@stage-labs/metro 0.1.0-beta.56 → 0.1.0-beta.58

package/dist/cli.js

@@ -14,9 +14,9 @@ const USAGE = `metro — run your agent on this machine
                   run the daemon: the agent, its channels and its connectors live in
                   ~/.metro/agents here, and the page at metro.box manages it through the
                   link it prints; --owner names the one wallet that may sign in (remembered
-                  after the first start); --tunnel adds a public https address through a
-                  Cloudflare quick tunnel (needs cloudflared, no account) so the link works
-                  from anywhere
+                  after the first start); --tunnel publishes the daemon through Tailscale
+                  Funnel at a permanent https://<machine>.<tailnet>.ts.net (Tailscale
+                  installed and signed in on this machine), so the link works from anywhere
   metro stop      stop the metro daemon on this machine
   metro tail <agent-id>
                   follow this machine's inbound events, one JSON line each

package/dist/serve.js

@@ -10,7 +10,7 @@ const SCRUBBED = new Set(['METRO_RUN_TOKEN', 'METRO_AGENT', 'DATABASE_URL']);
 const PORT_FLAG = /^--port=(.*)$/;
 const OWNER_FLAG = /^--owner=(.*)$/;
 const ADDRESS = /^0x[0-9a-fA-F]{40}$/;
-const USAGE = 'usage: metro serve [--port <n>] [--tunnel [quick|tailscale]] [--owner <address>]';
+const USAGE = 'usage: metro serve [--port <n>] [--tunnel] [--owner <address>]';
 const TUNNEL_FLAG = /^--tunnel=(.*)$/;
 const TAILSCALE_APP = '/Applications/Tailscale.app/Contents/MacOS/Tailscale';
 function portOf(raw) {
@@ -20,22 +20,21 @@ function portOf(raw) {
     return n;
 }
 function tunnelOf(raw) {
-    if (raw === undefined || raw === '' || raw === 'quick')
-        return 'quick';
-    if (raw === 'tailscale')
-        return 'tailscale';
-    throw new Error(`'${raw}' is not a tunnel kind (quick or tailscale) — ${USAGE}`);
+    if (raw === undefined || raw === '' || raw === 'tailscale')
+        return true;
+    throw new Error(`'${raw}' is not a tunnel metro knows; the public address is Tailscale Funnel — ${USAGE}`);
 }
 function tunnelFlag(argv, i) {
     const arg = argv[i] ?? '';
     const inline = TUNNEL_FLAG.exec(arg);
     if (inline)
-        return { kind: tunnelOf(inline[1]), consumed: 0 };
+        return { consumed: Number(tunnelOf(inline[1])) - 1 };
     if (arg !== '--tunnel')
         return null;
     const next = argv[i + 1];
     const takesValue = next !== undefined && !next.startsWith('-');
-    return { kind: tunnelOf(takesValue ? next : undefined), consumed: takesValue ? 1 : 0 };
+    tunnelOf(takesValue ? next : undefined);
+    return { consumed: takesValue ? 1 : 0 };
 }
 function ownerOf(raw) {
     if (raw === undefined || !ADDRESS.test(raw))
@@ -44,13 +43,13 @@ function ownerOf(raw) {
 }
 export function parseServeArgs(argv) {
     let port = localPort();
-    let tunnel = null;
+    let tunnel = false;
     let owner = null;
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i] ?? '';
         const tunnelArg = tunnelFlag(argv, i);
         if (tunnelArg) {
-            tunnel = tunnelArg.kind;
+            tunnel = true;
             i += tunnelArg.consumed;
             continue;
         }
@@ -111,18 +110,6 @@ export function findTailscale(candidates = ['tailscale', TAILSCALE_APP]) {
             'Funnel also has to be enabled once on your tailnet: https://tailscale.com/kb/1223/funnel');
     return bin;
 }
-function findCloudflared() {
-    const found = spawnSync('cloudflared', ['--version'], { stdio: 'ignore' });
-    if (found.error !== undefined || found.status !== 0)
-        throw new Error('metro serve --tunnel needs cloudflared, which is not on PATH.\n' +
-            'Debian/Ubuntu (it is not in the distro repos; this adds Cloudflare\'s signed one):\n' +
-            '  sudo mkdir -p --mode=0755 /usr/share/keyrings\n' +
-            '  curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null\n' +
-            "  echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list\n" +
-            '  sudo apt-get update && sudo apt-get install cloudflared\n' +
-            'macOS:  brew install cloudflared\n' +
-            'Others: https://pkg.cloudflare.com/');
-}
 export function servePlan(opts) {
     const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !SCRUBBED.has(key)));
     return {
@@ -141,7 +128,7 @@ export function servePlan(opts) {
                 ? {}
                 : { METRO_RUNTIME_STORE: opts.runtime.dir, METRO_RUNTIME_MANIFEST: opts.runtime.manifest }),
             METRO_STATE_DIR: process.env.METRO_STATE_DIR ?? serveStateDir(),
-            ...(opts.tunnel === null ? {} : { METRO_TUNNEL: opts.tunnel }),
+            ...(opts.tunnel ? { METRO_TUNNEL: 'tailscale' } : {}),
             ...(opts.tailscaleBin === undefined ? {} : { METRO_TAILSCALE_BIN: opts.tailscaleBin }),
             ...(opts.owner === null ? {} : { METRO_OWNER: opts.owner }),
         },
@@ -154,9 +141,7 @@ export function serve(argv) {
         throw new Error(`a metro serve daemon is already running on this machine (pid ${String(running)}). ` +
             'Stop it first: metro stop');
     requireOwner(owner);
-    if (tunnel === 'quick')
-        findCloudflared();
-    const tailscaleBin = tunnel === 'tailscale' ? findTailscale() : undefined;
+    const tailscaleBin = tunnel ? findTailscale() : undefined;
     process.stderr.write(`Starting a metro daemon of your own on http://127.0.0.1:${String(port)}\n`);
     return spawnPlan(() => servePlan({ runtime: prepareRuntime(), port, tunnel, owner, ...(tailscaleBin === undefined ? {} : { tailscaleBin }) }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.56",
+  "version": "0.1.0-beta.58",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/boot.ts

@@ -6,7 +6,7 @@ import { errMsg, log, logFatalSync } from './log.js';
 import { acquireLock, isLocalMode, STATE_DIR, trainsDir } from './paths.js';
 import { installCrashGuard, markDaemonReady } from './crash-guard.js';
 import { METRO_VERSION } from './version.js';
-import { driverFor, Tunnel, tunnelKind, webhookPort } from './tunnel.js';
+import { funnelDriver, Tunnel, tunnelWanted, webhookPort } from './tunnel.js';
 import {
   localConnectHint,
   publicConnectHint,
@@ -61,8 +61,7 @@ supervisor.onTrainEvent((env, train) => {
 });
 
 let webhookServer: Server | null = null;
-const tunnelWanted = tunnelKind();
-const tunnel = tunnelWanted === null ? null : new Tunnel(driverFor(tunnelWanted, webhookPort()), announcePublic);
+const tunnel = tunnelWanted() ? new Tunnel(funnelDriver(webhookPort()), announcePublic) : null;
 
 function announcePublic(url: string): void {
   process.stderr.write(`\n${publicConnectHint(url, localOwner())}`);
@@ -74,7 +73,7 @@ setTrainCallBackend((train, action, args) =>
 
 function announceLocalEndpoint(): void {
   process.stderr.write(
-    `\n${tunnelWanted === null ? localConnectHint(webhookPort(), localOwner()) : tunnelPendingHint(tunnelWanted)}`,
+    `\n${tunnel === null ? localConnectHint(webhookPort(), localOwner()) : tunnelPendingHint()}`,
   );
   const key = localAgentKey();
   if (key === null) {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connect-hint.ts

@@ -35,7 +35,5 @@ export function publicConnectHint(url: string, owner: string | null): string {
   ].join('\n');
 }
 
-export const tunnelPendingHint = (kind: 'quick' | 'tailscale'): string =>
-  kind === 'quick'
-    ? 'Bringing up a public address through a Cloudflare quick tunnel…\n'
-    : 'Publishing this daemon through Tailscale Funnel… (if Tailscale asks to enable Funnel, its link is in the log)\n';
+export const tunnelPendingHint = (): string =>
+  'Publishing this daemon through Tailscale Funnel… (if Tailscale asks to enable Funnel, its link is in the log)\n';

package/runtime/node_modules/@metro-labs/mcp/src/daemon/tunnel.ts

@@ -11,22 +11,11 @@ const RESTART_DELAY_MAX_MS = 30_000;
 const TAKEN_RE = /listener already exists/i;
 const FUNNEL_ON_RE = /\(Funnel on\)/i;
 
-export type TunnelKind = 'quick' | 'tailscale';
+export const tunnelWanted = (): boolean => process.env.METRO_TUNNEL?.trim() === 'tailscale';
 
-export function tunnelKind(): TunnelKind | null {
-  const raw = process.env.METRO_TUNNEL?.trim();
-  return raw === 'quick' || raw === 'tailscale' ? raw : null;
-}
-
-export const quickTunnelWanted = (): boolean => tunnelKind() === 'quick';
-
-const QUICK_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
 const FUNNEL_URL_RE = /https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)+\.ts\.net(?::\d{2,5})?(?=[\s/]|$)/i;
 const SILENT_MS = 20_000;
 
-export const quickTunnelUrlIn = (text: string): string | null =>
-  QUICK_URL_RE.exec(text)?.[0] ?? null;
-
 export const funnelUrlIn = (text: string): string | null =>
   FUNNEL_URL_RE.exec(text)?.[0]?.toLowerCase() ?? null;
 
@@ -69,14 +58,6 @@ export function funnelAlreadyServing(status: string, port: number): Adopted {
   return { url: null, hint: 'port 443 is held by another serve config on this node; run: tailscale serve reset' };
 }
 
-export const quickDriver = (port: number): TunnelDriver => ({
-  name: 'cloudflared quick tunnel',
-  command: 'cloudflared',
-  args: ['--no-autoupdate', 'tunnel', '--url', `http://127.0.0.1:${String(port)}`],
-  urlIn: quickTunnelUrlIn,
-  waitsForDns: true,
-});
-
 function tailscaleBin(): string {
   const configured = process.env.METRO_TAILSCALE_BIN?.trim() ?? '';
   return configured === '' ? 'tailscale' : configured;
@@ -91,27 +72,29 @@ export const funnelDriver = (port: number, bin = tailscaleBin()): TunnelDriver =
   adopt: async () => funnelAlreadyServing(await runText(bin, ['funnel', 'status']), port),
 });
 
-export const driverFor = (kind: TunnelKind, port: number): TunnelDriver =>
-  kind === 'quick' ? quickDriver(port) : funnelDriver(port);
-
 let liveUrl: string | null = null;
 
 export const currentTunnelUrl = (): string | null => liveUrl;
 
 export type Resolves = (host: string) => Promise<boolean>;
 
-const PUBLIC_RESOLVERS = ['1.1.1.1', '1.0.0.1'];
+const PUBLIC_RESOLVERS = ['1.1.1.1', '8.8.8.8'];
 const RESOLVE_EVERY_MS = 3_000;
 const RESOLVE_GIVE_UP_MS = 180_000;
 
-export async function resolvesAtCloudflare(host: string): Promise<boolean> {
+async function resolvesAt(server: string, host: string): Promise<boolean> {
   const resolver = new Resolver();
-  resolver.setServers(PUBLIC_RESOLVERS);
-  try {
-    return (await resolver.resolve4(host)).length > 0;
-  } catch {
-    return false;
-  }
+  resolver.setServers([server]);
+  const answers = await Promise.all([
+    resolver.resolve4(host).catch(() => []),
+    resolver.resolve6(host).catch(() => []),
+  ]);
+  return answers.some((a) => a.length > 0);
+}
+
+export async function resolvesPublicly(host: string): Promise<boolean> {
+  const found = await Promise.all(PUBLIC_RESOLVERS.map((server) => resolvesAt(server, host)));
+  return found.some(Boolean);
 }
 
 async function untilResolvable(host: string, resolves: Resolves): Promise<boolean> {
@@ -188,7 +171,7 @@ export class Tunnel {
   constructor(
     private driver: TunnelDriver,
     private onUrl: (url: string) => void = () => undefined,
-    private resolves: Resolves = resolvesAtCloudflare,
+    private resolves: Resolves = resolvesPublicly,
   ) {}
 
   private noticeUrl(text: string): void {

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.56"
+  "version": "0.1.0-beta.58"
 }