@stage-labs/metro 0.1.0-beta.54 → 0.1.0-beta.55

package/dist/serve.js

@@ -10,13 +10,33 @@ const SCRUBBED = new Set(['METRO_RUN_TOKEN', 'METRO_AGENT', 'DATABASE_URL']);
 const PORT_FLAG = /^--port=(.*)$/;
 const OWNER_FLAG = /^--owner=(.*)$/;
 const ADDRESS = /^0x[0-9a-fA-F]{40}$/;
-const USAGE = 'usage: metro serve [--port <n>] [--tunnel] [--owner <address>]';
+const USAGE = 'usage: metro serve [--port <n>] [--tunnel [quick|tailscale]] [--owner <address>]';
+const TUNNEL_FLAG = /^--tunnel=(.*)$/;
+const TAILSCALE_APP = '/Applications/Tailscale.app/Contents/MacOS/Tailscale';
 function portOf(raw) {
     const n = Number(raw);
     if (raw === undefined || raw === '' || !Number.isInteger(n) || n < 1 || n > 65535)
         throw new Error(`'${raw ?? ''}' is not a port — ${USAGE}`);
     return n;
 }
+function tunnelOf(raw) {
+    if (raw === undefined || raw === '' || raw === 'quick')
+        return 'quick';
+    if (raw === 'tailscale')
+        return 'tailscale';
+    throw new Error(`'${raw}' is not a tunnel kind (quick or tailscale) — ${USAGE}`);
+}
+function tunnelFlag(argv, i) {
+    const arg = argv[i] ?? '';
+    const inline = TUNNEL_FLAG.exec(arg);
+    if (inline)
+        return { kind: tunnelOf(inline[1]), consumed: 0 };
+    if (arg !== '--tunnel')
+        return null;
+    const next = argv[i + 1];
+    const takesValue = next !== undefined && !next.startsWith('-');
+    return { kind: tunnelOf(takesValue ? next : undefined), consumed: takesValue ? 1 : 0 };
+}
 function ownerOf(raw) {
     if (raw === undefined || !ADDRESS.test(raw))
         throw new Error(`'${raw ?? ''}' is not an Ethereum address — ${USAGE}`);
@@ -24,12 +44,14 @@ function ownerOf(raw) {
 }
 export function parseServeArgs(argv) {
     let port = localPort();
-    let tunnel = false;
+    let tunnel = null;
     let owner = null;
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i] ?? '';
-        if (arg === '--tunnel') {
-            tunnel = true;
+        const tunnelArg = tunnelFlag(argv, i);
+        if (tunnelArg) {
+            tunnel = tunnelArg.kind;
+            i += tunnelArg.consumed;
             continue;
         }
         const inlineOwner = OWNER_FLAG.exec(arg);
@@ -64,6 +86,31 @@ export function requireOwner(owner, dir = agentsDir()) {
         join(dir, '.owner') +
         ':\n  metro serve --owner <address>');
 }
+function tailscaleStatus(bin) {
+    const run = spawnSync(bin, ['status', '--json'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    if (run.error !== undefined || run.status !== 0)
+        return { ok: false, state: 'not running' };
+    try {
+        const parsed = JSON.parse(run.stdout);
+        return parsed.BackendState === 'Running' ? { ok: true } : { ok: false, state: String(parsed.BackendState) };
+    }
+    catch {
+        return { ok: false, state: 'unreadable' };
+    }
+}
+export function findTailscale(candidates = ['tailscale', TAILSCALE_APP]) {
+    const bin = candidates.find((c) => spawnSync(c, ['version'], { stdio: 'ignore' }).status === 0);
+    if (bin === undefined)
+        throw new Error('metro serve --tunnel tailscale needs Tailscale on this machine.\n' +
+            'macOS:  brew install --cask tailscale   (or the App Store app)\n' +
+            'Linux:  curl -fsSL https://tailscale.com/install.sh | sh\n' +
+            'Then sign the machine in:  tailscale up');
+    const status = tailscaleStatus(bin);
+    if (!status.ok)
+        throw new Error(`Tailscale is installed but this machine is not connected (${status.state}). Sign it in first:  tailscale up\n` +
+            'Funnel also has to be enabled once on your tailnet: https://tailscale.com/kb/1223/funnel');
+    return bin;
+}
 function findCloudflared() {
     const found = spawnSync('cloudflared', ['--version'], { stdio: 'ignore' });
     if (found.error !== undefined || found.status !== 0)
@@ -94,7 +141,8 @@ export function servePlan(opts) {
                 ? {}
                 : { METRO_RUNTIME_STORE: opts.runtime.dir, METRO_RUNTIME_MANIFEST: opts.runtime.manifest }),
             METRO_STATE_DIR: process.env.METRO_STATE_DIR ?? serveStateDir(),
-            ...(opts.tunnel ? { METRO_TUNNEL: 'quick' } : {}),
+            ...(opts.tunnel === null ? {} : { METRO_TUNNEL: opts.tunnel }),
+            ...(opts.tailscaleBin === undefined ? {} : { METRO_TAILSCALE_BIN: opts.tailscaleBin }),
             ...(opts.owner === null ? {} : { METRO_OWNER: opts.owner }),
         },
     };
@@ -106,8 +154,9 @@ export function serve(argv) {
         throw new Error(`a metro serve daemon is already running on this machine (pid ${String(running)}). ` +
             'Stop it first: metro stop');
     requireOwner(owner);
-    if (tunnel)
+    if (tunnel === 'quick')
         findCloudflared();
+    const tailscaleBin = tunnel === 'tailscale' ? findTailscale() : undefined;
     process.stderr.write(`Starting a metro daemon of your own on http://127.0.0.1:${String(port)}\n`);
-    return spawnPlan(() => servePlan({ runtime: prepareRuntime(), port, tunnel, owner }));
+    return spawnPlan(() => servePlan({ runtime: prepareRuntime(), port, tunnel, owner, ...(tailscaleBin === undefined ? {} : { tailscaleBin }) }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.54",
+  "version": "0.1.0-beta.55",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/boot.ts

@@ -6,7 +6,7 @@ import { errMsg, log, logFatalSync } from './log.js';
 import { acquireLock, isLocalMode, STATE_DIR, trainsDir } from './paths.js';
 import { installCrashGuard, markDaemonReady } from './crash-guard.js';
 import { METRO_VERSION } from './version.js';
-import { quickTunnelWanted, Tunnel, webhookPort } from './tunnel.js';
+import { driverFor, Tunnel, tunnelKind, webhookPort } from './tunnel.js';
 import {
   localConnectHint,
   publicConnectHint,
@@ -61,7 +61,8 @@ supervisor.onTrainEvent((env, train) => {
 });
 
 let webhookServer: Server | null = null;
-const tunnel = quickTunnelWanted() ? new Tunnel(webhookPort(), announcePublic) : null;
+const tunnelWanted = tunnelKind();
+const tunnel = tunnelWanted === null ? null : new Tunnel(driverFor(tunnelWanted, webhookPort()), announcePublic);
 
 function announcePublic(url: string): void {
   process.stderr.write(`\n${publicConnectHint(url, localOwner())}`);
@@ -73,7 +74,7 @@ setTrainCallBackend((train, action, args) =>
 
 function announceLocalEndpoint(): void {
   process.stderr.write(
-    `\n${tunnel === null ? localConnectHint(webhookPort(), localOwner()) : tunnelPendingHint()}`,
+    `\n${tunnelWanted === null ? localConnectHint(webhookPort(), localOwner()) : tunnelPendingHint(tunnelWanted)}`,
   );
   const key = localAgentKey();
   if (key === null) {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connect-hint.ts

@@ -35,5 +35,7 @@ export function publicConnectHint(url: string, owner: string | null): string {
   ].join('\n');
 }
 
-export const tunnelPendingHint = (): string =>
-  'Bringing up a public address through a Cloudflare quick tunnel…\n';
+export const tunnelPendingHint = (kind: 'quick' | 'tailscale'): string =>
+  kind === 'quick'
+    ? 'Bringing up a public address through a Cloudflare quick tunnel…\n'
+    : 'Publishing this daemon through Tailscale Funnel…\n';

package/runtime/node_modules/@metro-labs/mcp/src/daemon/tunnel.ts

@@ -8,14 +8,57 @@ import { readJson } from './secure-fs.js';
 
 const RESTART_DELAY_MS = 2_000;
 
-export const quickTunnelWanted = (): boolean =>
-  process.env.METRO_TUNNEL?.trim() === 'quick';
+export type TunnelKind = 'quick' | 'tailscale';
+
+export function tunnelKind(): TunnelKind | null {
+  const raw = process.env.METRO_TUNNEL?.trim();
+  return raw === 'quick' || raw === 'tailscale' ? raw : null;
+}
+
+export const quickTunnelWanted = (): boolean => tunnelKind() === 'quick';
 
 const QUICK_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
+const FUNNEL_URL_RE = /https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)+\.ts\.net(?::\d{2,5})?(?=[\s/]|$)/i;
+const SILENT_MS = 20_000;
 
 export const quickTunnelUrlIn = (text: string): string | null =>
   QUICK_URL_RE.exec(text)?.[0] ?? null;
 
+export const funnelUrlIn = (text: string): string | null =>
+  FUNNEL_URL_RE.exec(text)?.[0]?.toLowerCase() ?? null;
+
+export interface TunnelDriver {
+  name: string;
+  command: string;
+  args: string[];
+  urlIn: (text: string) => string | null;
+  waitsForDns: boolean;
+}
+
+export const quickDriver = (port: number): TunnelDriver => ({
+  name: 'cloudflared quick tunnel',
+  command: 'cloudflared',
+  args: ['--no-autoupdate', 'tunnel', '--url', `http://127.0.0.1:${String(port)}`],
+  urlIn: quickTunnelUrlIn,
+  waitsForDns: true,
+});
+
+function tailscaleBin(): string {
+  const configured = process.env.METRO_TAILSCALE_BIN?.trim() ?? '';
+  return configured === '' ? 'tailscale' : configured;
+}
+
+export const funnelDriver = (port: number, bin = tailscaleBin()): TunnelDriver => ({
+  name: 'tailscale funnel',
+  command: bin,
+  args: ['funnel', String(port)],
+  urlIn: funnelUrlIn,
+  waitsForDns: false,
+});
+
+export const driverFor = (kind: TunnelKind, port: number): TunnelDriver =>
+  kind === 'quick' ? quickDriver(port) : funnelDriver(port);
+
 let liveUrl: string | null = null;
 
 export const currentTunnelUrl = (): string | null => liveUrl;
@@ -104,53 +147,72 @@ export function tokenMatches(secret: string, given: string): boolean {
 export class Tunnel {
   private child: ChildProcess | null = null;
   private closed = false;
+  private output: string[] = [];
 
   constructor(
-    private port: number,
+    private driver: TunnelDriver,
     private onUrl: (url: string) => void = () => undefined,
     private resolves: Resolves = resolvesAtCloudflare,
   ) {}
 
-  private origin(): string {
-    return `http://127.0.0.1:${String(this.port)}`;
-  }
-
   private noticeUrl(text: string): void {
-    const url = quickTunnelUrlIn(text);
+    const url = this.driver.urlIn(text);
     if (url === null || url === liveUrl) return;
     liveUrl = url;
-    log.info({ url }, 'quick tunnel up; waiting for its name to resolve');
+    if (!this.driver.waitsForDns) {
+      log.info({ url }, `${this.driver.name} up`);
+      this.onUrl(url);
+      return;
+    }
+    log.info({ url }, `${this.driver.name} up; waiting for its name to resolve`);
     this.announceWhenResolvable(url).catch((err: unknown) => {
-      log.warn({ err: errMsg(err) }, 'quick tunnel: announce failed');
+      log.warn({ err: errMsg(err) }, `${this.driver.name}: announce failed`);
     });
   }
 
   private async announceWhenResolvable(url: string): Promise<void> {
     const resolved = await untilResolvable(new URL(url).host, this.resolves);
     if (liveUrl !== url) return;
-    if (!resolved) log.warn({ url }, 'quick tunnel name still not resolving; announcing anyway');
+    if (!resolved) log.warn({ url }, `${this.driver.name} name still not resolving; announcing anyway`);
     this.onUrl(url);
   }
 
+  private read(d: Buffer | string): void {
+    const text = (typeof d === 'string' ? d : d.toString('utf8')).trim();
+    if (text === '') return;
+    this.output.push(text);
+    log.debug({ output: text }, this.driver.name);
+    this.noticeUrl(text);
+  }
+
+  private silentCheck(): void {
+    if (this.closed || liveUrl !== null || this.child === null) return;
+    log.warn(
+      { output: this.output.join('\n') },
+      `${this.driver.name}: no public address after ${String(SILENT_MS / 1000)}s; its own output follows`,
+    );
+  }
+
   start(): void {
     if (this.closed) return;
-    log.info({ port: this.port }, 'cloudflared quick tunnel starting');
-    const child = spawn(
-      'cloudflared',
-      ['--no-autoupdate', 'tunnel', '--url', this.origin()],
-      { stdio: ['ignore', 'pipe', 'pipe'] },
-    );
+    log.info({ command: this.driver.command, args: this.driver.args }, `${this.driver.name} starting`);
+    this.output = [];
+    const child = spawn(this.driver.command, this.driver.args, { stdio: ['ignore', 'pipe', 'pipe'] });
     this.child = child;
+    child.stdout?.on('data', (d: Buffer | string) => {
+      this.read(d);
+    });
     child.stderr?.on('data', (d: Buffer | string) => {
-      const text = (typeof d === 'string' ? d : d.toString('utf8')).trim();
-      log.debug({ cloudflared: text }, 'cloudflared');
-      this.noticeUrl(text);
+      this.read(d);
     });
+    setTimeout(() => {
+      this.silentCheck();
+    }, SILENT_MS).unref();
     child.on('exit', (code) => {
       this.child = null;
       liveUrl = null;
       if (this.closed) return;
-      log.warn({ code }, 'cloudflared exited; restarting');
+      log.warn({ code, output: this.output.slice(-5).join('\n') }, `${this.driver.name} exited; restarting`);
       setTimeout(() => {
         this.start();
       }, RESTART_DELAY_MS);
@@ -159,17 +221,18 @@ export class Tunnel {
       if ((err as NodeJS.ErrnoException).code === 'ENOENT') {
         this.closed = true;
         log.error(
-          'cloudflared is not installed, so there is no public address; install it and restart',
+          { command: this.driver.command },
+          `${this.driver.name}: the binary is not installed, so there is no public address; install it and restart`,
         );
         return;
       }
-      log.warn({ err: errMsg(err) }, 'cloudflared spawn error');
+      log.warn({ err: errMsg(err) }, `${this.driver.name} spawn error`);
     });
   }
 
   stop(): void {
     this.closed = true;
-    this.child?.kill();
+    this.child?.kill('SIGINT');
     this.child = null;
   }
 }

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.54"
+  "version": "0.1.0-beta.55"
 }