@stage-labs/metro 0.1.0-beta.5 → 0.1.0-beta.50

package/dist/api.js

@@ -0,0 +1,148 @@
+import { metroUrl, readRunTokens, readToken } from './store.js';
+import { localAgents, localDaemonUp, localMcpServers, pickLocalAgent } from './local.js';
+import { localUrl } from './runtime.js';
+export class NotSignedIn extends Error {
+}
+const TIMEOUT_MS = 20_000;
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+export function carriesSecretsSafely(base) {
+    let url;
+    try {
+        url = new URL(base);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol === 'https:')
+        return true;
+    return url.protocol === 'http:' && LOOPBACK.has(url.hostname);
+}
+function tokenOrThrow() {
+    if (!carriesSecretsSafely(metroUrl()))
+        throw new Error(`refusing to send your session to ${metroUrl()} in the clear — use https, or a loopback address`);
+    const token = readToken() ?? soleRunToken();
+    if (token === null)
+        throw new NotSignedIn('not signed in — run `metro login`, or `metro start <agent-id>` on this machine');
+    return token;
+}
+function soleRunToken() {
+    const tokens = readRunTokens();
+    return tokens.length === 1 ? (tokens[0] ?? null) : null;
+}
+async function get(path) {
+    const auth = tokenOrThrow();
+    let res;
+    try {
+        res = await fetch(`${metroUrl()}${path}`, {
+            headers: { authorization: `Bearer ${auth}` },
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch {
+        throw new Error(`could not reach ${metroUrl()}`);
+    }
+    if (res.status === 401)
+        throw new NotSignedIn("metro refused this machine's sign-in — run `metro login` again");
+    if (!res.ok)
+        throw new Error(`metro answered ${String(res.status)}`);
+    return res.json();
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+async function post(path, body) {
+    if (!carriesSecretsSafely(metroUrl()))
+        throw new Error(`refusing to send your code to ${metroUrl()} in the clear — use https, or a loopback address`);
+    let res;
+    try {
+        res = await fetch(`${metroUrl()}${path}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch {
+        throw new Error(`could not reach ${metroUrl()}`);
+    }
+    const parsed = await res.json().catch(() => null);
+    if (res.ok)
+        return parsed;
+    const detail = isRecord(parsed) ? parsed.error : undefined;
+    throw new Error(typeof detail === 'string' ? detail : `metro answered ${String(res.status)}`);
+}
+export class RuntimeRevoked extends Error {
+}
+export function keyOfRunConfig(body) {
+    const agent = isRecord(body) ? body.agent : undefined;
+    const key = isRecord(agent) ? agent.key : undefined;
+    if (typeof key !== 'string' || key === '')
+        throw new Error('this agent has no key — reset it on its page in the web UI');
+    return key;
+}
+export async function runConfigKey(token) {
+    if (!carriesSecretsSafely(metroUrl()))
+        throw new Error(`refusing to send this machine's authorization to ${metroUrl()} in the clear — use https, or a loopback address`);
+    let res;
+    try {
+        res = await fetch(`${metroUrl()}/api/run/config`, {
+            headers: { authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch {
+        throw new Error(`could not reach ${metroUrl()}`);
+    }
+    if (res.status === 401 || res.status === 403 || res.status === 409)
+        throw new RuntimeRevoked('this machine no longer holds the agent — authorize it again from the agent page');
+    if (!res.ok)
+        throw new Error(`metro answered ${String(res.status)}`);
+    return keyOfRunConfig(await res.json());
+}
+export async function claimCode(code) {
+    const body = await post('/api/cli/claim', { code });
+    if (!isRecord(body) ||
+        typeof body.token !== 'string' ||
+        typeof body.subject !== 'string' ||
+        typeof body.agent !== 'string')
+        throw new Error('metro returned an unexpected response');
+    return { token: body.token, subject: body.subject, agent: body.agent };
+}
+export async function claimRuntime(code, label) {
+    const body = await post('/api/run/claim', { code, label });
+    if (!isRecord(body) ||
+        typeof body.token !== 'string' ||
+        typeof body.agent !== 'string' ||
+        typeof body.label !== 'string')
+        throw new Error('metro returned an unexpected response');
+    return { token: body.token, agent: body.agent, label: body.label };
+}
+export async function mcpServers(wanted) {
+    if (await localDaemonUp()) {
+        const agents = localAgents();
+        if (agents.length > 0)
+            return localMcpServers(pickLocalAgent(agents, wanted));
+    }
+    const body = await get('/api/cli/mcp');
+    if (!isRecord(body) || typeof body.json !== 'string')
+        throw new Error('metro returned an unexpected response');
+    return body.json;
+}
+export async function whoisAuthorized(wanted) {
+    if (await localDaemonUp()) {
+        const agents = localAgents();
+        if (agents.length > 0) {
+            const agent = pickLocalAgent(agents, wanted);
+            return { subject: 'this machine', agent: agent.name, where: `${localUrl()} (local)` };
+        }
+    }
+    return { ...(await hostedIdentity()), where: metroUrl() };
+}
+async function hostedIdentity() {
+    const body = await get('/api/cli/session');
+    if (!isRecord(body) ||
+        typeof body.subject !== 'string' ||
+        typeof body.agent !== 'string')
+        throw new Error('metro returned an unexpected response');
+    return { subject: body.subject, agent: body.agent };
+}

package/dist/bedrock-eventstream.js

@@ -0,0 +1,120 @@
+const PRELUDE_BYTES = 12;
+const CRC_BYTES = 4;
+const HEADER_TRUE = 0;
+const HEADER_FALSE = 1;
+const HEADER_BYTE = 2;
+const HEADER_SHORT = 3;
+const HEADER_INT = 4;
+const HEADER_LONG = 5;
+const HEADER_BYTES = 6;
+const HEADER_STRING = 7;
+const HEADER_TIMESTAMP = 8;
+const HEADER_UUID = 9;
+const FIXED_WIDTH = {
+    [HEADER_TRUE]: 0,
+    [HEADER_FALSE]: 0,
+    [HEADER_BYTE]: 1,
+    [HEADER_SHORT]: 2,
+    [HEADER_INT]: 4,
+    [HEADER_LONG]: 8,
+    [HEADER_TIMESTAMP]: 8,
+    [HEADER_UUID]: 16,
+};
+function readHeaderValue(buf, at, type) {
+    if (type === HEADER_BYTES || type === HEADER_STRING) {
+        const len = buf.readUInt16BE(at);
+        const raw = buf.subarray(at + 2, at + 2 + len);
+        const value = type === HEADER_STRING ? raw.toString('utf8') : raw.toString('base64');
+        return { value, next: at + 2 + len };
+    }
+    const width = FIXED_WIDTH[type];
+    if (width === undefined)
+        throw new Error(`eventstream: unknown header type ${String(type)}`);
+    if (type === HEADER_TRUE)
+        return { value: 'true', next: at };
+    if (type === HEADER_FALSE)
+        return { value: 'false', next: at };
+    return { value: buf.subarray(at, at + width).toString('hex'), next: at + width };
+}
+function readHeaders(buf) {
+    const out = {};
+    let at = 0;
+    while (at < buf.length) {
+        const nameLen = buf.readUInt8(at);
+        const name = buf.subarray(at + 1, at + 1 + nameLen).toString('utf8');
+        const type = buf.readUInt8(at + 1 + nameLen);
+        const parsed = readHeaderValue(buf, at + 2 + nameLen, type);
+        out[name] = parsed.value;
+        at = parsed.next;
+    }
+    return out;
+}
+export function decodeFrame(buf, offset) {
+    if (buf.length - offset < PRELUDE_BYTES)
+        return null;
+    const total = buf.readUInt32BE(offset);
+    const headersLen = buf.readUInt32BE(offset + 4);
+    if (total < PRELUDE_BYTES + CRC_BYTES || headersLen > total)
+        throw new Error('eventstream: malformed frame prelude');
+    if (buf.length - offset < total)
+        return null;
+    const headersStart = offset + PRELUDE_BYTES;
+    const payloadStart = headersStart + headersLen;
+    const payloadEnd = offset + total - CRC_BYTES;
+    return {
+        message: {
+            headers: readHeaders(buf.subarray(headersStart, payloadStart)),
+            payload: Buffer.from(buf.subarray(payloadStart, payloadEnd)),
+        },
+        end: offset + total,
+    };
+}
+export class EventStreamDecoder {
+    pending = Buffer.alloc(0);
+    push(chunk) {
+        this.pending =
+            this.pending.length === 0 ? chunk : Buffer.concat([this.pending, chunk]);
+        const out = [];
+        let offset = 0;
+        for (;;) {
+            const frame = decodeFrame(this.pending, offset);
+            if (frame === null)
+                break;
+            out.push(frame.message);
+            offset = frame.end;
+        }
+        this.pending = this.pending.subarray(offset);
+        return out;
+    }
+    leftover() {
+        return this.pending.length;
+    }
+}
+function encodeHeader(name, value) {
+    const nameBuf = Buffer.from(name, 'utf8');
+    const valueBuf = Buffer.from(value, 'utf8');
+    const out = Buffer.alloc(1 + nameBuf.length + 1 + 2 + valueBuf.length);
+    let at = 0;
+    out.writeUInt8(nameBuf.length, at);
+    at += 1;
+    nameBuf.copy(out, at);
+    at += nameBuf.length;
+    out.writeUInt8(HEADER_STRING, at);
+    at += 1;
+    out.writeUInt16BE(valueBuf.length, at);
+    at += 2;
+    valueBuf.copy(out, at);
+    return out;
+}
+export function encodeFrame(headers, payload) {
+    const headerBuf = Buffer.concat(Object.entries(headers).map(([name, value]) => encodeHeader(name, value)));
+    const total = PRELUDE_BYTES + headerBuf.length + payload.length + CRC_BYTES;
+    const out = Buffer.alloc(total);
+    out.writeUInt32BE(total, 0);
+    out.writeUInt32BE(headerBuf.length, 4);
+    out.writeUInt32BE(0, 8);
+    headerBuf.copy(out, PRELUDE_BYTES);
+    payload.copy(out, PRELUDE_BYTES + headerBuf.length);
+    out.writeUInt32BE(0, total - CRC_BYTES);
+    return out;
+}

package/dist/bedrock-proxy.js

@@ -0,0 +1,260 @@
+import { createServer, } from 'node:http';
+import { EventStreamDecoder } from './bedrock-eventstream.js';
+import { callBedrock, freshAdaptations, invoke, invokeUrl, upstreamMessage, } from './bedrock-upstream.js';
+export class BedrockConfigError extends Error {
+}
+class ProxyError extends Error {
+    status;
+    kind;
+    constructor(status, kind, message) {
+        super(message);
+        this.status = status;
+        this.kind = kind;
+    }
+}
+const ANTHROPIC_VERSION = 'bedrock-2023-05-31';
+const BODY_MAX = 64 * 1024 * 1024;
+const MESSAGES_PATH = '/v1/messages';
+const COUNT_PATH = '/v1/messages/count_tokens';
+function firstEnv(env, names) {
+    for (const name of names) {
+        const value = env[name]?.trim() ?? '';
+        if (value !== '')
+            return value;
+    }
+    return '';
+}
+export function bedrockConfigFromEnv(env = process.env) {
+    const bearerToken = firstEnv(env, ['AWS_BEARER_TOKEN_BEDROCK']);
+    if (bearerToken === '')
+        throw new BedrockConfigError('AWS_BEARER_TOKEN_BEDROCK is not set. Create an Amazon Bedrock API key in the AWS console (Bedrock → API keys) and export it.');
+    const region = firstEnv(env, ['METRO_BEDROCK_REGION', 'AWS_REGION', 'AWS_DEFAULT_REGION']);
+    if (region === '')
+        throw new BedrockConfigError('no AWS region: set AWS_REGION (or METRO_BEDROCK_REGION) to the region your Bedrock API key belongs to');
+    const model = firstEnv(env, ['METRO_BEDROCK_MODEL']);
+    return { region, bearerToken, model: model === '' ? null : model };
+}
+const PREFIXES = [
+    [/^us-gov-/, 'us-gov'],
+    [/^us-/, 'us'],
+    [/^eu-/, 'eu'],
+    [/^ap-/, 'apac'],
+];
+export function regionPrefix(region) {
+    for (const [pattern, prefix] of PREFIXES)
+        if (pattern.test(region))
+            return prefix;
+    return 'global';
+}
+export function mapModel(requested, cfg) {
+    if (cfg.model !== null)
+        return cfg.model;
+    if (requested.includes('anthropic.'))
+        return requested;
+    return `${regionPrefix(cfg.region)}.anthropic.${requested}`;
+}
+export const upstreamBase = (cfg, override) => override ?? `https://bedrock-runtime.${cfg.region}.amazonaws.com`;
+function splitBetas(header) {
+    const raw = Array.isArray(header) ? header.join(',') : (header ?? '');
+    return raw
+        .split(',')
+        .map((b) => b.trim())
+        .filter((b) => b !== '');
+}
+export function rewriteBody(raw, betaHeader, cfg) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        throw new ProxyError(400, 'invalid_request_error', 'body must be a JSON object');
+    const { model, stream, ...rest } = raw;
+    if (typeof model !== 'string' || model === '')
+        throw new ProxyError(400, 'invalid_request_error', 'model is required');
+    const betas = splitBetas(betaHeader);
+    const body = { ...rest, anthropic_version: ANTHROPIC_VERSION };
+    if (betas.length > 0)
+        body.anthropic_beta = betas;
+    return { modelId: mapModel(model, cfg), stream: stream === true, body, betas };
+}
+export function errorKind(status, errorType) {
+    if (status === 429 || errorType === 'ThrottlingException')
+        return 'rate_limit_error';
+    if (status === 400)
+        return 'invalid_request_error';
+    if (status === 401)
+        return 'authentication_error';
+    if (status === 403)
+        return 'permission_error';
+    if (status === 404)
+        return 'not_found_error';
+    if (status === 503)
+        return 'overloaded_error';
+    return 'api_error';
+}
+function sendError(res, status, kind, message) {
+    res.writeHead(status, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ type: 'error', error: { type: kind, message } }));
+}
+async function readBody(req) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        const buf = chunk;
+        total += buf.length;
+        if (total > BODY_MAX)
+            throw new ProxyError(413, 'invalid_request_error', 'request too large');
+        chunks.push(buf);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        throw new ProxyError(400, 'invalid_request_error', 'body must be JSON');
+    }
+}
+async function relayError(upstream, res) {
+    const text = await upstream.text();
+    const kind = errorKind(upstream.status, upstream.headers.get('x-amzn-errortype'));
+    sendError(res, upstream.status, kind, upstreamMessage(text));
+}
+function eventTypeOf(event) {
+    try {
+        const parsed = JSON.parse(event);
+        return typeof parsed.type === 'string' ? parsed.type : 'message';
+    }
+    catch {
+        return 'message';
+    }
+}
+function writeEvent(res, message) {
+    if (message.headers[':message-type'] === 'event') {
+        const parsed = JSON.parse(message.payload.toString('utf8'));
+        if (typeof parsed.bytes !== 'string')
+            return;
+        const event = Buffer.from(parsed.bytes, 'base64').toString('utf8');
+        res.write(`event: ${eventTypeOf(event)}\ndata: ${event}\n\n`);
+        return;
+    }
+    const errorType = message.headers[':exception-type'] ?? message.headers[':error-code'] ?? null;
+    const body = {
+        type: 'error',
+        error: {
+            type: errorKind(500, errorType),
+            message: upstreamMessage(message.payload.toString('utf8')),
+        },
+    };
+    res.write(`event: error\ndata: ${JSON.stringify(body)}\n\n`);
+}
+async function relayStream(upstream, res) {
+    res.writeHead(200, {
+        'content-type': 'text/event-stream',
+        'cache-control': 'no-store',
+        connection: 'keep-alive',
+    });
+    const body = upstream.body;
+    if (body === null) {
+        res.end();
+        return;
+    }
+    const decoder = new EventStreamDecoder();
+    const reader = body.getReader();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        for (const message of decoder.push(Buffer.from(value)))
+            writeEvent(res, message);
+    }
+    res.end();
+}
+async function relayJson(upstream, res) {
+    const text = await upstream.text();
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(text);
+}
+async function handleMessages(req, res, up) {
+    const rewritten = rewriteBody(await readBody(req), req.headers['anthropic-beta'], up.cfg);
+    const controller = new AbortController();
+    res.on('close', () => {
+        if (!res.writableEnded)
+            controller.abort();
+    });
+    const upstream = await invoke(up, rewritten, controller.signal);
+    if (!upstream.ok) {
+        await relayError(upstream, res);
+        return;
+    }
+    if (rewritten.stream)
+        await relayStream(upstream, res);
+    else
+        await relayJson(upstream, res);
+}
+function estimateTokens(body) {
+    return Math.ceil(JSON.stringify(body).length / 4);
+}
+async function handleCount(req, res, up) {
+    const rewritten = rewriteBody(await readBody(req), req.headers['anthropic-beta'], up.cfg);
+    const controller = new AbortController();
+    const upstream = await callBedrock(up, invokeUrl(up, rewritten.modelId, 'count-tokens'), { input: { invokeModel: { body: JSON.stringify(rewritten.body) } } }, 'application/json', controller.signal);
+    const text = await upstream.text();
+    let counted = null;
+    if (upstream.ok) {
+        const parsed = JSON.parse(text);
+        if (typeof parsed.inputTokens === 'number')
+            counted = parsed.inputTokens;
+    }
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ input_tokens: counted ?? estimateTokens(rewritten.body) }));
+}
+function presentedToken(req) {
+    const auth = req.headers.authorization ?? '';
+    if (auth.toLowerCase().startsWith('bearer '))
+        return auth.slice(7).trim();
+    const key = req.headers['x-api-key'];
+    return Array.isArray(key) ? (key[0] ?? '') : (key ?? '');
+}
+async function route(req, res, cfg, opts, learned) {
+    if (presentedToken(req) !== opts.token)
+        throw new ProxyError(401, 'authentication_error', 'unauthorized');
+    const path = (req.url ?? '').split('?')[0] ?? '';
+    const up = { cfg, base: upstreamBase(cfg, opts.upstream), learned };
+    if (req.method === 'POST' && path === MESSAGES_PATH)
+        return handleMessages(req, res, up);
+    if (req.method === 'POST' && path === COUNT_PATH)
+        return handleCount(req, res, up);
+    throw new ProxyError(404, 'not_found_error', 'not found');
+}
+function failed(res, err) {
+    if (res.headersSent) {
+        res.end();
+        return;
+    }
+    if (err instanceof ProxyError) {
+        sendError(res, err.status, err.kind, err.message);
+        return;
+    }
+    const message = err instanceof Error ? err.message : 'proxy failure';
+    sendError(res, 502, 'api_error', `metro bedrock proxy: ${message}`);
+}
+export function startBedrockProxy(cfg, opts) {
+    const learned = freshAdaptations();
+    const server = createServer((req, res) => {
+        route(req, res, cfg, opts, learned).catch((err) => {
+            failed(res, err);
+        });
+    });
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(opts.port ?? 0, '127.0.0.1', () => {
+            const address = server.address();
+            const port = typeof address === 'object' && address !== null ? address.port : 0;
+            resolve({
+                port,
+                server,
+                learned,
+                close: () => new Promise((done) => {
+                    server.close(() => {
+                        done();
+                    });
+                }),
+            });
+        });
+    });
+}

package/dist/bedrock-upstream.js

@@ -0,0 +1,72 @@
+export const freshAdaptations = () => ({
+    fields: new Set(),
+    dropBetas: false,
+});
+const EXTRA_INPUT_RE = /^([A-Za-z0-9_]+)(?:\.[^:]*)?: Extra inputs are not permitted/;
+const MAX_REPAIRS = 4;
+export function invokeUrl(up, modelId, action) {
+    return `${up.base}/model/${encodeURIComponent(modelId)}/${action}`;
+}
+export function callBedrock(up, url, body, accept, signal) {
+    return fetch(url, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${up.cfg.bearerToken}`,
+            'content-type': 'application/json',
+            accept,
+        },
+        body: JSON.stringify(body),
+        signal,
+    });
+}
+export function upstreamMessage(text) {
+    const fallback = text === '' ? 'Bedrock returned no body' : text;
+    try {
+        const parsed = JSON.parse(text);
+        const message = parsed.message ?? parsed.Message;
+        return typeof message === 'string' && message !== '' ? message : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+const without = (body, keys) => Object.fromEntries(Object.entries(body).filter(([key]) => !keys.has(key)));
+function applyLearned(req, learned) {
+    const dropped = new Set(learned.fields);
+    if (learned.dropBetas)
+        dropped.add('anthropic_beta');
+    return {
+        body: without(req.body, dropped),
+        betas: learned.dropBetas ? [] : req.betas,
+    };
+}
+function repair(attempt, learned, message) {
+    const named = EXTRA_INPUT_RE.exec(message)?.[1];
+    if (named !== undefined && named in attempt.body) {
+        learned.fields.add(named);
+        process.stderr.write(`metro bedrock: Bedrock refused "${named}" (extra input); dropping it from every request\n`);
+        return { body: without(attempt.body, new Set([named])), betas: attempt.betas };
+    }
+    if (attempt.betas.length > 0) {
+        learned.dropBetas = true;
+        process.stderr.write(`metro bedrock: retrying without anthropic_beta [${attempt.betas.join(', ')}]\n`);
+        return { body: without(attempt.body, new Set(['anthropic_beta'])), betas: [] };
+    }
+    return null;
+}
+export async function invoke(up, req, signal) {
+    const action = req.stream ? 'invoke-with-response-stream' : 'invoke';
+    const accept = req.stream ? 'application/vnd.amazon.eventstream' : 'application/json';
+    const url = invokeUrl(up, req.modelId, action);
+    let attempt = applyLearned(req, up.learned);
+    for (let repairs = 0;; repairs += 1) {
+        const res = await callBedrock(up, url, attempt.body, accept, signal);
+        if (res.status !== 400 || repairs >= MAX_REPAIRS)
+            return res;
+        const text = await res.text();
+        const next = repair(attempt, up.learned, upstreamMessage(text));
+        if (next === null)
+            return new Response(text, { status: 400, headers: res.headers });
+        attempt = next;
+    }
+}