@stage-labs/metro 0.1.0-beta.41 → 0.1.0-beta.43

package/runtime/node_modules/@metro-labs/mcp/src/db/local-connectors.ts

@@ -0,0 +1,312 @@
+import { join } from 'node:path';
+import { readJson, writeSecure } from '../daemon/secure-fs.js';
+import { errMsg, log } from '../daemon/log.js';
+import {
+  connectorUrlText,
+  ConnectorVerifyError,
+  parseConnectorUrl,
+  verifyRemoteMcp,
+  type ConnectorAuth,
+  type OAuthAuth,
+} from '../daemon/connector-verify.js';
+import { oauthExpired, refreshOAuth } from '../daemon/connector-oauth.js';
+import { advertisesOAuth } from '../daemon/oauth-discovery.js';
+import {
+  ConnectorError,
+  connectorAuth,
+  connectorName,
+  readConfig,
+  signInState,
+  stamp,
+  type ConnectorConfig,
+} from './connector-config.js';
+import {
+  bearerHeaders,
+  fixedTarget,
+  unrefreshedTarget,
+  type RelayTarget,
+} from './connector-relay.js';
+import {
+  connectorFromRow,
+  UNVERIFIED,
+  type Connector,
+  type ConnectorCheck,
+  type ConnectorInput,
+  type ConnectorSummary,
+  type DeletedConnector,
+} from './connectors.js';
+import type { AgentConnectors } from './agent-connectors.js';
+import { agentsDir } from './file-source.js';
+import {
+  assertLocalOwner,
+  connectorIdsOfLocalAgent,
+  localAgentConnectorIds,
+  localAgentsWith,
+  localDropConnectorEverywhere,
+  localOwnedAgentOrThrow,
+  localSetAgentConnectors,
+  LOCAL_PROJECT_ID,
+} from './file-admin.js';
+import { newId } from './ids.js';
+
+export interface LocalConnectorRow {
+  id: string;
+  name: string;
+  url: string;
+  transport: 'http';
+  config: ConnectorConfig;
+}
+
+const FILE = 'connectors.json';
+const filePath = (dir: string): string => join(dir, FILE);
+
+const isRow = (v: unknown): v is { id: string; name: string; url: string; config?: unknown } =>
+  typeof v === 'object' &&
+  v !== null &&
+  typeof (v as { id?: unknown }).id === 'string' &&
+  typeof (v as { name?: unknown }).name === 'string' &&
+  typeof (v as { url?: unknown }).url === 'string';
+
+const asList = (value: unknown): unknown[] =>
+  Array.isArray(value) ? value.map((item: unknown) => item) : [];
+
+export function readLocalConnectors(dir = agentsDir()): LocalConnectorRow[] {
+  const raw = readJson<{ connectors?: unknown }>(filePath(dir), {}, {
+    warn: 'connectors.json: malformed, ignoring',
+  });
+  return asList(raw.connectors).filter(isRow).map((r) => ({
+    id: r.id,
+    name: r.name,
+    url: r.url,
+    transport: 'http' as const,
+    config: readConfig(r.config),
+  }));
+}
+
+function writeRows(dir: string, rows: LocalConnectorRow[]): void {
+  writeSecure(filePath(dir), `${JSON.stringify({ version: 1, connectors: rows }, null, 2)}\n`);
+}
+
+const missing = (): ConnectorError => new ConnectorError('no such connector', 404);
+
+function ownedRows(subject: string, project: string, dir: string): LocalConnectorRow[] {
+  assertLocalOwner(subject, dir);
+  if (project !== LOCAL_PROJECT_ID) throw new ConnectorError('no such project', 404);
+  return readLocalConnectors(dir);
+}
+
+function rowOrThrow(subject: string, id: string, dir: string): LocalConnectorRow {
+  assertLocalOwner(subject, dir);
+  const row = readLocalConnectors(dir).find((r) => r.id === id);
+  if (row === undefined) throw missing();
+  return row;
+}
+
+function replace(dir: string, row: LocalConnectorRow): Connector {
+  writeRows(dir, readLocalConnectors(dir).map((r) => (r.id === row.id ? row : r)));
+  return connectorFromRow(row);
+}
+
+async function oauthCapable(url: URL, auth: ConnectorAuth): Promise<boolean> {
+  if (auth.kind === 'oauth') return true;
+  if (auth.kind === 'header') return false;
+  return advertisesOAuth(url);
+}
+
+export async function localListConnectors(
+  subject: string,
+  project: string,
+  dir = agentsDir(),
+): Promise<Connector[]> {
+  return Promise.resolve(ownedRows(subject, project, dir).map(connectorFromRow));
+}
+
+export async function localGetConnector(subject: string, id: string, dir = agentsDir()): Promise<Connector> {
+  return Promise.resolve(connectorFromRow(rowOrThrow(subject, id, dir)));
+}
+
+function insert(dir: string, name: string, url: URL, config: ConnectorConfig): Connector {
+  const row: LocalConnectorRow = { id: newId(), name, url: connectorUrlText(url), transport: 'http', config };
+  writeRows(dir, [...readLocalConnectors(dir), row]);
+  return connectorFromRow(row);
+}
+
+export async function localCreateConnector(
+  subject: string,
+  project: string,
+  input: ConnectorInput,
+  dir = agentsDir(),
+): Promise<Connector> {
+  ownedRows(subject, project, dir);
+  const name = connectorName(input.name);
+  const url = parseConnectorUrl(input.url);
+  const auth = connectorAuth(input.header, input.value);
+  const verified = stamp(await verifyRemoteMcp(url, auth));
+  return insert(dir, name, url, {
+    auth,
+    createdAt: new Date().toISOString(),
+    verified,
+    oauth: await oauthCapable(url, auth),
+  });
+}
+
+export async function localCreatePendingConnector(
+  subject: string,
+  project: string,
+  input: { name: unknown; url: unknown },
+  dir = agentsDir(),
+): Promise<Connector> {
+  ownedRows(subject, project, dir);
+  const name = connectorName(input.name);
+  const url = parseConnectorUrl(input.url);
+  return Promise.resolve(
+    insert(dir, name, url, { auth: { kind: 'none' }, createdAt: new Date().toISOString(), verified: UNVERIFIED, oauth: true }),
+  );
+}
+
+export async function localReconnectConnector(
+  subject: string,
+  id: string,
+  auth: OAuthAuth,
+  dir = agentsDir(),
+): Promise<Connector> {
+  const row = rowOrThrow(subject, id, dir);
+  const verified = stamp(await verifyRemoteMcp(parseConnectorUrl(row.url), auth));
+  return replace(dir, { ...row, config: { ...row.config, auth, verified, oauth: true } });
+}
+
+export async function localDisconnectConnector(subject: string, id: string, dir = agentsDir()): Promise<Connector> {
+  const row = rowOrThrow(subject, id, dir);
+  if (row.config.auth.kind !== 'oauth') throw new ConnectorError('that connector is not signed in', 400);
+  return Promise.resolve(replace(dir, { ...row, config: { ...row.config, auth: { kind: 'none' }, oauth: true } }));
+}
+
+async function freshAuth(auth: ConnectorAuth, resource: string): Promise<ConnectorAuth> {
+  if (auth.kind !== 'oauth' || !oauthExpired(auth)) return auth;
+  return refreshOAuth(auth, resource);
+}
+
+export async function localVerifyConnector(subject: string, id: string, dir = agentsDir()): Promise<ConnectorCheck> {
+  const row = rowOrThrow(subject, id, dir);
+  try {
+    const url = parseConnectorUrl(row.url);
+    const auth = await freshAuth(row.config.auth, url.toString());
+    const verified = stamp(await verifyRemoteMcp(url, auth));
+    const oauth = row.config.oauth || (await oauthCapable(url, auth));
+    replace(dir, { ...row, config: { ...row.config, auth, verified, oauth } });
+    return { id: row.id, name: row.name, ok: true, verified };
+  } catch (err) {
+    if (!(err instanceof ConnectorVerifyError)) throw err;
+    return { id: row.id, name: row.name, ok: false, reason: err.message };
+  }
+}
+
+const nameClash = (name: string, agent: string): ConnectorError =>
+  new ConnectorError(`the agent '${agent}' already has a connector named '${name}'`, 409);
+
+function clashFor(name: string, exceptId: string, agentIds: string[], dir: string): string | null {
+  const rows = readLocalConnectors(dir);
+  for (const agentId of agentIds) {
+    const held = connectorIdsOfLocalAgent(agentId, dir) ?? [];
+    const other = rows.find((r) => r.id !== exceptId && held.includes(r.id) && r.name === name);
+    if (other !== undefined) return localAgentsWith(other.id, dir).find((a) => a.id === agentId)?.name ?? agentId;
+  }
+  return null;
+}
+
+export async function localRenameConnector(subject: string, id: string, raw: string, dir = agentsDir()): Promise<Connector> {
+  const name = connectorName(raw);
+  const row = rowOrThrow(subject, id, dir);
+  const clash = clashFor(name, id, localAgentsWith(id, dir).map((a) => a.id), dir);
+  if (clash !== null) throw nameClash(name, clash);
+  return Promise.resolve(replace(dir, { ...row, name }));
+}
+
+export async function localDeleteConnector(subject: string, id: string, dir = agentsDir()): Promise<DeletedConnector> {
+  const row = rowOrThrow(subject, id, dir);
+  writeRows(dir, readLocalConnectors(dir).filter((r) => r.id !== id));
+  localDropConnectorEverywhere(id, dir);
+  return Promise.resolve({ id: row.id, name: row.name });
+}
+
+const byIds = (ids: string[], dir: string): LocalConnectorRow[] =>
+  readLocalConnectors(dir).filter((r) => ids.includes(r.id));
+
+export async function localConnectorSummariesByIds(ids: string[], dir = agentsDir()): Promise<ConnectorSummary[]> {
+  return Promise.resolve(
+    byIds(ids, dir).map((r) => ({ id: r.id, name: r.name, url: r.url, transport: r.transport, signIn: signInState(r.config) })),
+  );
+}
+
+export async function localConnectorNamesByIds(ids: string[], dir = agentsDir()): Promise<{ id: string; name: string }[]> {
+  return Promise.resolve(byIds(ids, dir).map((r) => ({ id: r.id, name: r.name })));
+}
+
+export async function localAgentConnectors(subject: string, agentId: string, dir = agentsDir()): Promise<AgentConnectors> {
+  const { agent } = await localOwnedAgentOrThrow(subject, agentId, dir);
+  return { ...agent, connectorIds: localAgentConnectorIds(subject, agentId, dir) };
+}
+
+export async function localAddConnector(subject: string, agentId: string, connectorId: string, dir = agentsDir()): Promise<AgentConnectors> {
+  const { agent } = await localOwnedAgentOrThrow(subject, agentId, dir);
+  const row = readLocalConnectors(dir).find((r) => r.id === connectorId);
+  if (row === undefined) throw missing();
+  const held = localAgentConnectorIds(subject, agentId, dir);
+  if (!held.includes(connectorId)) {
+    const clash = clashFor(row.name, connectorId, [agentId], dir);
+    if (clash !== null) throw nameClash(row.name, clash);
+    localSetAgentConnectors(subject, agentId, [...held, connectorId], dir);
+  }
+  return { ...agent, connectorIds: localAgentConnectorIds(subject, agentId, dir) };
+}
+
+export async function localRemoveConnector(subject: string, agentId: string, connectorId: string, dir = agentsDir()): Promise<AgentConnectors> {
+  const { agent } = await localOwnedAgentOrThrow(subject, agentId, dir);
+  const held = localAgentConnectorIds(subject, agentId, dir);
+  localSetAgentConnectors(subject, agentId, held.filter((id) => id !== connectorId), dir);
+  return { ...agent, connectorIds: localAgentConnectorIds(subject, agentId, dir) };
+}
+
+const inflight = new Map<string, Promise<OAuthAuth>>();
+
+function refreshOnce(row: LocalConnectorRow, auth: OAuthAuth, dir: string): Promise<OAuthAuth> {
+  const running = inflight.get(row.id);
+  if (running !== undefined) return running;
+  const job = refreshOAuth(auth, parseConnectorUrl(row.url).toString())
+    .then((fresh) => {
+      replace(dir, { ...row, config: { ...row.config, auth: fresh } });
+      return fresh;
+    })
+    .finally(() => {
+      inflight.delete(row.id);
+    });
+  inflight.set(row.id, job);
+  return job;
+}
+
+async function oauthTarget(row: LocalConnectorRow, auth: OAuthAuth, force: boolean, dir: string): Promise<RelayTarget> {
+  if (!force && !oauthExpired(auth)) return { kind: 'ok', url: row.url, headers: bearerHeaders(auth.accessToken) };
+  try {
+    const fresh = await refreshOnce(row, auth, dir);
+    return { kind: 'ok', url: row.url, headers: bearerHeaders(fresh.accessToken) };
+  } catch (err) {
+    log.warn({ id: row.id, err: errMsg(err) }, 'local relay: token refresh failed');
+    return unrefreshedTarget(row.url, auth, force);
+  }
+}
+
+export async function localRelayTarget(
+  agentId: string,
+  connectorId: string,
+  force: boolean,
+  dir = agentsDir(),
+): Promise<RelayTarget> {
+  const held = connectorIdsOfLocalAgent(agentId, dir);
+  if (!held?.includes(connectorId)) return { kind: 'missing' };
+  const row = readLocalConnectors(dir).find((r) => r.id === connectorId);
+  if (row === undefined) return { kind: 'missing' };
+  parseConnectorUrl(row.url);
+  const auth = row.config.auth;
+  if (auth.kind === 'oauth') return oauthTarget(row, auth, force, dir);
+  return fixedTarget(row.url, auth, force);
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.41"
+  "version": "0.1.0-beta.43"
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/hosted-connectors.ts

@@ -1,118 +0,0 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { errMsg, log } from './log.js';
-import { configDir } from './paths.js';
-import { metroBaseUrl } from './agent-import.js';
-
-const FETCH_TIMEOUT_MS = 15_000;
-const CACHE_MS = 60_000;
-
-export interface HostedConnector {
-  id: string;
-  name: string;
-  url: string;
-  transport: string;
-  signIn: 'connected' | 'disconnected' | null;
-}
-
-export interface HostedCredential {
-  token: string;
-  url: string;
-}
-
-function readJsonFile(path: string): Record<string, unknown> | null {
-  try {
-    const parsed: unknown = JSON.parse(readFileSync(path, 'utf8'));
-    return typeof parsed === 'object' && parsed !== null ? (parsed as Record<string, unknown>) : null;
-  } catch {
-    return null;
-  }
-}
-
-function agentOfToken(token: string): string | null {
-  const body = token.split('.')[1];
-  if (body === undefined) return null;
-  try {
-    const claims = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as { agent?: unknown };
-    return typeof claims.agent === 'string' ? claims.agent : null;
-  } catch {
-    return null;
-  }
-}
-
-function credential(file: Record<string, unknown> | null): HostedCredential | null {
-  if (file === null || typeof file.token !== 'string' || file.token === '') return null;
-  return { token: file.token, url: typeof file.url === 'string' && file.url !== '' ? file.url : metroBaseUrl() };
-}
-
-export function hostedCredentialsFor(agentId: string, dir = configDir()): HostedCredential[] {
-  const out: HostedCredential[] = [];
-  const login = credential(readJsonFile(join(dir, 'credentials.json')));
-  if (login !== null && agentOfToken(login.token) === agentId) out.push(login);
-  const runtime = join(dir, `runtime-${agentId}.json`);
-  if (existsSync(runtime)) {
-    const cred = credential(readJsonFile(runtime));
-    if (cred !== null) out.push(cred);
-  }
-  return out;
-}
-
-const isConnector = (v: unknown): v is HostedConnector =>
-  typeof v === 'object' &&
-  v !== null &&
-  typeof (v as { id?: unknown }).id === 'string' &&
-  typeof (v as { name?: unknown }).name === 'string';
-
-class Refused extends Error {}
-
-async function fetchHosted(cred: HostedCredential): Promise<HostedConnector[]> {
-  const res = await fetch(`${cred.url}/api/cli/connectors`, {
-    headers: { authorization: `Bearer ${cred.token}` },
-    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-    redirect: 'manual',
-  });
-  if (res.status === 401 || res.status === 403 || res.status === 409) {
-    await res.arrayBuffer().catch(() => undefined);
-    throw new Refused(`metro no longer accepts this credential (${String(res.status)})`);
-  }
-  if (!res.ok) throw new Error(`metro answered ${String(res.status)} for the connectors`);
-  const body = (await res.json()) as { connectors?: unknown };
-  return Array.isArray(body.connectors) ? body.connectors.filter(isConnector) : [];
-}
-
-async function firstAccepted(agentId: string, creds: HostedCredential[]): Promise<HostedConnector[] | null> {
-  for (const cred of creds) {
-    try {
-      return await fetchHosted(cred);
-    } catch (err) {
-      if (!(err instanceof Refused)) throw err;
-      log.warn({ agent: agentId, reason: errMsg(err) }, 'hosted connectors: credential refused, trying the next');
-    }
-  }
-  return null;
-}
-
-const cache = new Map<string, { at: number; list: HostedConnector[] }>();
-
-export async function hostedConnectorsFor(agentId: string, dir = configDir()): Promise<HostedConnector[]> {
-  const hit = cache.get(agentId);
-  if (hit !== undefined && Date.now() - hit.at < CACHE_MS) return hit.list;
-  const creds = hostedCredentialsFor(agentId, dir);
-  if (creds.length === 0) return [];
-  try {
-    const list = await firstAccepted(agentId, creds);
-    if (list === null) {
-      log.warn({ agent: agentId }, 'hosted connectors: every stored credential is stale; metro login again');
-      return [];
-    }
-    cache.set(agentId, { at: Date.now(), list });
-    return list;
-  } catch (err) {
-    log.warn({ agent: agentId, err: errMsg(err) }, 'hosted connectors: unavailable, listing none');
-    return [];
-  }
-}
-
-export function forgetHostedConnectors(): void {
-  cache.clear();
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-connectors-api.ts

@@ -1,56 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
-import { apiSession, cors, sendJson } from './api-http.js';
-import type { HostedConnector } from './hosted-connectors.js';
-
-const PATH = '/api/connectors';
-
-export interface LocalConnectorsDeps {
-  listConnectors: (subject: string) => Promise<HostedConnector[]>;
-}
-
-const payload = (c: HostedConnector): Record<string, unknown> => ({
-  id: c.id,
-  name: c.name,
-  url: c.url,
-  transport: c.transport,
-  auth: c.signIn === null ? 'none' : 'oauth',
-  header: null,
-  signIn: c.signIn,
-  verified: null,
-  managed: 'metro.box',
-});
-
-export function handleLocalConnectorsRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: LocalConnectorsDeps,
-): boolean {
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  if (path !== PATH && !path.startsWith(`${PATH}/`)) return false;
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (path !== PATH || req.method !== 'GET') {
-    sendJson(req, res, path === PATH ? 405 : 404, {
-      error: 'connectors are managed on metro.box, not on a local daemon',
-    });
-    return true;
-  }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
-  deps
-    .listConnectors(session.subject)
-    .then((list) => {
-      sendJson(req, res, 200, { connectors: list.map(payload) });
-    })
-    .catch((err: unknown) => {
-      log.warn({ err: errMsg(err) }, 'local connectors: request failed');
-      if (!res.headersSent) sendJson(req, res, 500, { error: 'connectors failed' });
-    });
-  return true;
-}