@stage-labs/metro 0.1.0-beta.58 → 0.1.0-beta.59

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.58",
+  "version": "0.1.0-beta.59",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/boot.ts

@@ -118,6 +118,7 @@ async function sessionApis(): Promise<SessionApis> {
       prepareAccount,
     });
   const vault = await import('../db/vault.js');
+  const servers = await import('../db/servers.js');
   return {
     vaultApi: {
       list: vault.listVaultForOwner,
@@ -125,6 +126,12 @@ async function sessionApis(): Promise<SessionApis> {
       get: vault.getVaultForOwner,
       remove: vault.deleteVaultForOwner,
     },
+    serversApi: {
+      list: servers.listServersForOwner,
+      add: servers.addServerForOwner,
+      rename: servers.renameServerForOwner,
+      remove: servers.deleteServerForOwner,
+    },
     mode: hostedMode,
   };
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/server-types.ts

@@ -0,0 +1,21 @@
+export interface ServerEntry {
+  id: string;
+  host: string;
+  name: string | null;
+  addedAt: string;
+}
+
+const HOST_RE = /^[a-z0-9][a-z0-9.-]*(?::\d{1,5})?$/;
+const HOST_MAX = 253;
+const NAME_MAX = 40;
+
+export function parseServerHost(raw: string): string | null {
+  const host = raw.trim().toLowerCase();
+  return host.length <= HOST_MAX && HOST_RE.test(host) ? host : null;
+}
+
+export function parseServerName(raw: unknown): string | null {
+  if (typeof raw !== 'string') return null;
+  const name = raw.replace(/[\p{Cc}]/gu, '').trim().slice(0, NAME_MAX);
+  return name === '' ? null : name;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/servers-api.ts

@@ -0,0 +1,80 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { log } from './log.js';
+import { apiFailure, cors, readJsonBody, sendJson } from './api-http.js';
+import { signedIdentity } from './signed-identity.js';
+import type { ServerEntry } from './server-types.js';
+import { parseId } from '../db/ids.js';
+
+const PREFIX = '/api/servers';
+
+export interface ServersApiDeps {
+  list: (subject: string) => Promise<ServerEntry[]>;
+  add: (subject: string, body: unknown) => Promise<ServerEntry>;
+  rename: (subject: string, id: string, body: unknown) => Promise<ServerEntry>;
+  remove: (subject: string, id: string) => Promise<{ id: string; host: string }>;
+}
+
+type Target = { kind: 'index' } | { kind: 'server'; id: string } | { kind: 'unknown' } | null;
+
+function target(path: string): Target {
+  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'index' };
+  if (!path.startsWith(`${PREFIX}/`)) return null;
+  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
+  const id = parseId(segments[0] ?? '');
+  return id === null || segments.length !== 1 ? { kind: 'unknown' } : { kind: 'server', id };
+}
+
+const ALLOWED: Record<'index' | 'server', string[]> = { index: ['GET', 'POST'], server: ['PUT', 'DELETE'] };
+
+async function answer(
+  req: IncomingMessage,
+  deps: ServersApiDeps,
+  owner: string,
+  tgt: { kind: 'index' } | { kind: 'server'; id: string },
+): Promise<unknown> {
+  if (tgt.kind === 'index')
+    return req.method === 'GET' ? { servers: await deps.list(owner) } : deps.add(owner, await readJsonBody(req));
+  return req.method === 'DELETE' ? deps.remove(owner, tgt.id) : deps.rename(owner, tgt.id, await readJsonBody(req));
+}
+
+async function route(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ServersApiDeps,
+  tgt: { kind: 'index' } | { kind: 'server'; id: string },
+): Promise<void> {
+  try {
+    const owner = await signedIdentity(req);
+    if (owner === null) {
+      sendJson(req, res, 401, { error: 'unauthorized' });
+      return;
+    }
+    const body = await answer(req, deps, owner, tgt);
+    if (req.method !== 'GET') log.info({ method: req.method, target: tgt }, 'servers-api: list changed');
+    sendJson(req, res, 200, body);
+  } catch (err) {
+    apiFailure(req, res, err, 'servers-api');
+  }
+}
+
+export function handleServersApiRequest(req: IncomingMessage, res: ServerResponse, deps: ServersApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  const tgt = target(path);
+  if (tgt === null) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (tgt.kind === 'unknown') {
+    sendJson(req, res, 404, { error: 'no such server' });
+    return true;
+  }
+  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  route(req, res, deps, tgt).catch((err: unknown) => {
+    apiFailure(req, res, err, 'servers-api');
+  });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-apis.ts

@@ -15,6 +15,7 @@ import { handleLocalCliRequest, type LocalCliDeps } from './local-cli-api.js';
 import { handleClaudeRequest, type ClaudeApiDeps } from './claude-api.js';
 import type { ModeInfo } from './mode-api.js';
 import { handleVaultApiRequest, type VaultApiDeps } from './vault-api.js';
+import { handleServersApiRequest, type ServersApiDeps } from './servers-api.js';
 import { handleBundleRequest, type BundleApiDeps } from './bundle-api.js';
 import { handleUpdateRequest, type UpdateApiDeps } from './update-api.js';
 
@@ -23,6 +24,7 @@ export interface SessionApis {
   agentConnectorApi?: AgentConnectorApiDeps;
   bundleApi?: BundleApiDeps;
   vaultApi?: VaultApiDeps;
+  serversApi?: ServersApiDeps;
   updateApi?: UpdateApiDeps;
   localCli?: LocalCliDeps;
   claudeApi?: ClaudeApiDeps;
@@ -46,6 +48,7 @@ export function handleSessionApis(
     ...when(apis.connectorApi, (d) => handleConnectorApiRequest(req, res, d)),
     ...when(apis.bundleApi, (d) => handleBundleRequest(req, res, d)),
     ...when(apis.vaultApi, (d) => handleVaultApiRequest(req, res, d)),
+    ...when(apis.serversApi, (d) => handleServersApiRequest(req, res, d)),
     ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),
     ...when(apis.claudeApi, (d) => handleClaudeRequest(req, res, d)),
     ...when(apis.agentConnectorApi, (d) => handleAgentConnectorRequest(req, res, d)),

package/runtime/node_modules/@metro-labs/mcp/src/daemon/tunnel.ts

@@ -40,6 +40,47 @@ const runText = (command: string, args: string[]): Promise<string> =>
     });
   });
 
+export type Probe = (url: string) => Promise<boolean>;
+
+const PROBE_MS = 5_000;
+
+export async function daemonAnswersAt(url: string): Promise<boolean> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, PROBE_MS);
+  try {
+    const res = await fetch(`${url}/api/mode`, { signal: controller.signal });
+    if (!res.ok) return false;
+    const body: unknown = await res.json();
+    return typeof body === 'object' && body !== null && (body as { mode?: unknown }).mode === 'local';
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export function nodeNameIn(statusJson: string): string | null {
+  try {
+    const parsed: unknown = JSON.parse(statusJson);
+    const self = typeof parsed === 'object' && parsed !== null ? (parsed as { Self?: { DNSName?: unknown } }).Self : undefined;
+    const name = typeof self?.DNSName === 'string' ? self.DNSName.replace(/\.$/, '').toLowerCase() : '';
+    return name === '' ? null : name;
+  } catch {
+    return null;
+  }
+}
+
+async function adoptFunnel(bin: string, port: number, probe: Probe): Promise<Adopted> {
+  const name = nodeNameIn(await runText(bin, ['status', '--json']));
+  if (name !== null) {
+    const url = `https://${name}`;
+    if (await probe(url)) return { url, hint: `a Funnel already publishes this daemon at ${url}; using it` };
+  }
+  return funnelAlreadyServing(await runText(bin, ['funnel', 'status']), port);
+}
+
 export function funnelAlreadyServing(status: string, port: number): Adopted {
   const lines = status.split('\n');
   const target = `http://127.0.0.1:${String(port)}`;
@@ -63,13 +104,13 @@ function tailscaleBin(): string {
   return configured === '' ? 'tailscale' : configured;
 }
 
-export const funnelDriver = (port: number, bin = tailscaleBin()): TunnelDriver => ({
+export const funnelDriver = (port: number, bin = tailscaleBin(), probe: Probe = daemonAnswersAt): TunnelDriver => ({
   name: 'tailscale funnel',
   command: bin,
   args: ['funnel', String(port)],
   urlIn: funnelUrlIn,
   waitsForDns: true,
-  adopt: async () => funnelAlreadyServing(await runText(bin, ['funnel', 'status']), port),
+  adopt: () => adoptFunnel(bin, port, probe),
 });
 
 let liveUrl: string | null = null;

package/runtime/node_modules/@metro-labs/mcp/src/db/schema.ts

@@ -1,4 +1,4 @@
-import { index, jsonb, pgTable, text } from 'drizzle-orm/pg-core';
+import { index, jsonb, pgTable, text, uniqueIndex } from 'drizzle-orm/pg-core';
 
 import { STATIONS, type ConnectorTransport, type StationName } from './stations.js';
 
@@ -7,8 +7,8 @@ export { STATIONS, type ConnectorTransport, type StationName };
 export type ProjectRole = 'admin' | 'member';
 
 
-export const vault = pgTable(
-  'vault',
+export const vaults = pgTable(
+  'vaults',
   {
     id: text('id').primaryKey(),
     owner: text('owner').notNull(),
@@ -17,5 +17,17 @@ export const vault = pgTable(
     envelope: jsonb('envelope').notNull(),
     syncedAt: text('synced_at').notNull(),
   },
-  (t) => [index('vault_owner_idx').on(t.owner)],
+  (t) => [index('vaults_owner_idx').on(t.owner)],
+);
+
+export const servers = pgTable(
+  'servers',
+  {
+    id: text('id').primaryKey(),
+    owner: text('owner').notNull(),
+    host: text('host').notNull(),
+    name: text('name'),
+    addedAt: text('added_at').notNull(),
+  },
+  (t) => [uniqueIndex('servers_owner_host_idx').on(t.owner, t.host), index('servers_owner_idx').on(t.owner)],
 );

package/runtime/node_modules/@metro-labs/mcp/src/db/servers.ts

@@ -0,0 +1,83 @@
+import { and, asc, eq } from 'drizzle-orm';
+import { ApiError } from '../daemon/api-error.js';
+import { isRecord } from '../daemon/is-record.js';
+import { getDb } from './client.js';
+import { newId, parseId } from './ids.js';
+import { servers } from './schema.js';
+import { normalizeAddress } from './address.js';
+import { parseServerHost, parseServerName, type ServerEntry } from '../daemon/server-types.js';
+
+export class ServerListError extends ApiError {}
+
+const missing = (): ServerListError => new ServerListError('no such server', 404);
+
+function ownerOf(subject: string): string {
+  const address = normalizeAddress(subject);
+  if (address === null) throw new ServerListError('the server list needs a signed identity', 403);
+  return address;
+}
+
+function idOf(raw: string): string {
+  const id = parseId(raw);
+  if (id === null) throw missing();
+  return id;
+}
+
+const entryOf = (row: { id: string; host: string; name: string | null; addedAt: string }): ServerEntry => ({
+  id: row.id,
+  host: row.host,
+  name: row.name,
+  addedAt: row.addedAt,
+});
+
+const columns = { id: servers.id, host: servers.host, name: servers.name, addedAt: servers.addedAt };
+
+export async function listServersForOwner(subject: string): Promise<ServerEntry[]> {
+  const owner = ownerOf(subject);
+  const rows = await getDb().select(columns).from(servers).where(eq(servers.owner, owner)).orderBy(asc(servers.addedAt));
+  return rows.map(entryOf);
+}
+
+export async function addServerForOwner(subject: string, body: unknown): Promise<ServerEntry> {
+  const owner = ownerOf(subject);
+  const host = parseServerHost(isRecord(body) && typeof body.host === 'string' ? body.host : '');
+  if (host === null) throw new ServerListError('host is not a server address', 400);
+  const name = parseServerName(isRecord(body) ? body.name : undefined);
+  const db = getDb();
+  const held = await db.select(columns).from(servers).where(and(eq(servers.owner, owner), eq(servers.host, host)));
+  const row = held[0];
+  if (row !== undefined) {
+    if (name === null) return entryOf(row);
+    await db.update(servers).set({ name }).where(eq(servers.id, row.id));
+    return entryOf({ ...row, name });
+  }
+  const next = { id: newId(), owner, host, name, addedAt: new Date().toISOString() };
+  await db.insert(servers).values(next);
+  return entryOf(next);
+}
+
+export async function renameServerForOwner(subject: string, rawId: string, body: unknown): Promise<ServerEntry> {
+  const owner = ownerOf(subject);
+  const id = idOf(rawId);
+  const name = parseServerName(isRecord(body) ? body.name : undefined);
+  const rows = await getDb()
+    .update(servers)
+    .set({ name })
+    .where(and(eq(servers.id, id), eq(servers.owner, owner)))
+    .returning(columns);
+  const row = rows[0];
+  if (row === undefined) throw missing();
+  return entryOf(row);
+}
+
+export async function deleteServerForOwner(subject: string, rawId: string): Promise<{ id: string; host: string }> {
+  const owner = ownerOf(subject);
+  const id = idOf(rawId);
+  const gone = await getDb()
+    .delete(servers)
+    .where(and(eq(servers.id, id), eq(servers.owner, owner)))
+    .returning({ id: servers.id, host: servers.host });
+  const row = gone[0];
+  if (row === undefined) throw missing();
+  return row;
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/vault.ts

@@ -3,7 +3,7 @@ import { ApiError } from '../daemon/api-error.js';
 import { isRecord } from '../daemon/is-record.js';
 import { getDb } from './client.js';
 import { AGENT_NAME_RE, parseId } from './ids.js';
-import { vault } from './schema.js';
+import { vaults } from './schema.js';
 import { STATIONS } from './stations.js';
 import { normalizeAddress } from './address.js';
 
@@ -66,10 +66,10 @@ const entryOf = (row: { id: string; name: string; stations: unknown; syncedAt: s
 export async function listVaultForOwner(subject: string): Promise<VaultEntry[]> {
   const owner = ownerOf(subject);
   const rows = await getDb()
-    .select({ id: vault.id, name: vault.name, stations: vault.stations, syncedAt: vault.syncedAt })
-    .from(vault)
-    .where(eq(vault.owner, owner))
-    .orderBy(asc(vault.name));
+    .select({ id: vaults.id, name: vaults.name, stations: vaults.stations, syncedAt: vaults.syncedAt })
+    .from(vaults)
+    .where(eq(vaults.owner, owner))
+    .orderBy(asc(vaults.name));
   return rows.map(entryOf);
 }
 
@@ -78,19 +78,19 @@ export async function putVaultForOwner(subject: string, id: string, body: unknow
   const syncedAt = new Date().toISOString();
   const values = { id, owner: input.owner, name: input.name, stations: input.stations, envelope: input.envelope, syncedAt };
   const db = getDb();
-  const held = await db.select({ owner: vault.owner }).from(vault).where(eq(vault.id, id));
+  const held = await db.select({ owner: vaults.owner }).from(vaults).where(eq(vaults.id, id));
   if (held[0] !== undefined && held[0].owner !== input.owner) throw missing();
   await db
-    .insert(vault)
+    .insert(vaults)
     .values(values)
-    .onConflictDoUpdate({ target: vault.id, set: { name: input.name, stations: input.stations, envelope: input.envelope, syncedAt } });
+    .onConflictDoUpdate({ target: vaults.id, set: { name: input.name, stations: input.stations, envelope: input.envelope, syncedAt } });
   return entryOf(values);
 }
 
 export async function getVaultForOwner(subject: string, id: string): Promise<VaultBundle> {
   const owner = ownerOf(subject);
   if (parseId(id) === null) throw missing();
-  const rows = await getDb().select().from(vault).where(and(eq(vault.id, id), eq(vault.owner, owner)));
+  const rows = await getDb().select().from(vaults).where(and(eq(vaults.id, id), eq(vaults.owner, owner)));
   const row = rows[0];
   if (row === undefined) throw missing();
   return { ...entryOf(row), envelope: isRecord(row.envelope) ? row.envelope : {} };
@@ -100,9 +100,9 @@ export async function deleteVaultForOwner(subject: string, id: string): Promise<
   const owner = ownerOf(subject);
   if (parseId(id) === null) throw missing();
   const gone = await getDb()
-    .delete(vault)
-    .where(and(eq(vault.id, id), eq(vault.owner, owner)))
-    .returning({ id: vault.id, name: vault.name });
+    .delete(vaults)
+    .where(and(eq(vaults.id, id), eq(vaults.owner, owner)))
+    .returning({ id: vaults.id, name: vaults.name });
   const row = gone[0];
   if (row === undefined) throw missing();
   return row;

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.58"
+  "version": "0.1.0-beta.59"
 }