@stage-labs/metro 0.1.0-beta.32 → 0.1.0-beta.321

package/runtime/node_modules/@metro-labs/mcp/src/daemon/run-api.ts

@@ -1,139 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { log } from './log.js';
-import {
-  apiFailure,
-  bodyField,
-  cors,
-  readJsonBody,
-  runIdentity,
-  sendJson,
-} from './api-http.js';
-import { AGENT_CODE_RE, takeAgentCode } from './agent-pair.js';
-import { sessionTtlFromEnv } from './session-config.js';
-import { signRunToken } from './session.js';
-import type { LoadedAgent } from '../db/materialize.js';
-import type { RuntimeLease } from '../db/runtimes.js';
-
-const CLAIM_PATH = '/api/run/claim';
-const CONFIG_PATH = '/api/run/config';
-
-const ALLOWED: Record<string, string> = {
-  [CLAIM_PATH]: 'POST',
-  [CONFIG_PATH]: 'GET',
-};
-
-export interface RunApiDeps {
-  claimRuntime: (agentId: string, label: string) => Promise<RuntimeLease>;
-  fenceRuntime: (runtimeId: string, agentId: string) => Promise<void>;
-  touchRuntime: (runtimeId: string) => Promise<void>;
-  loadAgent: (agentId: string) => Promise<LoadedAgent>;
-  blockedStations: (agentId: string) => Promise<string[]>;
-}
-
-function secretOrNull(): string | null {
-  const secret = process.env.METRO_SESSION_SECRET?.trim() ?? '';
-  return secret === '' ? null : secret;
-}
-
-function labelOf(body: unknown): string {
-  const raw = bodyField(body, 'label');
-  const label = typeof raw === 'string' ? raw.trim().slice(0, 64) : '';
-  return label === '' ? 'unnamed machine' : label;
-}
-
-async function handleClaim(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: RunApiDeps,
-): Promise<void> {
-  const secret = secretOrNull();
-  if (secret === null) {
-    sendJson(req, res, 503, { error: 'sign-in is not configured' });
-    return;
-  }
-  const body = await readJsonBody(req);
-  const raw = bodyField(body, 'code');
-  const code = typeof raw === 'string' ? raw.trim() : '';
-  if (!AGENT_CODE_RE.test(code)) {
-    sendJson(req, res, 400, {
-      error:
-        'that does not look like an agent code — metro start wants the ma_… code from the agent page',
-    });
-    return;
-  }
-  const taken = takeAgentCode(code);
-  if (taken === undefined) {
-    sendJson(req, res, 400, {
-      error: 'that code has expired or was already used',
-    });
-    return;
-  }
-  const blocked = await deps.blockedStations(taken.agentId);
-  if (blocked.length > 0) {
-    sendJson(req, res, 409, {
-      error:
-        `this agent holds ${blocked.join(', ')}, which only runs on metro because a webhook url has to be publicly reachable. Detach it, or move it to a second agent that stays on metro, then start this one.`,
-    });
-    return;
-  }
-  const lease = await deps.claimRuntime(taken.agentId, labelOf(body));
-  const token = signRunToken(
-    { subject: taken.subject, agentId: lease.agentId, runtimeId: lease.runtimeId },
-    secret,
-    { ttlSec: sessionTtlFromEnv() },
-  );
-  log.info(
-    { agent: lease.agentId, runtime: lease.runtimeId, label: lease.label },
-    'run: agent claimed by a local runtime',
-  );
-  sendJson(req, res, 200, {
-    token,
-    agent: lease.agentId,
-    label: lease.label,
-  });
-}
-
-async function handleConfig(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: RunApiDeps,
-): Promise<void> {
-  const who = runIdentity(req);
-  if (who === null) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return;
-  }
-  await deps.fenceRuntime(who.runtimeId, who.agentId);
-  await deps.touchRuntime(who.runtimeId);
-  sendJson(req, res, 200, { agent: await deps.loadAgent(who.agentId) });
-}
-
-export function handleRunApiRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: RunApiDeps,
-): boolean {
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  const method = ALLOWED[path];
-  if (method === undefined) {
-    if (!path.startsWith('/api/run/') && path !== '/api/run') return false;
-    sendJson(req, res, 404, { error: 'no such route' });
-    return true;
-  }
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (req.method !== method) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  const work =
-    path === CLAIM_PATH
-      ? handleClaim(req, res, deps)
-      : handleConfig(req, res, deps);
-  work.catch((err: unknown) => {
-    apiFailure(req, res, err, 'run-api');
-  });
-  return true;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/runtime-source.ts

@@ -1,105 +0,0 @@
-import { errMsg, log } from './log.js';
-import type { LoadedAgent, StationSource } from '../db/materialize.js';
-
-const POLL_MS = 30_000;
-const BACKOFF_MS = 5 * 60_000;
-const FETCH_TIMEOUT_MS = 15_000;
-
-export class RuntimeRevoked extends Error {}
-
-const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);
-
-export function carriesSecretsSafely(base: string): boolean {
-  let url: URL;
-  try {
-    url = new URL(base);
-  } catch {
-    return false;
-  }
-  if (url.protocol === 'https:') return true;
-  return url.protocol === 'http:' && LOOPBACK.has(url.hostname);
-}
-
-export interface RuntimeConfig {
-  url: string;
-  token: string;
-}
-
-export function runtimeConfigFromEnv(): RuntimeConfig | null {
-  const token = process.env.METRO_RUN_TOKEN?.trim() ?? '';
-  if (token === '') return null;
-  const raw = (process.env.METRO_URL?.trim() ?? '').replace(/\/+$/, '');
-  const url = raw === '' ? 'https://mcp.metro.box' : raw;
-  if (!carriesSecretsSafely(url))
-    throw new Error(
-      `refusing to fetch station credentials from ${url} in the clear — ` +
-        'use https, or a loopback address',
-    );
-  return { url, token };
-}
-
-export function httpSource(cfg: RuntimeConfig): StationSource {
-  return async () => {
-    const res = await fetch(`${cfg.url}/api/run/config`, {
-      headers: { authorization: `Bearer ${cfg.token}` },
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      redirect: 'manual',
-    });
-    if (res.status === 401 || res.status === 403 || res.status === 409)
-      throw new RuntimeRevoked(
-        `metro no longer recognises this machine as the holder (${String(res.status)})`,
-      );
-    if (!res.ok)
-      throw new Error(`metro answered ${String(res.status)} for the run config`);
-    const body = (await res.json()) as { agent?: LoadedAgent };
-    if (!body.agent) throw new Error('metro returned no agent');
-    return [body.agent];
-  };
-}
-
-export interface PollerDeps {
-  sync: () => Promise<void>;
-  stopAll: () => Promise<void>;
-  everyMs?: number;
-  backoffMs?: number;
-}
-
-export function startRuntimePoller(deps: PollerDeps): () => void {
-  const everyMs = deps.everyMs ?? POLL_MS;
-  const backoffMs = deps.backoffMs ?? BACKOFF_MS;
-  let stopped = false;
-  let timer: ReturnType<typeof setTimeout> | null = null;
-
-  const arm = (ms: number): void => {
-    if (stopped) return;
-    timer = setTimeout(() => {
-      tick().catch((err: unknown) => {
-        log.error({ err: errMsg(err) }, 'runtime: poller failed');
-      });
-    }, ms);
-    timer.unref?.();
-  };
-
-  async function tick(): Promise<void> {
-    if (stopped) return;
-    try {
-      await deps.sync();
-      arm(everyMs);
-    } catch (err) {
-      if (err instanceof RuntimeRevoked) {
-        stopped = true;
-        log.error({ reason: err.message }, 'runtime: revoked — stopping stations');
-        await deps.stopAll();
-        return;
-      }
-      log.warn({ err: errMsg(err) }, 'runtime: could not reach metro; retrying');
-      arm(backoffMs);
-    }
-  }
-
-  arm(everyMs);
-  return () => {
-    stopped = true;
-    if (timer !== null) clearTimeout(timer);
-  };
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-apis.ts

@@ -1,52 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { handleSessionApiRequest } from './session-api.js';
-import { handleAgentApiRequest, type AgentApiDeps } from './agent-api.js';
-import {
-  handleConnectorApiRequest,
-  type ConnectorApiDeps,
-} from './connector-api.js';
-import { handleCliPairRequest } from './cli-pair-api.js';
-import { handleRunApiRequest, type RunApiDeps } from './run-api.js';
-import type { RelayApiDeps } from './relay.js';
-import {
-  handleProjectApiRequest,
-  type ProjectApiDeps,
-} from './project-api.js';
-import {
-  handleAgentConnectorRequest,
-  type AgentConnectorApiDeps,
-} from './agent-connector-api.js';
-import type { SiweRouteDeps } from './siwe-routes.js';
-import type { ModeInfo } from './mode-api.js';
-
-export interface SessionApis {
-  agentApi?: AgentApiDeps;
-  agentConnectorApi?: AgentConnectorApiDeps;
-  connectorApi?: ConnectorApiDeps;
-  projectApi?: ProjectApiDeps;
-  runApi?: RunApiDeps;
-  relayApi?: RelayApiDeps;
-  siwe?: SiweRouteDeps;
-  mode?: () => ModeInfo;
-}
-
-export function handleSessionApis(
-  req: IncomingMessage,
-  res: ServerResponse,
-  apis: SessionApis,
-): boolean {
-  const { agentApi, agentConnectorApi, connectorApi, projectApi, runApi } = apis;
-  const routes: (() => boolean)[] = [() => handleSessionApiRequest(req, res)];
-  if (runApi) routes.push(() => handleRunApiRequest(req, res, runApi));
-  if (projectApi)
-    routes.push(() => handleProjectApiRequest(req, res, projectApi));
-  if (connectorApi)
-    routes.push(
-      () => handleCliPairRequest(req, res, connectorApi),
-      () => handleConnectorApiRequest(req, res, connectorApi),
-    );
-  if (agentConnectorApi)
-    routes.push(() => handleAgentConnectorRequest(req, res, agentConnectorApi));
-  if (agentApi) routes.push(() => handleAgentApiRequest(req, res, agentApi));
-  return routes.some((run) => run());
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session.ts

@@ -1,218 +0,0 @@
-import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
-import { ID_RE } from '../db/ids.js';
-
-export class SessionError extends Error {}
-
-const b64url = (buf: Buffer): string =>
-  buf
-    .toString('base64')
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(/=+$/, '');
-
-const b64urlJson = (v: unknown): string =>
-  b64url(Buffer.from(JSON.stringify(v)));
-
-const decodeJson = (seg: string): unknown =>
-  JSON.parse(
-    Buffer.from(seg.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString(
-      'utf8',
-    ),
-  );
-
-const HEADER = b64urlJson({ alg: 'HS256', typ: 'JWT' });
-
-function sign(payload: Record<string, unknown>, secret: string): string {
-  if (secret === '') throw new SessionError('missing signing secret');
-  const body = b64urlJson(payload);
-  const data = `${HEADER}.${body}`;
-  const sig = b64url(createHmac('sha256', secret).update(data).digest());
-  return `${data}.${sig}`;
-}
-
-function verify(token: string, secret: string): Record<string, unknown> {
-  if (secret === '') throw new SessionError('missing signing secret');
-  const parts = token.split('.');
-  if (parts.length !== 3) throw new SessionError('malformed token');
-  const data = `${parts[0]}.${parts[1]}`;
-  const expected = b64url(createHmac('sha256', secret).update(data).digest());
-  const a = Buffer.from(parts[2] ?? '');
-  const b = Buffer.from(expected);
-  if (a.length !== b.length || !timingSafeEqual(a, b))
-    throw new SessionError('bad signature');
-  let payload: unknown;
-  try {
-    payload = decodeJson(parts[1] ?? '');
-  } catch {
-    throw new SessionError('malformed payload');
-  }
-  if (typeof payload !== 'object' || payload === null)
-    throw new SessionError('malformed payload');
-  return payload as Record<string, unknown>;
-}
-
-const nowSec = (now?: number): number => Math.floor((now ?? Date.now()) / 1000);
-
-export function newNonce(): string {
-  return b64url(randomBytes(16));
-}
-
-interface StateClaims {
-  return_to: string;
-  nonce: string;
-}
-
-export function signState(
-  claims: StateClaims,
-  secret: string,
-  opts: { ttlSec?: number; now?: number } = {},
-): string {
-  const iat = nowSec(opts.now);
-  return sign(
-    {
-      typ: 'state',
-      return_to: claims.return_to,
-      nonce: claims.nonce,
-      iat,
-      exp: iat + (opts.ttlSec ?? 600),
-    },
-    secret,
-  );
-}
-
-export function verifyState(
-  token: string,
-  secret: string,
-  now?: number,
-): StateClaims {
-  const p = verify(token, secret);
-  if (p.typ !== 'state') throw new SessionError('wrong token type');
-  if (typeof p.exp !== 'number' || p.exp < nowSec(now))
-    throw new SessionError('state expired');
-  if (typeof p.return_to !== 'string' || typeof p.nonce !== 'string')
-    throw new SessionError('malformed state');
-  return { return_to: p.return_to, nonce: p.nonce };
-}
-
-interface SessionClaims {
-  subject: string;
-  agentIds: string[];
-}
-
-export interface AgentClaims {
-  subject: string;
-  agentId: string;
-}
-
-export interface RunClaims {
-  subject: string;
-  agentId: string;
-  runtimeId: string;
-}
-
-export function signSession(
-  claims: SessionClaims,
-  secret: string,
-  opts: { ttlSec?: number; now?: number } = {},
-): string {
-  const iat = nowSec(opts.now);
-  return sign(
-    {
-      typ: 'session',
-      sub: claims.subject,
-      agent_ids: claims.agentIds,
-      iat,
-      exp: iat + (opts.ttlSec ?? 30 * 24 * 3600),
-    },
-    secret,
-  );
-}
-
-export function verifySession(
-  token: string,
-  secret: string,
-  now?: number,
-): SessionClaims {
-  const p = verify(token, secret);
-  if (p.typ !== 'session') throw new SessionError('wrong token type');
-  if (typeof p.exp !== 'number' || p.exp < nowSec(now))
-    throw new SessionError('session expired');
-  const ids = p.agent_ids;
-  if (
-    typeof p.sub !== 'string' ||
-    !Array.isArray(ids) ||
-    ids.some((a) => typeof a !== 'string' || !ID_RE.test(a))
-  )
-    throw new SessionError('malformed session');
-  return { subject: p.sub, agentIds: ids as string[] };
-}
-
-export function signAgentToken(
-  claims: AgentClaims,
-  secret: string,
-  opts: { ttlSec?: number; now?: number } = {},
-): string {
-  const iat = nowSec(opts.now);
-  return sign(
-    {
-      typ: 'agent',
-      sub: claims.subject,
-      agent: claims.agentId,
-      iat,
-      exp: iat + (opts.ttlSec ?? 30 * 24 * 3600),
-    },
-    secret,
-  );
-}
-
-export function verifyAgentToken(
-  token: string,
-  secret: string,
-  now?: number,
-): AgentClaims {
-  const p = verify(token, secret);
-  if (p.typ !== 'agent') throw new SessionError('wrong token type');
-  if (typeof p.exp !== 'number' || p.exp < nowSec(now))
-    throw new SessionError('agent token expired');
-  if (typeof p.sub !== 'string' || typeof p.agent !== 'string')
-    throw new SessionError('malformed agent token');
-  return { subject: p.sub, agentId: p.agent };
-}
-
-export function signRunToken(
-  claims: RunClaims,
-  secret: string,
-  opts: { ttlSec?: number; now?: number } = {},
-): string {
-  const iat = nowSec(opts.now);
-  return sign(
-    {
-      typ: 'run',
-      sub: claims.subject,
-      agent: claims.agentId,
-      rt: claims.runtimeId,
-      iat,
-      exp: iat + (opts.ttlSec ?? 365 * 24 * 3600),
-    },
-    secret,
-  );
-}
-
-export function verifyRunToken(
-  token: string,
-  secret: string,
-  now?: number,
-): RunClaims {
-  const p = verify(token, secret);
-  if (p.typ !== 'run') throw new SessionError('wrong token type');
-  if (typeof p.exp !== 'number' || p.exp < nowSec(now))
-    throw new SessionError('run token expired');
-  if (
-    typeof p.sub !== 'string' ||
-    typeof p.agent !== 'string' ||
-    typeof p.rt !== 'string' ||
-    !ID_RE.test(p.agent)
-  )
-    throw new SessionError('malformed run token');
-  return { subject: p.sub, agentId: p.agent, runtimeId: p.rt };
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-auth.ts

@@ -1,82 +0,0 @@
-import { verifyMessage, type Hex } from 'viem';
-import { parseSiweMessage, validateSiweMessage } from 'viem/siwe';
-import { ApiError } from './api-error.js';
-import { allowedWebHost } from './session-config.js';
-
-export class SiweError extends ApiError {}
-
-export interface SiweLogin {
-  message: string;
-  signature: string;
-}
-
-export interface SiweVerifyArgs {
-  address: `0x${string}`;
-  message: string;
-  signature: Hex;
-}
-
-export interface SiweDeps {
-  takeNonce: (nonce: string) => boolean;
-  now?: number;
-  verify?: (args: SiweVerifyArgs) => Promise<boolean>;
-}
-
-const HEX_SIGNATURE = /^0x[0-9a-fA-F]{130}$/;
-
-export function allowedSiweDomain(domain: string): boolean {
-  return allowedWebHost(domain.replace(/:\d+$/, ''));
-}
-
-function hostOf(uri: string): string | null {
-  try {
-    return new URL(uri).host;
-  } catch {
-    return null;
-  }
-}
-
-function fieldsOrThrow(message: string): {
-  address: `0x${string}`;
-  domain: string;
-  nonce: string;
-  parsed: ReturnType<typeof parseSiweMessage>;
-} {
-  const parsed = parseSiweMessage(message);
-  const { address, domain, nonce, uri, version } = parsed;
-  if (
-    address === undefined ||
-    domain === undefined ||
-    nonce === undefined ||
-    uri === undefined ||
-    version !== '1'
-  )
-    throw new SiweError('that is not a sign-in message', 400);
-  if (!allowedSiweDomain(domain))
-    throw new SiweError(`sign-in messages for ${domain} are not accepted here`, 400);
-  if (hostOf(uri) !== domain)
-    throw new SiweError('the sign-in message names a different site', 400);
-  return { address, domain, nonce, parsed };
-}
-
-export async function verifySiweLogin(
-  input: SiweLogin,
-  deps: SiweDeps,
-): Promise<string> {
-  if (!HEX_SIGNATURE.test(input.signature))
-    throw new SiweError('that is not an Ethereum signature', 400);
-  const { address, domain, nonce, parsed } = fieldsOrThrow(input.message);
-  const time = new Date(deps.now ?? Date.now());
-  if (!validateSiweMessage({ message: parsed, domain, nonce, time }))
-    throw new SiweError('this sign-in message is expired or does not match', 400);
-  if (!deps.takeNonce(nonce))
-    throw new SiweError('that sign-in has expired or was already used', 400);
-  const verify = deps.verify ?? verifyMessage;
-  const signature = input.signature as Hex;
-  if (!(await verify({ address, message: input.message, signature })))
-    throw new SiweError(
-      'the signature does not match the address; smart-contract wallets are not supported yet',
-      401,
-    );
-  return address.toLowerCase();
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-nonces.ts

@@ -1,43 +0,0 @@
-import { generateSiweNonce } from 'viem/siwe';
-
-const TTL_MS = 10 * 60_000;
-const SWEEP_MS = 60_000;
-const MAX_LIVE = 500;
-
-const live = new Map<string, number>();
-let sweeper: ReturnType<typeof setInterval> | null = null;
-
-function sweep(now = Date.now()): void {
-  for (const [nonce, expiresAt] of live) if (expiresAt <= now) live.delete(nonce);
-}
-
-function ensureSweeper(): void {
-  if (sweeper !== null) return;
-  sweeper = setInterval(sweep, SWEEP_MS);
-  sweeper.unref?.();
-}
-
-export function mintNonce(now = Date.now()): string {
-  sweep(now);
-  while (live.size >= MAX_LIVE) {
-    const oldest = live.keys().next();
-    if (oldest.done) break;
-    live.delete(oldest.value);
-  }
-  const nonce = generateSiweNonce();
-  live.set(nonce, now + TTL_MS);
-  ensureSweeper();
-  return nonce;
-}
-
-export function takeNonce(nonce: string, now = Date.now()): boolean {
-  const expiresAt = live.get(nonce);
-  if (expiresAt === undefined) return false;
-  live.delete(nonce);
-  return expiresAt > now;
-}
-
-export function nonceCount(): number {
-  sweep();
-  return live.size;
-}