-type') ?? '';
-  const text = await res.text().catch(() => '');
-  return contentType.includes('text/event-stream') ? sseData(text) : text;
-}
-
-async function resultOrNull(
-  res: Response,
-): Promise<Record<string, unknown> | null> {
-  const payload = await payloadOf(res);
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(payload);
-  } catch {
-    return null;
-  }
-  if (!isRecord(parsed) || !isRecord(parsed.result)) return null;
-  return parsed.result;
-}
-
-function initializeBody(version: string): unknown {
-  return {
-    jsonrpc: '2.0',
-    id: 1,
-    method: 'initialize',
-    params: {
-      protocolVersion: version,
-      capabilities: {},
-      clientInfo: { name: 'metro', version: '0.1.0' },
-    },
-  };
-}
-
-function iconOf(info: Record<string, unknown>): string {
-  const icons = info.icons;
-  if (!Array.isArray(icons)) return '';
-  for (const entry of icons) {
-    if (!isRecord(entry)) continue;
-    const src = safeIconSrc(entry.src);
-    if (src !== '') return src;
-  }
-  return '';
-}
-
-function serverFrom(url: URL, result: Record<string, unknown>): VerifiedServer {
-  const protocol = result.protocolVersion;
-  if (typeof protocol !== 'string') throw notMcp(url);
-  const info = isRecord(result.serverInfo) ? result.serverInfo : {};
-  const title = typeof info.title === 'string' ? info.title : '';
-  return {
-    server:
-      title !== ''
-        ? title
-        : typeof info.name === 'string'
-          ? info.name
-          : url.hostname,
-    version: typeof info.version === 'string' ? info.version : '',
-    protocol,
-    icon: iconOf(info),
-    tools: 0,
-    catalog: [],
-  };
-}
-
-async function initialize(
-  url: URL,
-  auth: ConnectorAuth,
-  signal: AbortSignal,
-  version: string,
-): Promise<{ session: string | null; server: VerifiedServer }> {
-  const res = await frame(url, auth, {}, initializeBody(version), signal);
-  if (res.status === 401 || res.status === 403) {
-    await discard(res);
-    throw new ConnectorUnauthorized(
-      auth.kind === 'none'
-        ? `${url.hostname} requires authorization.`
-        : `${url.hostname} rejected that credential.`,
-      400,
-    );
-  }
-  if (res.status === 404 || res.status === 405) {
-    await discard(res);
-    throw refused(
-      `${url.hostname} did not accept an MCP initialize over HTTP POST. ` +
-        'If it is a legacy SSE server, Metro cannot verify it yet.',
-    );
-  }
-  if (!res.ok) {
-    await discard(res);
-    throw notMcp(url);
-  }
-  const result = await resultOrNull(res);
-  if (result === null) throw notMcp(url);
-  return {
-    session: res.headers.get('mcp-session-id'),
-    server: serverFrom(url, result),
-  };
-}
-
-function sessionHeaders(
-  session: string | null,
-  version: string,
-): Record<string, string> {
-  const headers: Record<string, string> = {
-    'mcp-protocol-version': version,
-  };
-  if (session !== null && session !== '') headers['mcp-session-id'] = session;
-  return headers;
-}
-
-async function announce(
-  url: URL,
-  auth: ConnectorAuth,
-  headers: Record<string, string>,
-  signal: AbortSignal,
-): Promise<void> {
-  const res = await frame(
-    url,
-    auth,
-    headers,
-    { jsonrpc: '2.0', method: 'notifications/initialized' },
-    signal,
-  );
-  await discard(res);
-}
-
-async function toolPage(
-  url: URL,
-  auth: ConnectorAuth,
-  headers: Record<string, string>,
-  signal: AbortSignal,
-  cursor: string,
-): Promise<Record<string, unknown> | null> {
-  const params = cursor === '' ? {} : { cursor };
-  const res = await frame(
-    url,
-    auth,
-    headers,
-    { jsonrpc: '2.0', id: 2, method: 'tools/list', params },
-    signal,
-  );
-  if (!res.ok) {
-    await discard(res);
-    return null;
-  }
-  return resultOrNull(res);
-}
-
-async function listTools(
-  url: URL,
-  auth: ConnectorAuth,
-  headers: Record<string, string>,
-  signal: AbortSignal,
-): Promise<ToolInfo[]> {
-  const tools: ToolInfo[] = [];
-  let cursor = '';
-  for (let page = 0; page < MAX_TOOL_PAGES; page += 1) {
-    const result = await toolPage(url, auth, headers, signal, cursor);
-    if (result === null) break;
-    tools.push(...toToolList(result.tools));
-    const next = result.nextCursor;
-    if (typeof next !== 'string' || next === '' || next === cursor) break;
-    cursor = next;
-  }
-  return tools;
-}
-
-async function terminate(
-  url: URL,
-  auth: ConnectorAuth,
-  headers: Record<string, string>,
-  signal: AbortSignal,
-): Promise<void> {
-  const res = await fetch(url, {
-    method: 'DELETE',
-    redirect: 'manual',
-    signal,
-    headers: { ...authHeaders(auth), ...headers },
-  });
-  await discard(res);
-}
-
-async function probeWith(
-  url: URL,
-  auth: ConnectorAuth,
-  version: string,
-): Promise<VerifiedServer> {
-  const signal = AbortSignal.timeout(PROBE_TIMEOUT_MS);
-  const { session, server } = await initialize(url, auth, signal, version);
-  const headers = sessionHeaders(session, server.protocol);
-  await announce(url, auth, headers, signal);
-  const catalog = await listTools(url, auth, headers, signal);
-  await terminate(url, auth, headers, signal).catch((err: unknown) => {
-    log.debug(
-      { host: url.hostname, err: errMsg(err) },
-      'connector-verify: the remote declined to end the session',
-    );
-  });
-  return { ...server, tools: catalog.length, catalog };
-}
-
-export async function verifyRemoteMcp(
-  url: URL,
-  auth: ConnectorAuth,
-): Promise<VerifiedServer> {
-  let last: unknown;
-  for (const version of PROTOCOL_VERSIONS) {
-    try {
-      return await probeWith(url, auth, version);
-    } catch (err) {
-      if (!(err instanceof ConnectorNotMcp)) throw err;
-      last = err;
-    }
-  }
-  throw last;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/identity.ts

@@ -1,86 +0,0 @@
-import { execFileSync } from 'node:child_process';
-import { errMsg, log } from './log.js';
-import { Line } from '../stations/lines.js';
-
-const TTL_MS = 5_000;
-type Cache = { id: string; at: number } | null;
-
-function memo(loader: () => string): () => string {
-  let cache: Cache = null;
-  return () => {
-    if (cache && Date.now() - cache.at < TTL_MS) return cache.id;
-    const id = loader();
-    cache = { id, at: Date.now() };
-    return id;
-  };
-}
-
-const claudeAccountId = memo(() => {
-  let raw: string;
-  try {
-    raw = execFileSync('claude', ['auth', 'status', '--json'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-  } catch (e) {
-    throw new Error(
-      `metro: failed to run 'claude auth status --json' — is Claude Code installed? (${errMsg(e)})`,
-    );
-  }
-  let p: { loggedIn?: boolean; orgId?: string };
-  try {
-    p = JSON.parse(raw) as { loggedIn?: boolean; orgId?: string };
-  } catch {
-    throw new Error(
-      `metro: 'claude auth status --json' returned non-JSON: ${raw.slice(0, 200)}`,
-    );
-  }
-  if (!p.loggedIn || !p.orgId)
-    throw new Error(
-      "metro: Claude Code is not logged in — run 'claude auth login'",
-    );
-  return p.orgId;
-});
-
-export const claudeUserId = (): string =>
-  process.env.METRO_USER_ID ?? claudeAccountId();
-
-export const claudeSessionId = (): string | null =>
-  process.env.METRO_USER_SESSION_ID ??
-  process.env.CLAUDE_CODE_SESSION_ID ??
-  null;
-
-export function userSelf(): Line {
-  const explicit = process.env.METRO_FROM;
-  if (explicit) return explicit as Line;
-  if (!process.env.CLAUDECODE) return 'metro://user' as Line;
-  try {
-    return Line.user('claude', claudeUserId());
-  } catch (e) {
-    log.warn(
-      { reason: errMsg(e) },
-      'could not resolve a Claude account id; relaying as metro://user',
-    );
-    return 'metro://user' as Line;
-  }
-}
-
-export function daemonSelf(): Line {
-  const explicit = process.env.METRO_FROM ?? process.env.METRO_SELF_URI;
-  return (explicit ?? 'metro://user') as Line;
-}
-
-export function selfLine(): Line | null {
-  if (!process.env.CLAUDECODE) return null;
-  const s = claudeSessionId();
-  if (!s) return null;
-  try {
-    return Line.claude(claudeUserId(), s);
-  } catch (e) {
-    log.warn(
-      { reason: errMsg(e) },
-      'could not resolve a Claude account id; relaying with no self line',
-    );
-    return null;
-  }
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-mode.ts

@@ -1,158 +0,0 @@
-import { hostname } from 'node:os';
-import { ApiError } from './api-error.js';
-import { errMsg, log } from './log.js';
-import { AttachSessions } from './attach-session.js';
-import type { AgentApiDeps } from './agent-api.js';
-import { ATTACHABLE, type AccountApiDeps } from './account-api.js';
-import type { AgentConnectorApiDeps } from './agent-connector-api.js';
-import type { ProjectApiDeps } from './project-api.js';
-import type { SessionApis } from './session-apis.js';
-import type { ModeInfo } from './mode-api.js';
-import {
-  claimLocalOwner,
-  LOCAL_PROJECT_ID,
-  localAttachAccount,
-  localCreateAgent,
-  localDeleteAgent,
-  localDetachAccount,
-  localListAgents,
-  localOwnedAgentOrThrow,
-  localOwner,
-  localResetAgentKey,
-} from '../db/file-admin.js';
-import { normalizeAddress } from '../db/users.js';
-import type { Project } from '../db/projects.js';
-import type { StationName } from '../db/schema.js';
-
-export interface LocalModeDeps {
-  syncStations: (station: StationName) => Promise<void>;
-  closeAgentSession: (id: string) => Promise<boolean>;
-  gatherAccounts: AgentApiDeps['gatherAccounts'];
-  capabilities: AgentApiDeps['capabilities'];
-  liveness: AgentApiDeps['liveness'];
-  prepareAccount: AccountApiDeps['prepareAccount'];
-}
-
-const notHere = (what: string): Promise<never> =>
-  Promise.reject(
-    new ApiError(`${what} are managed on metro.box, not on a local daemon`, 400),
-  );
-
-function localProject(): Project {
-  return {
-    id: LOCAL_PROJECT_ID,
-    name: hostname(),
-    isDefault: true,
-    owner: true,
-    role: 'admin',
-  };
-}
-
-function attachSessions(deps: LocalModeDeps): AttachSessions {
-  return new AttachSessions({
-    authorize: async (owner) => {
-      await localOwnedAgentOrThrow(owner.subject, owner.agentId);
-    },
-    complete: async (owner, station, config) => {
-      const ref = await localAttachAccount(owner.subject, owner.agentId, station, config);
-      const activated = await deps.syncStations(station).then(
-        () => true,
-        (err: unknown) => {
-          log.warn(
-            { station, err: errMsg(err) },
-            'attach-session: station reload failed, the change lands at the next boot',
-          );
-          return false;
-        },
-      );
-      return { accountId: ref.accountId, activated };
-    },
-  });
-}
-
-function agentApi(deps: LocalModeDeps): AgentApiDeps {
-  return {
-    attachSessions: attachSessions(deps),
-    listAgents: localListAgents,
-    createAgent: localCreateAgent,
-    deleteAgent: localDeleteAgent,
-    resetKey: async (subject, id) => {
-      const reset = await localResetAgentKey(subject, id);
-      const closed = await deps.closeAgentSession(id);
-      log.info({ agent: reset.name, id, sessionClosed: closed }, 'local: key rotated');
-      return reset;
-    },
-    gatherAccounts: deps.gatherAccounts,
-    capabilities: deps.capabilities,
-    attachable: ATTACHABLE.filter((s) => s !== 'webhook'),
-    liveness: deps.liveness,
-    releaseRuntime: () => notHere('runtime leases'),
-    runtimes: () => Promise.resolve(new Map()),
-    connectorIds: () => Promise.resolve(new Map()),
-    prepareAccount: deps.prepareAccount,
-    attachAccount: localAttachAccount,
-    detachAccount: localDetachAccount,
-    syncStations: deps.syncStations,
-  };
-}
-
-const projectApi: ProjectApiDeps = {
-  listProjects: (subject) => {
-    const owner = localOwner();
-    const mine = owner !== null && owner === normalizeAddress(subject);
-    return Promise.resolve(mine ? [localProject()] : []);
-  },
-  createProject: () => notHere('projects'),
-  renameProject: () => notHere('projects'),
-  deleteProject: () => notHere('projects'),
-  listMembers: (subject, id) => {
-    const owner = localOwner();
-    if (id !== LOCAL_PROJECT_ID || owner === null || owner !== normalizeAddress(subject))
-      return Promise.reject(new ApiError('no such project', 404));
-    return Promise.resolve([
-      { id: 'owner', address: owner, email: null, role: 'admin', owner: true },
-    ]);
-  },
-  addMember: () => notHere('members'),
-  setMemberRole: () => notHere('members'),
-  removeMember: () => notHere('members'),
-};
-
-const agentConnectorApi: AgentConnectorApiDeps = {
-  agentConnectors: async (subject, id) => {
-    const { agent } = await localOwnedAgentOrThrow(subject, id);
-    return { ...agent, connectorIds: [] };
-  },
-  addConnector: () => notHere('connectors'),
-  removeConnector: () => notHere('connectors'),
-  mintCode: () =>
-    Promise.reject(new ApiError('a local daemon has no pairing codes', 400)),
-};
-
-export function localConnectHint(port: number): string {
-  const ui = process.env.METRO_UI_URL ?? 'https://metro.box';
-  const here = `http://127.0.0.1:${String(port)}`;
-  const forward = `ssh -L ${String(port)}:127.0.0.1:${String(port)} ${hostname()}`;
-  return [
-    'Manage this machine from the web UI:',
-    '',
-    `  ${ui}/#/connect/${encodeURIComponent(here)}`,
-    '',
-    `From another computer, forward the port first:  ${forward}`,
-    '',
-  ].join('\n');
-}
-
-export function localModeInfo(): ModeInfo {
-  return { mode: 'local', owner: localOwner(), project: LOCAL_PROJECT_ID };
-}
-
-export function localSessionApis(deps: LocalModeDeps): SessionApis {
-  return {
-    agentApi: agentApi(deps),
-    agentConnectorApi,
-    projectApi,
-    siwe: { ensureUser: claimLocalOwner },
-    mode: localModeInfo,
-  };
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-secret.ts

@@ -1,21 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { agentsDir } from '../db/file-source.js';
-import { ensureSecureDir, writeSecure } from './secure-fs.js';
-
-const SECRET_FILE = '.session-secret';
-
-export function ensureLocalSessionSecret(dir = agentsDir()): string {
-  const configured = process.env.METRO_SESSION_SECRET?.trim() ?? '';
-  if (configured !== '') return configured;
-  const path = join(dir, SECRET_FILE);
-  let secret = existsSync(path) ? readFileSync(path, 'utf8').trim() : '';
-  if (secret === '') {
-    secret = randomBytes(32).toString('base64url');
-    ensureSecureDir(dir);
-    writeSecure(path, `${secret}\n`);
-  }
-  process.env.METRO_SESSION_SECRET = secret;
-  return secret;
-}