@stage-labs/metro 0.1.0-beta.7 → 0.1.0-beta.70

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-mode.ts

@@ -0,0 +1,184 @@
+import { ApiError } from './api-error.js';
+import { errMsg, log } from './log.js';
+import { AttachSessions } from './attach-session.js';
+import type { AgentApiDeps } from './agent-api.js';
+import { ATTACHABLE, type AccountApiDeps } from './account-api.js';
+import type { SessionApis } from './session-apis.js';
+import type { ModeInfo } from './mode-api.js';
+import { loadedAgentOf, type AgentBundle, type BundleApiDeps } from './bundle-api.js';
+import { METRO_VERSION } from './version.js';
+import type { ConnectorApiDeps } from './connector-api.js';
+import { allowLocalConnectors } from './connector-url.js';
+import { keyIdentity, type LocalCliDeps } from './local-cli-api.js';
+import type { RelayApiDeps } from './relay.js';
+import {
+  readLocalConnectors,
+  localImportConnectors,
+  localConnectorNamesByIds,
+  localCreateConnector,
+  localCreatePendingConnector,
+  localDeleteConnector,
+  localDisconnectConnector,
+  localGetConnector,
+  localListConnectors,
+  localReconnectConnector,
+  localRelayTarget,
+  localRenameConnector,
+  localVerifyConnector,
+} from '../db/local-connectors.js';
+import {
+  assertLocalOwner,
+  LOCAL_PROJECT_ID,
+  localAttachAccount,
+  localCreateAgent,
+  localDeleteAgent,
+  localDetachAccount,
+  localImportAgent,
+  localListAgents,
+  localOwnedAgentOrThrow,
+  localOwner,
+  localResetAgentKey,
+  readLocalAgentFile,
+} from '../db/file-admin.js';
+import { listAgentFiles, readAgentFile } from '../db/file-source.js';
+import type { StationName } from '../db/stations.js';
+
+export interface LocalModeDeps {
+  syncStations: (station: StationName) => Promise<void>;
+  restart: () => void;
+  stop: () => void;
+  closeAgentSession: (id: string) => Promise<boolean>;
+  gatherAccounts: AgentApiDeps['gatherAccounts'];
+  capabilities: AgentApiDeps['capabilities'];
+  liveness: AgentApiDeps['liveness'];
+  prepareAccount: AccountApiDeps['prepareAccount'];
+}
+
+function attachSessions(deps: LocalModeDeps): AttachSessions {
+  return new AttachSessions({
+    authorize: async (owner) => {
+      await localOwnedAgentOrThrow(owner.subject, owner.agentId);
+    },
+    complete: async (owner, station, config) => {
+      const ref = await localAttachAccount(owner.subject, owner.agentId, station, config);
+      const activated = await deps.syncStations(station).then(
+        () => true,
+        (err: unknown) => {
+          log.warn(
+            { station, err: errMsg(err) },
+            'attach-session: station reload failed, the change lands at the next boot',
+          );
+          return false;
+        },
+      );
+      return { accountId: ref.accountId, activated };
+    },
+  });
+}
+
+function agentApi(deps: LocalModeDeps): AgentApiDeps {
+  return {
+    attachSessions: attachSessions(deps),
+    listAgents: localListAgents,
+    createAgent: localCreateAgent,
+    deleteAgent: localDeleteAgent,
+    resetKey: async (subject, id) => {
+      const reset = await localResetAgentKey(subject, id);
+      const closed = await deps.closeAgentSession(id);
+      log.info({ agent: reset.name, id, sessionClosed: closed }, 'local: key rotated');
+      return reset;
+    },
+    gatherAccounts: deps.gatherAccounts,
+    capabilities: deps.capabilities,
+    attachable: ATTACHABLE.filter((s) => s !== 'webhook'),
+    liveness: deps.liveness,
+    connectorIds: connectorIdsOfLocalAgents,
+    prepareAccount: deps.prepareAccount,
+    attachAccount: localAttachAccount,
+    detachAccount: localDetachAccount,
+    syncStations: deps.syncStations,
+  };
+}
+
+const allConnectorIds = (): string[] => readLocalConnectors().map((c) => c.id);
+
+function connectorIdsOfLocalAgents(ids: string[]): Promise<Map<string, string[]>> {
+  const all = allConnectorIds();
+  return Promise.resolve(new Map(ids.map((id) => [id, all] as const)));
+}
+
+const connectorApi: ConnectorApiDeps = {
+  listConnectors: localListConnectors,
+  createConnector: localCreateConnector,
+  verifyConnector: localVerifyConnector,
+  disconnectConnector: localDisconnectConnector,
+  renameConnector: localRenameConnector,
+  deleteConnector: localDeleteConnector,
+  createPendingConnector: localCreatePendingConnector,
+  reconnectConnector: localReconnectConnector,
+  getConnector: localGetConnector,
+};
+
+const relayApi: RelayApiDeps = {
+  target: (connectorId, force) => localRelayTarget(connectorId, force),
+  identify: keyIdentity,
+};
+
+function agentNameOf(agentId: string): string | null {
+  return listAgentFiles()
+    .map((path) => readAgentFile(path))
+    .find((file) => file.id === agentId)?.name ?? null;
+}
+
+const localCli: LocalCliDeps = {
+  agentName: agentNameOf,
+  connectorEntries: () => localConnectorNamesByIds(allConnectorIds()),
+};
+
+function bundleApi(deps: LocalModeDeps): BundleApiDeps {
+  return {
+    bundle: async (subject, agentId) => {
+      const { agent } = await localOwnedAgentOrThrow(subject, agentId);
+      const file = readLocalAgentFile(agentId);
+      const bundle: AgentBundle = {
+        version: 1,
+        agent: { id: file.id, name: file.name, key: file.key ?? '', stations: file.stations },
+        connectors: readLocalConnectors().map((c) => ({ id: c.id, name: c.name, url: c.url, transport: c.transport, config: { ...c.config } })),
+      };
+      if (bundle.agent.key === '') throw new ApiError(`agent '${agent.name}' has no key to bundle`, 400);
+      return bundle;
+    },
+    restore: async (subject, bundle) => {
+      assertLocalOwner(subject);
+      const made = await localImportAgent(subject, loadedAgentOf(bundle));
+      const connectors = localImportConnectors(bundle.connectors);
+      for (const station of new Set(bundle.agent.stations.map((a) => a.station)))
+        await deps.syncStations(station).catch((err: unknown) => {
+          log.warn({ station, err: errMsg(err) }, 'restore: station reload failed, the change lands at the next boot');
+        });
+      return { id: made.id, name: made.name, stations: made.stations, connectors };
+    },
+  };
+}
+
+function localModeInfo(): ModeInfo {
+  return { mode: 'local', owner: localOwner(), project: LOCAL_PROJECT_ID, version: METRO_VERSION };
+}
+
+export function localSessionApis(deps: LocalModeDeps): SessionApis {
+  allowLocalConnectors(true);
+  return {
+    agentApi: agentApi(deps),
+    bundleApi: bundleApi(deps),
+    connectorApi,
+    relayApi,
+    localCli,
+    claudeApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    updateApi: { authorize: (subject) => { assertLocalOwner(subject); }, restart: deps.restart },
+    controlApi: { authorize: (subject) => { assertLocalOwner(subject); }, restart: deps.restart, stop: deps.stop },
+    machineApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    terminalApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    identity: { owner: localOwner },
+    mode: localModeInfo,
+  };
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-owner.ts

@@ -0,0 +1,14 @@
+import { localOwner, setLocalOwner } from '../db/file-admin.js';
+import { log } from './log.js';
+
+export function applyLocalOwner(): string | null {
+  const wanted = process.env.METRO_OWNER?.trim() ?? '';
+  if (wanted !== '') {
+    const address = setLocalOwner(wanted);
+    log.info({ owner: address }, 'local daemon: owner set from METRO_OWNER');
+    return address;
+  }
+  const stored = localOwner();
+  if (stored === null) log.warn('local daemon: no owner set, so no wallet can sign in; restart with metro serve --owner <address>');
+  return stored;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/log.ts

@@ -0,0 +1,42 @@
+import { writeSync } from 'node:fs';
+import pino from 'pino';
+import pinoPretty from 'pino-pretty';
+
+const stream = process.stderr.isTTY
+  ? pinoPretty({
+      colorize: true,
+      translateTime: 'HH:MM:ss',
+      ignore: 'pid,hostname,name',
+      destination: 2,
+    })
+  : pino.destination(2);
+
+export const log = pino(
+  { base: { name: 'metro' }, level: process.env.METRO_LOG_LEVEL ?? 'info' },
+  stream,
+);
+
+export const logFatalSync = (
+  fields: Record<string, unknown>,
+  msg: string,
+): void => {
+  const line = JSON.stringify({
+    level: 60,
+    time: Date.now(),
+    name: 'metro',
+    ...fields,
+    msg,
+  });
+  try {
+    writeSync(2, `${line}\n`);
+  } catch {
+    return;
+  }
+};
+
+export const errMsg = (err: unknown): string => {
+  if (err instanceof Error) return err.message;
+  if (err && typeof err === 'object' && 'message' in err)
+    return String(err.message);
+  return String(err);
+};

package/runtime/node_modules/@metro-labs/mcp/src/daemon/machine-api.ts

@@ -0,0 +1,61 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { hostname } from 'node:os';
+import { ApiError } from './api-error.js';
+import { apiFailure, apiSession, cors, sendJson } from './api-http.js';
+import { publicBaseUrl } from './attach-serve.js';
+import { claudeDir } from './claude-files.js';
+import { webhookPort } from './tunnel.js';
+import { METRO_VERSION } from './version.js';
+import { agentsDir } from '../db/file-source.js';
+import { localOwner } from '../db/file-admin.js';
+
+const PATH = '/api/server';
+
+export interface MachineApiDeps {
+  authorize: (subject: string) => void;
+  startedAt?: string;
+}
+
+const bootedAt = new Date(Date.now() - process.uptime() * 1000).toISOString();
+
+export function machineInfo(startedAt = bootedAt): Record<string, unknown> {
+  const store = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+  return {
+    version: METRO_VERSION,
+    owner: localOwner(),
+    hostname: hostname(),
+    platform: process.platform,
+    arch: process.arch,
+    port: webhookPort(),
+    publicUrl: publicBaseUrl(),
+    uptimeSeconds: Math.round(process.uptime()),
+    startedAt,
+    bun: process.versions.bun ?? null,
+    agentsDir: agentsDir(),
+    claudeDir: claudeDir(),
+    runtimeStore: store === '' ? null : store,
+  };
+}
+
+export function handleMachineRequest(req: IncomingMessage, res: ServerResponse, deps: MachineApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  apiSession(req)
+    .then((session) => {
+      if (!session) throw new ApiError('unauthorized', 401);
+      deps.authorize(session.subject);
+      sendJson(req, res, 200, machineInfo(deps.startedAt));
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'machine-api');
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/mode-api.ts

@@ -0,0 +1,32 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { cors, sendJson } from './api-http.js';
+
+const PATH = '/api/mode';
+
+export type DaemonMode = 'hosted' | 'linked' | 'local';
+
+export interface ModeInfo {
+  mode: DaemonMode;
+  owner: string | null;
+  project: string | null;
+  version: string;
+}
+
+export function handleModeRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  info: () => ModeInfo,
+): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  sendJson(req, res, 200, info());
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-client.ts

@@ -0,0 +1,159 @@
+import { createHash, randomBytes } from 'node:crypto';
+import {
+  ConnectorVerifyError,
+  type OAuthTokens,
+} from './connector-verify.js';
+import type { OAuthServer } from './oauth-discovery.js';
+import { isRecord } from './is-record.js';
+
+const TOKEN_TIMEOUT_MS = 15_000;
+const CLIENT_NAME = 'Metro';
+
+export interface OAuthClient {
+  clientId: string;
+  clientSecret?: string;
+}
+
+function refused(message: string): ConnectorVerifyError {
+  return new ConnectorVerifyError(message, 400);
+}
+
+export function newVerifier(): string {
+  return randomBytes(32).toString('base64url');
+}
+
+export function challengeOf(verifier: string): string {
+  return createHash('sha256').update(verifier).digest('base64url');
+}
+
+export async function registerClient(
+  server: OAuthServer,
+  redirectUri: string,
+): Promise<OAuthClient> {
+  if (server.registrationEndpoint === null)
+    throw refused(
+      'That server requires OAuth but does not accept client registration, so Metro cannot sign in to it.',
+    );
+  let res: Response;
+  try {
+    res = await fetch(server.registrationEndpoint, {
+      method: 'POST',
+      redirect: 'manual',
+      signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+      headers: { 'content-type': 'application/json', accept: 'application/json' },
+      body: JSON.stringify({
+        client_name: CLIENT_NAME,
+        redirect_uris: [redirectUri],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+      }),
+    });
+  } catch {
+    throw refused('Metro could not reach that server to register.');
+  }
+  const body: unknown = await res.json().catch(() => null);
+  if (!res.ok || !isRecord(body) || typeof body.client_id !== 'string')
+    throw refused('That server refused to register Metro as a client.');
+  const secret = body.client_secret;
+  return {
+    clientId: body.client_id,
+    ...(typeof secret === 'string' ? { clientSecret: secret } : {}),
+  };
+}
+
+export interface AuthorizeInput {
+  server: OAuthServer;
+  client: OAuthClient;
+  redirectUri: string;
+  state: string;
+  verifier: string;
+  resource: string;
+}
+
+export function authorizeUrl(input: AuthorizeInput): string {
+  const url = new URL(input.server.authorizationEndpoint);
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('client_id', input.client.clientId);
+  url.searchParams.set('redirect_uri', input.redirectUri);
+  url.searchParams.set('state', input.state);
+  url.searchParams.set('code_challenge', challengeOf(input.verifier));
+  url.searchParams.set('code_challenge_method', 'S256');
+  url.searchParams.set('resource', input.resource);
+  return url.toString();
+}
+
+function tokensFrom(body: Record<string, unknown>): OAuthTokens {
+  const access = body.access_token;
+  if (typeof access !== 'string' || access === '')
+    throw refused('That server did not return an access token.');
+  const refresh = body.refresh_token;
+  const expires = body.expires_in;
+  return {
+    accessToken: access,
+    ...(typeof refresh === 'string' ? { refreshToken: refresh } : {}),
+    ...(typeof expires === 'number'
+      ? { expiresAt: Date.now() + expires * 1000 }
+      : {}),
+  };
+}
+
+async function postToken(
+  server: OAuthServer,
+  client: OAuthClient,
+  form: Record<string, string>,
+): Promise<OAuthTokens> {
+  const params = new URLSearchParams({
+    ...form,
+    client_id: client.clientId,
+    ...(client.clientSecret === undefined
+      ? {}
+      : { client_secret: client.clientSecret }),
+  });
+  let res: Response;
+  try {
+    res = await fetch(server.tokenEndpoint, {
+      method: 'POST',
+      redirect: 'manual',
+      signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+      headers: {
+        'content-type': 'application/x-www-form-urlencoded',
+        accept: 'application/json',
+      },
+      body: params.toString(),
+    });
+  } catch {
+    throw refused('Metro could not reach that server to finish signing in.');
+  }
+  const body: unknown = await res.json().catch(() => null);
+  if (!res.ok || !isRecord(body))
+    throw refused('That server refused to complete the sign-in.');
+  return tokensFrom(body);
+}
+
+export function exchangeCode(
+  server: OAuthServer,
+  client: OAuthClient,
+  input: { code: string; redirectUri: string; verifier: string; resource: string },
+): Promise<OAuthTokens> {
+  return postToken(server, client, {
+    grant_type: 'authorization_code',
+    code: input.code,
+    redirect_uri: input.redirectUri,
+    code_verifier: input.verifier,
+    resource: input.resource,
+  });
+}
+
+export function refreshTokens(
+  server: OAuthServer,
+  client: OAuthClient,
+  refreshToken: string,
+  resource: string,
+): Promise<OAuthTokens> {
+  return postToken(server, client, {
+    grant_type: 'refresh_token',
+    refresh_token: refreshToken,
+    resource,
+  });
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-discovery.ts

@@ -0,0 +1,117 @@
+import { ConnectorVerifyError, parseConnectorUrl } from './connector-verify.js';
+import { isRecord } from './is-record.js';
+
+const DISCOVERY_TIMEOUT_MS = 10_000;
+
+export interface OAuthServer {
+  issuer: string;
+  authorizationEndpoint: string;
+  tokenEndpoint: string;
+  registrationEndpoint: string | null;
+  supportsS256: boolean;
+}
+
+function refused(message: string): ConnectorVerifyError {
+  return new ConnectorVerifyError(message, 400);
+}
+
+const str = (value: unknown): string =>
+  typeof value === 'string' ? value : '';
+
+async function getJson(url: URL): Promise<Record<string, unknown> | null> {
+  let res: Response;
+  try {
+    res = await fetch(url, {
+      redirect: 'manual',
+      signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),
+      headers: { accept: 'application/json' },
+    });
+  } catch {
+    return null;
+  }
+  if (!res.ok) {
+    await res.body?.cancel().catch(() => undefined);
+    return null;
+  }
+  const body: unknown = await res.json().catch(() => null);
+  return isRecord(body) ? body : null;
+}
+
+function wellKnown(base: URL, suffix: string): URL {
+  const url = new URL(base.toString());
+  url.pathname = `/.well-known/${suffix}`;
+  url.search = '';
+  url.hash = '';
+  return url;
+}
+
+export function resourceMetadataUrls(resource: URL): URL[] {
+  const path = resource.pathname.replace(/\/$/, '');
+  const urls = [wellKnown(resource, 'oauth-protected-resource')];
+  if (path !== '')
+    urls.unshift(
+      new URL(`/.well-known/oauth-protected-resource${path}`, resource.origin),
+    );
+  return urls;
+}
+
+export async function advertisesOAuth(resource: URL): Promise<boolean> {
+  for (const candidate of resourceMetadataUrls(resource)) {
+    const body = await getJson(candidate);
+    const servers: unknown = body?.authorization_servers;
+    const first: unknown = Array.isArray(servers) ? servers[0] : undefined;
+    if (typeof first === 'string' && first !== '') return true;
+  }
+  return false;
+}
+
+async function authServerFor(resource: URL): Promise<URL> {
+  for (const candidate of resourceMetadataUrls(resource)) {
+    const body = await getJson(candidate);
+    const servers: unknown = body?.authorization_servers;
+    const first: unknown = Array.isArray(servers) ? servers[0] : undefined;
+    if (typeof first === 'string' && first !== '')
+      return parseConnectorUrl(first);
+  }
+  return parseConnectorUrl(resource.origin);
+}
+
+function toServer(body: Record<string, unknown>, issuer: URL): OAuthServer {
+  const authorizationEndpoint = str(body.authorization_endpoint);
+  const tokenEndpoint = str(body.token_endpoint);
+  if (authorizationEndpoint === '' || tokenEndpoint === '')
+    throw refused(
+      `${issuer.hostname} advertises OAuth but not where to sign in.`,
+    );
+  const methods = body.code_challenge_methods_supported;
+  const registration = str(body.registration_endpoint);
+  return {
+    issuer: str(body.issuer) === '' ? issuer.origin : str(body.issuer),
+    authorizationEndpoint,
+    tokenEndpoint,
+    registrationEndpoint: registration === '' ? null : registration,
+    supportsS256: Array.isArray(methods) ? methods.includes('S256') : false,
+  };
+}
+
+export function authServerMetadataUrls(issuer: URL): URL[] {
+  const path = issuer.pathname.replace(/\/$/, '');
+  const suffixes = ['oauth-authorization-server', 'openid-configuration'];
+  const urls = suffixes.map((suffix) => wellKnown(issuer, suffix));
+  if (path === '') return urls;
+  const aware = suffixes.map(
+    (suffix) => new URL(`/.well-known/${suffix}${path}`, issuer.origin),
+  );
+  return [...aware, new URL(`${path}/.well-known/openid-configuration`, issuer.origin), ...urls];
+}
+
+export async function discoverOAuth(resource: URL): Promise<OAuthServer> {
+  const issuer = await authServerFor(resource);
+  for (const candidate of authServerMetadataUrls(issuer)) {
+    const body = await getJson(candidate);
+    if (body !== null) return toServer(body, issuer);
+  }
+  throw refused(
+    `${resource.hostname} needs authorization, but publishes no OAuth metadata Metro can use.`,
+  );
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-pending.ts

@@ -0,0 +1,65 @@
+import { randomBytes } from 'node:crypto';
+import type { OAuthClient } from './oauth-client.js';
+import type { OAuthServer } from './oauth-discovery.js';
+
+const TTL_MS = 10 * 60_000;
+const SWEEP_MS = 60_000;
+const MAX_PENDING = 100;
+
+export interface PendingAuth {
+  subject: string;
+  name: string;
+  url: string;
+  resource: string;
+  returnTo: string;
+  verifier: string;
+  server: OAuthServer;
+  client: OAuthClient;
+  connectorId: string;
+}
+
+interface Entry extends PendingAuth {
+  expiresAt: number;
+}
+
+const pending = new Map<string, Entry>();
+let sweeper: ReturnType<typeof setInterval> | null = null;
+
+function sweep(now = Date.now()): void {
+  for (const [state, entry] of pending)
+    if (entry.expiresAt <= now) pending.delete(state);
+}
+
+function ensureSweeper(): void {
+  if (sweeper !== null) return;
+  sweeper = setInterval(sweep, SWEEP_MS);
+  sweeper.unref?.();
+}
+
+export function startPending(entry: PendingAuth, now = Date.now()): string {
+  sweep(now);
+  while (pending.size >= MAX_PENDING) {
+    const oldest = pending.keys().next();
+    if (oldest.done) break;
+    pending.delete(oldest.value);
+  }
+  const state = randomBytes(32).toString('base64url');
+  pending.set(state, { ...entry, expiresAt: now + TTL_MS });
+  ensureSweeper();
+  return state;
+}
+
+export function takePending(
+  state: string,
+  now = Date.now(),
+): PendingAuth | undefined {
+  const entry = pending.get(state);
+  if (entry === undefined) return undefined;
+  pending.delete(state);
+  return entry.expiresAt > now ? entry : undefined;
+}
+
+export function pendingCount(): number {
+  sweep();
+  return pending.size;
+}