@stage-labs/metro 0.1.0-beta.33 → 0.1.0-beta.35

package/dist/cli.js

@@ -5,7 +5,7 @@ import { askSecret } from './prompt.js';
 import { clearToken, credentialsPath, metroUrl, metroWebUrl, writeToken, } from './store.js';
 import { detach, lockedBy, probe, runningPid, stopAll, tail } from './control.js';
 import { tailEvents } from './tail.js';
-import { assertAgentId, daemonPlan, localUrl, readRunToken, runDaemon, runtimeDir, writeRunToken, } from './runtime.js';
+import { assertAgentId, daemonPlan, localUrl, readRunToken, runDaemon, runtimeDir, runTokenState, writeRunToken, } from './runtime.js';
 import { launchClaude } from './claude.js';
 import { bedrock } from './bedrock.js';
 import { installPlugin, syncPluginServers } from './plugin.js';
@@ -71,13 +71,24 @@ async function authorizeRuntime(agentId) {
     process.stderr.write(`Authorized as '${claimed.label}'.\n`);
     return claimed.token;
 }
+async function usableRunToken(agentId) {
+    const stored = readRunToken(agentId);
+    if (stored === null)
+        return authorizeRuntime(agentId);
+    const state = await runTokenState(stored);
+    if (state !== 'stale')
+        return stored;
+    process.stderr.write(`metro no longer recognises this machine as the holder of ${agentId}: ` +
+        'it was taken back, or another machine claimed it since. Authorize it again.\n');
+    return authorizeRuntime(agentId);
+}
 async function start(argv) {
     const agentId = assertAgentId(argv[0]);
     if (runningPid(agentId) !== null || lockedBy() !== null)
         throw new Error('a metro daemon is already running on this machine. ' +
             'Stop it first: metro stop');
     const dir = runtimeDir();
-    const token = readRunToken(agentId) ?? (await authorizeRuntime(agentId));
+    const token = await usableRunToken(agentId);
     const detached = argv.includes('--detach');
     const plan = daemonPlan({ agentId, token, dir });
     if (!detached)

package/dist/control.js

@@ -3,6 +3,12 @@ import { existsSync, mkdirSync, openSync, readdirSync, readFileSync, rmSync, wri
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 const STATE = () => join(homedir(), '.metro');
+export function serveStateDir() {
+    const xdg = process.env.XDG_CACHE_HOME?.trim();
+    const base = xdg === undefined || xdg === '' ? join(homedir(), '.cache') : xdg;
+    return join(base, 'metro', 'serve');
+}
+const serveLockPath = () => join(serveStateDir(), '.tail-lock');
 const pidPath = (agentId) => join(STATE(), `run-${agentId}.pid`);
 export const logPath = (agentId) => join(STATE(), 'logs', `${agentId}.log`);
 function ensureStateDirs() {
@@ -83,10 +89,10 @@ function commandOf(pid) {
     }
 }
 const looksLikeMetro = (command) => command.includes('server.ts') || command.includes('metro');
-export function lockedBy() {
+function holderOf(lockFile) {
     let pid;
     try {
-        pid = Number(readFileSync(lockPath(), 'utf8').trim());
+        pid = Number(readFileSync(lockFile, 'utf8').trim());
     }
     catch {
         return null;
@@ -95,6 +101,8 @@ export function lockedBy() {
         return null;
     return looksLikeMetro(commandOf(pid)) ? pid : null;
 }
+export const lockedBy = () => holderOf(lockPath());
+export const serveLockedBy = () => holderOf(serveLockPath());
 function trackedAgents(agentId) {
     const tracked = new Set();
     if (agentId !== undefined)
@@ -125,10 +133,17 @@ export async function stopAll(agentId, waitMs = 10_000) {
     }
     const holder = lockedBy();
     if (holder !== null && !seen.has(holder)) {
+        seen.add(holder);
         await stopPid(holder, waitMs);
         rmSync(lockPath(), { force: true });
         stopped.push({ pid: holder, via: 'the machine lock' });
     }
+    const served = serveLockedBy();
+    if (served !== null && !seen.has(served)) {
+        await stopPid(served, waitMs);
+        rmSync(serveLockPath(), { force: true });
+        stopped.push({ pid: served, via: 'metro serve' });
+    }
     return stopped;
 }
 export function tail(agentId, follow) {

package/dist/runtime.js

@@ -57,6 +57,26 @@ export function writeRunToken(agentId, token) {
     writeFileSync(path, JSON.stringify({ token, url: metroUrl() }, null, 2));
     chmodSync(path, 0o600);
 }
+const PROBE_TIMEOUT_MS = 15_000;
+export async function runTokenState(token) {
+    let res;
+    try {
+        res = await fetch(`${metroUrl()}/api/run/config`, {
+            headers: { authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+            redirect: 'manual',
+        });
+    }
+    catch {
+        return 'unreachable';
+    }
+    await res.arrayBuffer().catch(() => undefined);
+    if (res.ok)
+        return 'ok';
+    return res.status === 401 || res.status === 403 || res.status === 409
+        ? 'stale'
+        : 'unreachable';
+}
 export const localPort = () => Number(process.env.METRO_WEBHOOK_PORT) || 8420;
 export const localUrl = () => `http://127.0.0.1:${String(localPort())}`;
 export function daemonPlan(opts) {

package/dist/serve.js

@@ -1,6 +1,6 @@
 import { spawnSync } from 'node:child_process';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { serveLockedBy, serveStateDir } from './control.js';
 import { findBun, localPort, runtimeDir, SERVER_ENTRY, spawnPlan, } from './runtime.js';
 const SCRUBBED = new Set(['METRO_RUN_TOKEN', 'METRO_AGENT', 'DATABASE_URL']);
 const PORT_FLAG = /^--port=(.*)$/;
@@ -38,13 +38,13 @@ export function findCloudflared() {
     const found = spawnSync('cloudflared', ['--version'], { stdio: 'ignore' });
     if (found.error !== undefined || found.status !== 0)
         throw new Error('metro serve --tunnel needs cloudflared, which is not on PATH.\n' +
-            'Install it with:  brew install cloudflared  (macOS), or from\n' +
-            'https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/downloads/');
-}
-export function serveStateDir() {
-    const xdg = process.env.XDG_CACHE_HOME?.trim();
-    const base = xdg === undefined || xdg === '' ? join(homedir(), '.cache') : xdg;
-    return join(base, 'metro', 'serve');
+            'Debian/Ubuntu (it is not in the distro repos; this adds Cloudflare\'s signed one):\n' +
+            '  sudo mkdir -p --mode=0755 /usr/share/keyrings\n' +
+            '  curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null\n' +
+            "  echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list\n" +
+            '  sudo apt-get update && sudo apt-get install cloudflared\n' +
+            'macOS:  brew install cloudflared\n' +
+            'Others: https://pkg.cloudflare.com/');
 }
 export function servePlan(opts) {
     const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !SCRUBBED.has(key)));
@@ -65,6 +65,10 @@ export function servePlan(opts) {
 }
 export function serve(argv) {
     const { port, tunnel } = parseServeArgs(argv);
+    const running = serveLockedBy();
+    if (running !== null)
+        throw new Error(`a metro serve daemon is already running on this machine (pid ${String(running)}). ` +
+            'Stop it first: metro stop');
     if (tunnel)
         findCloudflared();
     const plan = servePlan({ dir: runtimeDir(), port, tunnel });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.33",
+  "version": "0.1.0-beta.35",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/agent-import.ts

@@ -0,0 +1,63 @@
+import { ApiError } from './api-error.js';
+import { carriesSecretsSafely, httpSource } from './runtime-source.js';
+import type { LoadedAgent } from '../db/materialize.js';
+
+const CLAIM_TIMEOUT_MS = 15_000;
+const CODE_RE = /^ma_[A-Za-z0-9_-]{16}$/;
+
+export function metroBaseUrl(): string {
+  const raw = (process.env.METRO_URL?.trim() ?? '').replace(/\/+$/, '');
+  const url = raw === '' ? 'https://mcp.metro.box' : raw;
+  if (!carriesSecretsSafely(url))
+    throw new ApiError(`refusing to read station credentials from ${url} in the clear`, 400);
+  return url;
+}
+
+export function parsePairingCode(raw: unknown): string {
+  const code = typeof raw === 'string' ? raw.trim() : '';
+  if (!CODE_RE.test(code))
+    throw new ApiError('paste the pairing code from the agent\'s page on metro.box', 400);
+  return code;
+}
+
+async function claim(base: string, code: string, label: string): Promise<string> {
+  let res: Response;
+  try {
+    res = await fetch(`${base}/api/run/claim`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ code, label }),
+      signal: AbortSignal.timeout(CLAIM_TIMEOUT_MS),
+      redirect: 'manual',
+    });
+  } catch {
+    throw new ApiError(`could not reach ${base}`, 502);
+  }
+  const body: unknown = await res.json().catch(() => null);
+  const field = (key: string): unknown =>
+    typeof body === 'object' && body !== null ? (body as Record<string, unknown>)[key] : undefined;
+  if (!res.ok) {
+    const reason = field('error');
+    throw new ApiError(
+      typeof reason === 'string' ? reason : `metro answered ${String(res.status)} for the code`,
+      res.status === 404 ? 400 : res.status,
+    );
+  }
+  const token = field('token');
+  if (typeof token !== 'string' || token === '')
+    throw new ApiError('metro returned no runtime token', 502);
+  return token;
+}
+
+export async function fetchAgentWithCode(
+  code: string,
+  label: string,
+  base = metroBaseUrl(),
+): Promise<LoadedAgent> {
+  const token = await claim(base, code, label);
+  const agents = await httpSource({ url: base, token })();
+  const agent = agents[0];
+  if (agent === undefined || agents.length !== 1)
+    throw new ApiError('metro returned no agent for that code', 502);
+  return agent;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/import-api.ts

@@ -0,0 +1,67 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from './log.js';
+import {
+  apiFailure,
+  apiSession,
+  bodyField,
+  cors,
+  readJsonBody,
+  sendJson,
+} from './api-http.js';
+import { parsePairingCode } from './agent-import.js';
+import type { CreatedAgent } from '../db/agent-admin.js';
+
+const PATH = '/api/agents/import';
+
+export interface ImportedAgent extends CreatedAgent {
+  stations: number;
+}
+
+export interface ImportApiDeps {
+  importAgent: (subject: string, code: string) => Promise<ImportedAgent>;
+}
+
+async function handle(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ImportApiDeps,
+  subject: string,
+): Promise<void> {
+  try {
+    const code = parsePairingCode(bodyField(await readJsonBody(req), 'code'));
+    const made = await deps.importAgent(subject, code);
+    log.info(
+      { agent: made.name, id: made.id, stations: made.stations },
+      'import-api: agent imported from metro',
+    );
+    sendJson(req, res, 201, made);
+  } catch (err) {
+    apiFailure(req, res, err, 'import-api');
+  }
+}
+
+export function handleImportRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ImportApiDeps,
+): boolean {
+  if ((req.url ?? '').split('?')[0] !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'POST') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  const session = apiSession(req);
+  if (!session) {
+    sendJson(req, res, 401, { error: 'unauthorized' });
+    return true;
+  }
+  handle(req, res, deps, session.subject).catch((err: unknown) => {
+    log.warn({ err: errMsg(err) }, 'import-api: unhandled error');
+    if (!res.headersSent) sendJson(req, res, 500, { error: 'import failed' });
+  });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-mode.ts

@@ -8,13 +8,17 @@ import type { AgentConnectorApiDeps } from './agent-connector-api.js';
 import type { ProjectApiDeps } from './project-api.js';
 import type { SessionApis } from './session-apis.js';
 import type { ModeInfo } from './mode-api.js';
+import type { ImportApiDeps } from './import-api.js';
+import { fetchAgentWithCode } from './agent-import.js';
 import {
+  assertLocalOwner,
   claimLocalOwner,
   LOCAL_PROJECT_ID,
   localAttachAccount,
   localCreateAgent,
   localDeleteAgent,
   localDetachAccount,
+  localImportAgent,
   localListAgents,
   localOwnedAgentOrThrow,
   localOwner,
@@ -26,6 +30,7 @@ import type { StationName } from '../db/schema.js';
 
 export interface LocalModeDeps {
   syncStations: (station: StationName) => Promise<void>;
+  fetchAgent?: (code: string, label: string) => ReturnType<typeof fetchAgentWithCode>;
   closeAgentSession: (id: string) => Promise<boolean>;
   gatherAccounts: AgentApiDeps['gatherAccounts'];
   capabilities: AgentApiDeps['capabilities'];
@@ -129,6 +134,25 @@ const agentConnectorApi: AgentConnectorApiDeps = {
     Promise.reject(new ApiError('a local daemon has no pairing codes', 400)),
 };
 
+function importApi(deps: LocalModeDeps): ImportApiDeps {
+  const fetchAgent = deps.fetchAgent ?? fetchAgentWithCode;
+  return {
+    importAgent: async (subject, code) => {
+      assertLocalOwner(subject);
+      const agent = await fetchAgent(code, hostname());
+      const made = await localImportAgent(subject, agent);
+      for (const station of new Set(agent.accounts.map((a) => a.station)))
+        await deps.syncStations(station).catch((err: unknown) => {
+          log.warn(
+            { station, err: errMsg(err) },
+            'import: station reload failed, the change lands at the next boot',
+          );
+        });
+      return made;
+    },
+  };
+}
+
 export function localModeInfo(): ModeInfo {
   return { mode: 'local', owner: localOwner(), project: LOCAL_PROJECT_ID };
 }
@@ -137,6 +161,7 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
   return {
     agentApi: agentApi(deps),
     agentConnectorApi,
+    importApi: importApi(deps),
     projectApi,
     siwe: { ensureUser: claimLocalOwner },
     mode: localModeInfo,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-apis.ts

@@ -17,11 +17,13 @@ import {
   type AgentConnectorApiDeps,
 } from './agent-connector-api.js';
 import type { SiweRouteDeps } from './siwe-routes.js';
+import { handleImportRequest, type ImportApiDeps } from './import-api.js';
 import type { ModeInfo } from './mode-api.js';
 
 export interface SessionApis {
   agentApi?: AgentApiDeps;
   agentConnectorApi?: AgentConnectorApiDeps;
+  importApi?: ImportApiDeps;
   connectorApi?: ConnectorApiDeps;
   projectApi?: ProjectApiDeps;
   runApi?: RunApiDeps;
@@ -35,7 +37,7 @@ export function handleSessionApis(
   res: ServerResponse,
   apis: SessionApis,
 ): boolean {
-  const { agentApi, agentConnectorApi, connectorApi, projectApi, runApi } = apis;
+  const { agentApi, agentConnectorApi, connectorApi, projectApi, runApi, importApi } = apis;
   const routes: (() => boolean)[] = [() => handleSessionApiRequest(req, res)];
   if (runApi) routes.push(() => handleRunApiRequest(req, res, runApi));
   if (projectApi)
@@ -45,6 +47,7 @@ export function handleSessionApis(
       () => handleCliPairRequest(req, res, connectorApi),
       () => handleConnectorApiRequest(req, res, connectorApi),
     );
+  if (importApi) routes.push(() => handleImportRequest(req, res, importApi));
   if (agentConnectorApi)
     routes.push(() => handleAgentConnectorRequest(req, res, agentConnectorApi));
   if (agentApi) routes.push(() => handleAgentApiRequest(req, res, agentApi));

package/runtime/node_modules/@metro-labs/mcp/src/db/file-admin.ts

@@ -25,12 +25,13 @@ import {
   AGENT_FILE,
   agentsDir,
   listAgentFiles,
+  parseAgentFile,
   readAgentFile,
   type AgentFile,
 } from './file-source.js';
 import { newId } from './ids.js';
 import { registerKey, rotateAgentKey, unregisterAgentKey } from './key-map.js';
-import { MOVABLE_STATIONS } from './materialize.js';
+import { MOVABLE_STATIONS, type LoadedAgent } from './materialize.js';
 import type { StationName } from './schema.js';
 import { normalizeAddress } from './users.js';
 
@@ -188,6 +189,63 @@ export async function localDeleteAgent(
   return Promise.resolve({ id, name: stored.file.name });
 }
 
+function assertUnclaimed(existing: Stored[], agent: LoadedAgent): void {
+  for (const { file } of existing) {
+    if (file.id === agent.id)
+      throw new AgentAdminError(`agent ${agent.id} is already on this machine`, 409);
+    if (agent.key !== null && file.key === agent.key)
+      throw new AgentAdminError('that agent key is already on this machine', 409);
+  }
+}
+
+export function assertLocalOwner(subject: string, dir = agentsDir()): void {
+  if (!isOwner(subject, dir)) throw new AgentAdminError('no such project', 404);
+}
+
+export async function localImportAgent(
+  subject: string,
+  agent: LoadedAgent,
+  dir = agentsDir(),
+): Promise<{ id: string; name: string; key: string; stations: number }> {
+  assertLocalOwner(subject, dir);
+  const immovable = agent.accounts.find((a) => !MOVABLE_STATIONS.has(a.station));
+  if (immovable !== undefined)
+    throw new AgentAdminError(
+      `a ${immovable.station} endpoint needs a public url and cannot live on a local daemon`,
+      400,
+    );
+  if (agent.key === null)
+    throw new AgentAdminError('that agent has no key; reset it on metro.box first', 400);
+  const folder = join(dir, agent.name);
+  const path = join(folder, AGENT_FILE);
+  if (existsSync(path))
+    throw new AgentAdminError(
+      `an agent named '${agent.name}' already exists on this machine`,
+      409,
+    );
+  assertUnclaimed(storedAgents(dir), agent);
+  const file = parseAgentFile(
+    JSON.stringify({
+      version: 1,
+      id: agent.id,
+      name: agent.name,
+      key: agent.key,
+      owner: localOwner(dir),
+      stations: agent.accounts.map((a) => ({ ...a, allowlist: a.allowlist ?? ['*'] })),
+    }),
+    path,
+  );
+  ensureSecureDir(folder);
+  save({ path, file });
+  registerKey(agent.key, agent.id);
+  return Promise.resolve({
+    id: agent.id,
+    name: agent.name,
+    key: agent.key,
+    stations: agent.accounts.length,
+  });
+}
+
 function removeIfEmpty(folder: string): void {
   try {
     rmdirSync(folder);

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.33"
+  "version": "0.1.0-beta.35"
 }