@stage-labs/metro 0.1.0-beta.7 → 0.1.0-beta.71

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-discovery.ts

@@ -0,0 +1,117 @@
+import { ConnectorVerifyError, parseConnectorUrl } from './connector-verify.js';
+import { isRecord } from './is-record.js';
+
+const DISCOVERY_TIMEOUT_MS = 10_000;
+
+export interface OAuthServer {
+  issuer: string;
+  authorizationEndpoint: string;
+  tokenEndpoint: string;
+  registrationEndpoint: string | null;
+  supportsS256: boolean;
+}
+
+function refused(message: string): ConnectorVerifyError {
+  return new ConnectorVerifyError(message, 400);
+}
+
+const str = (value: unknown): string =>
+  typeof value === 'string' ? value : '';
+
+async function getJson(url: URL): Promise<Record<string, unknown> | null> {
+  let res: Response;
+  try {
+    res = await fetch(url, {
+      redirect: 'manual',
+      signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),
+      headers: { accept: 'application/json' },
+    });
+  } catch {
+    return null;
+  }
+  if (!res.ok) {
+    await res.body?.cancel().catch(() => undefined);
+    return null;
+  }
+  const body: unknown = await res.json().catch(() => null);
+  return isRecord(body) ? body : null;
+}
+
+function wellKnown(base: URL, suffix: string): URL {
+  const url = new URL(base.toString());
+  url.pathname = `/.well-known/${suffix}`;
+  url.search = '';
+  url.hash = '';
+  return url;
+}
+
+export function resourceMetadataUrls(resource: URL): URL[] {
+  const path = resource.pathname.replace(/\/$/, '');
+  const urls = [wellKnown(resource, 'oauth-protected-resource')];
+  if (path !== '')
+    urls.unshift(
+      new URL(`/.well-known/oauth-protected-resource${path}`, resource.origin),
+    );
+  return urls;
+}
+
+export async function advertisesOAuth(resource: URL): Promise<boolean> {
+  for (const candidate of resourceMetadataUrls(resource)) {
+    const body = await getJson(candidate);
+    const servers: unknown = body?.authorization_servers;
+    const first: unknown = Array.isArray(servers) ? servers[0] : undefined;
+    if (typeof first === 'string' && first !== '') return true;
+  }
+  return false;
+}
+
+async function authServerFor(resource: URL): Promise<URL> {
+  for (const candidate of resourceMetadataUrls(resource)) {
+    const body = await getJson(candidate);
+    const servers: unknown = body?.authorization_servers;
+    const first: unknown = Array.isArray(servers) ? servers[0] : undefined;
+    if (typeof first === 'string' && first !== '')
+      return parseConnectorUrl(first);
+  }
+  return parseConnectorUrl(resource.origin);
+}
+
+function toServer(body: Record<string, unknown>, issuer: URL): OAuthServer {
+  const authorizationEndpoint = str(body.authorization_endpoint);
+  const tokenEndpoint = str(body.token_endpoint);
+  if (authorizationEndpoint === '' || tokenEndpoint === '')
+    throw refused(
+      `${issuer.hostname} advertises OAuth but not where to sign in.`,
+    );
+  const methods = body.code_challenge_methods_supported;
+  const registration = str(body.registration_endpoint);
+  return {
+    issuer: str(body.issuer) === '' ? issuer.origin : str(body.issuer),
+    authorizationEndpoint,
+    tokenEndpoint,
+    registrationEndpoint: registration === '' ? null : registration,
+    supportsS256: Array.isArray(methods) ? methods.includes('S256') : false,
+  };
+}
+
+export function authServerMetadataUrls(issuer: URL): URL[] {
+  const path = issuer.pathname.replace(/\/$/, '');
+  const suffixes = ['oauth-authorization-server', 'openid-configuration'];
+  const urls = suffixes.map((suffix) => wellKnown(issuer, suffix));
+  if (path === '') return urls;
+  const aware = suffixes.map(
+    (suffix) => new URL(`/.well-known/${suffix}${path}`, issuer.origin),
+  );
+  return [...aware, new URL(`${path}/.well-known/openid-configuration`, issuer.origin), ...urls];
+}
+
+export async function discoverOAuth(resource: URL): Promise<OAuthServer> {
+  const issuer = await authServerFor(resource);
+  for (const candidate of authServerMetadataUrls(issuer)) {
+    const body = await getJson(candidate);
+    if (body !== null) return toServer(body, issuer);
+  }
+  throw refused(
+    `${resource.hostname} needs authorization, but publishes no OAuth metadata Metro can use.`,
+  );
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-pending.ts

@@ -0,0 +1,65 @@
+import { randomBytes } from 'node:crypto';
+import type { OAuthClient } from './oauth-client.js';
+import type { OAuthServer } from './oauth-discovery.js';
+
+const TTL_MS = 10 * 60_000;
+const SWEEP_MS = 60_000;
+const MAX_PENDING = 100;
+
+export interface PendingAuth {
+  subject: string;
+  name: string;
+  url: string;
+  resource: string;
+  returnTo: string;
+  verifier: string;
+  server: OAuthServer;
+  client: OAuthClient;
+  connectorId: string;
+}
+
+interface Entry extends PendingAuth {
+  expiresAt: number;
+}
+
+const pending = new Map<string, Entry>();
+let sweeper: ReturnType<typeof setInterval> | null = null;
+
+function sweep(now = Date.now()): void {
+  for (const [state, entry] of pending)
+    if (entry.expiresAt <= now) pending.delete(state);
+}
+
+function ensureSweeper(): void {
+  if (sweeper !== null) return;
+  sweeper = setInterval(sweep, SWEEP_MS);
+  sweeper.unref?.();
+}
+
+export function startPending(entry: PendingAuth, now = Date.now()): string {
+  sweep(now);
+  while (pending.size >= MAX_PENDING) {
+    const oldest = pending.keys().next();
+    if (oldest.done) break;
+    pending.delete(oldest.value);
+  }
+  const state = randomBytes(32).toString('base64url');
+  pending.set(state, { ...entry, expiresAt: now + TTL_MS });
+  ensureSweeper();
+  return state;
+}
+
+export function takePending(
+  state: string,
+  now = Date.now(),
+): PendingAuth | undefined {
+  const entry = pending.get(state);
+  if (entry === undefined) return undefined;
+  pending.delete(state);
+  return entry.expiresAt > now ? entry : undefined;
+}
+
+export function pendingCount(): number {
+  sweep();
+  return pending.size;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/paths.ts

@@ -0,0 +1,109 @@
+import { execFileSync } from 'node:child_process';
+import {
+  closeSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  unlinkSync,
+  writeSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { log } from './log.js';
+
+export const STATE_DIR =
+  process.env.METRO_STATE_DIR ?? join(homedir(), '.cache', 'metro');
+mkdirSync(STATE_DIR, { recursive: true });
+
+
+export function trainsDir(): string {
+  const env = process.env.METRO_TRAINS_DIR?.trim();
+  if (env !== undefined && env !== '') return env;
+  return fileURLToPath(new URL('../../trains', import.meta.url));
+}
+
+export const isLocalMode = (): boolean =>
+  process.env.METRO_MODE?.trim() === 'local';
+
+function readLockPid(lockFile: string): number {
+  try {
+    return Number(readFileSync(lockFile, 'utf8').trim());
+  } catch {
+    return NaN;
+  }
+}
+
+function namesMetro(text: string): boolean {
+  return text.includes('server.ts') || text.includes('metro');
+}
+
+function holderIsMetro(pid: number): boolean {
+  try {
+    return namesMetro(readFileSync(`/proc/${pid}/cmdline`, 'utf8'));
+  } catch {
+    return holderCommand(pid);
+  }
+}
+
+function holderCommand(pid: number): boolean {
+  try {
+    return namesMetro(
+      execFileSync('ps', ['-o', 'command=', '-p', String(pid)], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+      }),
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function lockHeldByLiveDaemon(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid) return false;
+  try {
+    process.kill(pid, 0);
+  } catch {
+    return false;
+  }
+  return holderIsMetro(pid);
+}
+
+function writeOwnLock(lockFile: string): void {
+  const fd = openSync(lockFile, 'wx');
+  writeSync(fd, String(process.pid));
+  closeSync(fd);
+  process.on('exit', () => {
+    try {
+      if (readFileSync(lockFile, 'utf8').trim() === String(process.pid))
+        unlinkSync(lockFile);
+    } catch {
+    }
+  });
+}
+
+export function acquireLock(lockFile: string): void {
+  for (let attempt = 0; attempt < 5; attempt++) {
+    try {
+      writeOwnLock(lockFile);
+      return;
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err;
+      const pid = readLockPid(lockFile);
+      if (lockHeldByLiveDaemon(pid)) {
+        log.info(
+          { pid },
+          'a healthy `metro` daemon is already running; exiting (no second dispatcher)',
+        );
+        process.exit(0);
+      }
+      try {
+        unlinkSync(lockFile);
+      } catch {
+      }
+    }
+  }
+  throw new Error(
+    `metro: could not acquire dispatcher lock (${lockFile}) after retries`,
+  );
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/protocol.ts

@@ -0,0 +1,226 @@
+import { readdirSync, statSync } from 'node:fs';
+import { join, parse as parsePath } from 'node:path';
+import { errMsg, log } from './log.js';
+import { coerceErrorInfo, type TrainErrorInfo } from './train-error.js';
+import type { StructuredEvent } from './events.js';
+import type { CallMsg } from '../stations/station-runtime.js';
+
+export {
+  TrainError,
+  serializeTrainError,
+  type TrainErrorInfo,
+} from './train-error.js';
+
+const CALL_TIMEOUT_MS = 60_000;
+
+export interface Pending {
+  resolve: (r: TrainCallResponse) => void;
+  reject: (err: Error) => void;
+  timer: ReturnType<typeof setTimeout>;
+}
+export interface CallTarget {
+  name: string;
+  pending: Map<string, Pending>;
+  proc: ({ stdin?: unknown } & Record<string, unknown>) | null;
+}
+
+const STDOUT_LINE_MAX = 4 * 1024 * 1024;
+
+export type TrainEvent = {
+  station?: string;
+  line?: string;
+  line_name?: string;
+  from?: string;
+  from_name?: string;
+  from_display_name?: string;
+  to?: string;
+  message_id?: string;
+  reply_to?: string;
+  is_private?: boolean;
+  mentions_self?: boolean;
+  reply_to_self?: boolean;
+  text?: string;
+  emoji?: string;
+  payload?: unknown;
+  ts?: string;
+  id?: string;
+  event?: StructuredEvent;
+} & Record<string, unknown>;
+
+export interface TrainCallResponse {
+  result?: unknown;
+  error?: string;
+  errorInfo?: TrainErrorInfo;
+}
+
+export type TrainMessage =
+  | {
+      op: 'response';
+      id: string;
+      result?: unknown;
+      error?: string;
+      errorInfo?: TrainErrorInfo;
+    }
+  | { op: 'log'; text?: string }
+  | { op: 'event'; event: TrainEvent }
+  | { op: 'ignore' };
+
+export function parseTrainLine(
+  name: string,
+  line: string,
+): TrainMessage | null {
+  let msg: {
+    op?: string;
+    id?: string;
+    result?: unknown;
+    error?: string;
+    errorInfo?: unknown;
+    text?: string;
+  } & Record<string, unknown>;
+  try {
+    msg = JSON.parse(line) as typeof msg;
+  } catch (err) {
+    log.warn(
+      { name, err: errMsg(err), line: line.slice(0, 200) },
+      'train: bad JSON',
+    );
+    return null;
+  }
+  if (msg.op === 'response') {
+    if (typeof msg.id !== 'string') return { op: 'ignore' };
+    return {
+      op: 'response',
+      id: msg.id,
+      result: msg.result,
+      error: msg.error,
+      errorInfo: coerceErrorInfo(msg.errorInfo),
+    };
+  }
+  if (msg.op === 'log') return { op: 'log', text: msg.text };
+  if (typeof msg.line !== 'string') {
+    log.warn(
+      { name, line: line.slice(0, 200) },
+      'train: event missing `line` (string) — dropped',
+    );
+    return { op: 'ignore' };
+  }
+  return { op: 'event', event: msg };
+}
+
+export function drainLines(
+  name: string,
+  buf: string,
+  onLine: (line: string) => void,
+): string {
+  if (buf.length > STDOUT_LINE_MAX && !buf.includes('\n')) {
+    log.warn(
+      { name, bytes: buf.length },
+      'train: dropping oversized stdout line',
+    );
+    return '';
+  }
+  let nl;
+  while ((nl = buf.indexOf('\n')) !== -1) {
+    const line = buf.slice(0, nl).trim();
+    buf = buf.slice(nl + 1);
+    if (!line) continue;
+    onLine(line);
+  }
+  return buf;
+}
+
+export function readCalls(
+  name: string,
+  handleCall: (msg: CallMsg) => Promise<void>,
+): void {
+  let buf = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', (chunk: Buffer | string) => {
+    buf += typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+    buf = drainLines(name, buf, (line) => {
+      try {
+        const msg = JSON.parse(line) as Partial<CallMsg>;
+        if (msg.op === 'call')
+          handleCall(msg as CallMsg).catch((e: unknown) => {
+            process.stderr.write(`call failed: ${errMsg(e)}\n`);
+          });
+      } catch (err: unknown) {
+        process.stderr.write(`bad stdin line: ${errMsg(err)}\n`);
+      }
+    });
+  });
+}
+
+function encodeCall(id: string, action: string, args: unknown): string {
+  return JSON.stringify({ op: 'call', id, action, args }) + '\n';
+}
+
+function isTrainFile(name: string): boolean {
+  return (
+    /\.(ts|js|mjs)$/.test(name) &&
+    !name.startsWith('_') &&
+    !name.startsWith('.')
+  );
+}
+
+export function listTrainFiles(dir: string): { name: string; path: string }[] {
+  return readdirSync(dir)
+    .filter(isTrainFile)
+    .map((f) => ({ name: parsePath(f).name, path: join(dir, f) }))
+    .filter((t) => {
+      try {
+        return statSync(t.path).isFile();
+      } catch {
+        return false;
+      }
+    });
+}
+
+export function mintCallId(seq: number): string {
+  return `req_${seq}_${Math.random().toString(36).slice(2, 8)}`;
+}
+
+export function failAllPending(
+  pending: Map<string, Pending>,
+  reason: string,
+): void {
+  for (const p of pending.values()) {
+    clearTimeout(p.timer);
+    p.reject(new Error(reason));
+  }
+  pending.clear();
+}
+
+export function sendCall(
+  t: CallTarget,
+  id: string,
+  action: string,
+  args: unknown,
+): Promise<TrainCallResponse> {
+  return new Promise<TrainCallResponse>((resolve, reject) => {
+    const timer = setTimeout(() => {
+      t.pending.delete(id);
+      reject(
+        new Error(
+          `train '${t.name}' call '${action}' timed out after ${CALL_TIMEOUT_MS}ms`,
+        ),
+      );
+    }, CALL_TIMEOUT_MS);
+    t.pending.set(id, { resolve, reject, timer });
+    try {
+      const stdin = (
+        t.proc as {
+          stdin?: { write: (s: string) => void; flush: () => void };
+        } | null
+      )?.stdin;
+      if (!stdin || typeof stdin === 'number')
+        throw new Error('stdin not piped');
+      stdin.write(encodeCall(id, action, args));
+      stdin.flush();
+    } catch (err) {
+      clearTimeout(timer);
+      t.pending.delete(id);
+      reject(new Error(`train '${t.name}' stdin write failed: ${errMsg(err)}`));
+    }
+  });
+}