@stage-labs/metro 0.1.0-beta.7 → 0.1.0-beta.71

package/runtime/node_modules/@metro-labs/mcp/src/daemon/relay.ts

@@ -0,0 +1,295 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RelayTarget } from '../db/connector-relay.js';
+import type { AgentIdentity } from './api-http.js';
+import { ApiError } from './api-error.js';
+import { errMsg, log } from './log.js';
+
+export interface RelayApiDeps {
+  target: (connectorId: string, force: boolean) => Promise<RelayTarget>;
+  identify: (req: IncomingMessage) => AgentIdentity | null;
+}
+
+const ID_PATH_RE = /^\/relay\/([A-Za-z0-9][A-Za-z0-9_-]{10})$/;
+const METHODS = new Set(['POST', 'GET', 'DELETE']);
+const RELAY_BODY_MAX = 8 * 1024 * 1024;
+const FIRST_BYTE_MS = 120_000;
+const PASS_REQ = [
+  'accept',
+  'content-type',
+  'mcp-session-id',
+  'mcp-protocol-version',
+  'last-event-id',
+] as const;
+const PASS_RES = [
+  'content-type',
+  'mcp-session-id',
+  'mcp-protocol-version',
+  'cache-control',
+] as const;
+
+const keepaliveMs = (): number =>
+  Number(process.env.METRO_RELAY_KEEPALIVE_MS) || 25_000;
+
+const reconnectUrl = (id: string): string =>
+  `https://metro.box/#/connector/${id}`;
+
+function answer(
+  res: ServerResponse,
+  status: number,
+  body: Record<string, unknown>,
+): void {
+  if (res.headersSent) return;
+  res.writeHead(status, { 'content-type': 'application/json' });
+  res.end(JSON.stringify(body));
+}
+
+const signinAnswer = (res: ServerResponse, id: string): void => {
+  answer(res, 424, {
+    error: 'this connector needs signing in again',
+    reconnect: reconnectUrl(id),
+  });
+};
+
+function closeIfBodyUnread(req: IncomingMessage, res: ServerResponse): void {
+  if (req.readableEnded) return;
+  const drop = (): void => {
+    req.socket?.destroy();
+  };
+  if (res.writableFinished) drop();
+  else res.once('finish', drop);
+}
+
+async function readCapped(req: IncomingMessage): Promise<Uint8Array<ArrayBuffer>> {
+  const declared = Number(req.headers['content-length']);
+  if (Number.isFinite(declared) && declared > RELAY_BODY_MAX)
+    throw new ApiError('relay body exceeds 8 MiB', 413);
+  const chunks: Buffer[] = [];
+  let total = 0;
+  for await (const chunk of req) {
+    const buf = chunk as Buffer;
+    total += buf.length;
+    if (total > RELAY_BODY_MAX)
+      throw new ApiError('relay body exceeds 8 MiB', 413);
+    chunks.push(buf);
+  }
+  const merged = Buffer.concat(chunks);
+  const out = new Uint8Array(new ArrayBuffer(merged.byteLength));
+  out.set(merged);
+  return out;
+}
+
+function upstreamHeaders(
+  req: IncomingMessage,
+  injected: Record<string, string>,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const name of PASS_REQ) {
+    const value = req.headers[name];
+    if (typeof value === 'string') out[name] = value;
+  }
+  return { ...out, ...injected };
+}
+
+async function forward(
+  req: IncomingMessage,
+  target: { url: string; headers: Record<string, string> },
+  body: Uint8Array<ArrayBuffer> | null,
+  signal: AbortSignal,
+): Promise<Response> {
+  const firstByte = setTimeout(() => {
+    log.warn({ url: target.url }, 'relay: upstream sent no response in time');
+  }, FIRST_BYTE_MS);
+  firstByte.unref?.();
+  try {
+    return await fetch(target.url, {
+      method: req.method,
+      headers: upstreamHeaders(req, target.headers),
+      ...(body === null ? {} : { body }),
+      signal,
+      redirect: 'manual',
+    });
+  } finally {
+    clearTimeout(firstByte);
+  }
+}
+
+interface Keepalive {
+  touch: () => void;
+  stop: () => void;
+}
+
+function startKeepalive(res: ServerResponse): Keepalive {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const arm = (): void => {
+    timer = setTimeout(() => {
+      try {
+        res.write(': keepalive\n\n');
+      } catch {
+        log.debug('relay: keepalive write failed');
+      }
+      arm();
+    }, keepaliveMs());
+    timer.unref?.();
+  };
+  arm();
+  return {
+    touch: (): void => {
+      if (timer) clearTimeout(timer);
+      arm();
+    },
+    stop: (): void => {
+      if (timer) clearTimeout(timer);
+    },
+  };
+}
+
+async function pumpBody(
+  res: ServerResponse,
+  body: ReadableStream<Uint8Array>,
+  touch: () => void,
+): Promise<void> {
+  const reader = body.getReader();
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) return;
+    touch();
+    const ok = res.write(value);
+    if (!ok)
+      await new Promise((resolve) => {
+        res.once('drain', resolve);
+      });
+  }
+}
+
+async function pipe(res: ServerResponse, upstream: Response): Promise<void> {
+  const headers: Record<string, string> = {};
+  for (const name of PASS_RES) {
+    const value = upstream.headers.get(name);
+    if (value !== null) headers[name] = value;
+  }
+  const sse = (headers['content-type'] ?? '').includes('text/event-stream');
+  if (sse) headers['x-accel-buffering'] = 'no';
+  res.writeHead(upstream.status, headers);
+  if (upstream.body === null) {
+    res.end();
+    return;
+  }
+  const keepalive = sse ? startKeepalive(res) : null;
+  try {
+    await pumpBody(res, upstream.body, () => keepalive?.touch());
+  } finally {
+    keepalive?.stop();
+  }
+  res.end();
+}
+
+const authFailed = (status: number): boolean =>
+  status === 401 || status === 403;
+
+type Exchanged =
+  | { kind: 'response'; upstream: Response }
+  | { kind: 'missing' }
+  | { kind: 'signin' };
+
+async function exchange(
+  req: IncomingMessage,
+  connectorId: string,
+  deps: RelayApiDeps,
+  body: Uint8Array<ArrayBuffer> | null,
+  signal: AbortSignal,
+): Promise<Exchanged> {
+  const target = await deps.target(connectorId, false);
+  if (target.kind !== 'ok') return { kind: target.kind };
+  let upstream = await forward(req, target, body, signal);
+  if (!authFailed(upstream.status)) return { kind: 'response', upstream };
+  await upstream.body?.cancel();
+  const fresh = await deps.target(connectorId, true);
+  if (fresh.kind !== 'ok') return { kind: 'signin' };
+  upstream = await forward(req, fresh, body, signal);
+  if (!authFailed(upstream.status)) return { kind: 'response', upstream };
+  await upstream.body?.cancel();
+  return { kind: 'signin' };
+}
+
+async function relayExchange(
+  req: IncomingMessage,
+  res: ServerResponse,
+  connectorId: string,
+  deps: RelayApiDeps,
+): Promise<void> {
+  const control = new AbortController();
+  const bail = (): void => {
+    if (!res.writableEnded) control.abort();
+  };
+  res.once('close', bail);
+  res.socket?.once('close', bail);
+  res.once('finish', () => {
+    res.socket?.removeListener('close', bail);
+  });
+  const body = req.method === 'POST' ? await readCapped(req) : null;
+  const out = await exchange(
+    req,
+    connectorId,
+    deps,
+    body,
+    control.signal,
+  );
+  if (out.kind === 'missing') {
+    answer(res, 404, { error: 'no such connector' });
+    return;
+  }
+  if (out.kind === 'signin') {
+    signinAnswer(res, connectorId);
+    return;
+  }
+  if (out.upstream.status >= 300 && out.upstream.status < 400) {
+    await out.upstream.body?.cancel();
+    answer(res, 502, { error: 'the connector redirected; metro does not follow' });
+    return;
+  }
+  await pipe(res, out.upstream);
+}
+
+function dispatch(
+  req: IncomingMessage,
+  res: ServerResponse,
+  connectorId: string,
+  deps: RelayApiDeps,
+): void {
+  const who = deps.identify(req);
+  if (who === null) {
+    answer(res, 401, { error: 'unauthorized' });
+    return;
+  }
+  relayExchange(req, res, connectorId, deps)
+    .catch((err: unknown) => {
+      if (err instanceof ApiError) {
+        answer(res, err.status, { error: err.message });
+      } else {
+        log.warn({ err: errMsg(err), connector: connectorId }, 'relay: failed');
+        answer(res, 502, { error: 'metro could not reach the connector' });
+        if (!res.writableEnded) res.end();
+      }
+      closeIfBodyUnread(req, res);
+    });
+}
+
+export function handleRelayRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: RelayApiDeps,
+): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== '/relay' && !path.startsWith('/relay/')) return false;
+  const match = ID_PATH_RE.exec(path);
+  if (match?.[1] === undefined) {
+    answer(res, 404, { error: 'no such connector' });
+    return true;
+  }
+  if (!METHODS.has(req.method ?? '')) {
+    answer(res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  dispatch(req, res, match[1], deps);
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/return-to.ts

@@ -0,0 +1,21 @@
+const PREVIEW = /^([a-z0-9-]+--)?metro-ui\.netlify\.app$/;
+
+export function allowedWebHost(host: string): boolean {
+  if (host === 'metro.box' || host === 'localhost' || host === '127.0.0.1')
+    return true;
+  return PREVIEW.test(host);
+}
+
+export function validateReturnTo(returnTo: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(returnTo);
+  } catch {
+    return false;
+  }
+  const host = url.hostname;
+  if (url.protocol === 'http:' && (host === 'localhost' || host === '127.0.0.1'))
+    return true;
+  if (url.protocol !== 'https:') return false;
+  return allowedWebHost(host);
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/runtime-deps.ts

@@ -0,0 +1,82 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { log } from './log.js';
+import { isRecord } from './is-record.js';
+import type { StationName } from '../db/stations.js';
+import { knownAccounts } from '../db/agent-map.js';
+
+const INSTALL_TIMEOUT_MS = 15 * 60_000;
+
+export interface RuntimeManifest {
+  core: Record<string, string>;
+  stations: Record<string, Record<string, string>>;
+}
+
+export interface RuntimeStore {
+  dir: string;
+  manifest: RuntimeManifest;
+}
+
+const ranges = (raw: unknown): Record<string, string> =>
+  isRecord(raw)
+    ? Object.fromEntries(Object.entries(raw).filter((e): e is [string, string] => typeof e[1] === 'string'))
+    : {};
+
+export function readManifest(path: string): RuntimeManifest {
+  const raw: unknown = JSON.parse(readFileSync(path, 'utf8'));
+  if (!isRecord(raw)) throw new Error(`${path} is not a runtime manifest`);
+  const stations = isRecord(raw.stations) ? raw.stations : {};
+  return {
+    core: ranges(raw.core),
+    stations: Object.fromEntries(Object.entries(stations).map(([name, deps]) => [name, ranges(deps)])),
+  };
+}
+
+export function runtimeStore(): RuntimeStore | null {
+  const dir = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+  const manifest = process.env.METRO_RUNTIME_MANIFEST?.trim() ?? '';
+  if (dir === '' || manifest === '') return null;
+  return { dir, manifest: readManifest(manifest) };
+}
+
+export function dependenciesFor(manifest: RuntimeManifest, stations: Iterable<string>): Record<string, string> {
+  const out: Record<string, string> = { ...manifest.core };
+  for (const station of new Set(stations)) Object.assign(out, manifest.stations[station] ?? {});
+  return Object.fromEntries(Object.entries(out).sort(([a], [b]) => a.localeCompare(b)));
+}
+
+const packageText = (deps: Record<string, string>): string =>
+  `${JSON.stringify({ name: 'metro-runtime', private: true, dependencies: deps }, null, 2)}\n`;
+
+function current(dir: string): string | null {
+  try {
+    return readFileSync(join(dir, 'package.json'), 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+export function installRuntime(store: RuntimeStore, stations: Iterable<string>): boolean {
+  const wanted = packageText(dependenciesFor(store.manifest, stations));
+  const installed = existsSync(join(store.dir, 'node_modules', '.metro-installed'));
+  if (installed && current(store.dir) === wanted) return false;
+  mkdirSync(store.dir, { recursive: true });
+  writeFileSync(join(store.dir, 'package.json'), wanted);
+  log.info({ dir: store.dir }, 'runtime: installing the channel SDKs this machine needs');
+  const run = spawnSync('bun', ['install', '--no-summary', '--no-progress'], {
+    cwd: store.dir,
+    stdio: ['ignore', 'inherit', 'inherit'],
+    timeout: INSTALL_TIMEOUT_MS,
+  });
+  if (run.error !== undefined || run.status !== 0)
+    throw new Error(`bun install failed in ${store.dir}: ${run.error?.message ?? `exit ${String(run.status)}`}`);
+  writeFileSync(join(store.dir, 'node_modules', '.metro-installed'), `${new Date().toISOString()}\n`);
+  return true;
+}
+
+export function ensureStationDeps(station: StationName): void {
+  const store = runtimeStore();
+  if (store === null) return;
+  installRuntime(store, [...knownAccounts().map((a) => a.station), station]);
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/secure-fs.ts

@@ -0,0 +1,57 @@
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { dirname } from 'node:path';
+import { errMsg, log } from './log.js';
+
+export function ensureSecureDir(dir: string): void {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try {
+    chmodSync(dir, 0o700);
+  } catch {
+  }
+}
+
+export function chmodIfExists(path: string, mode = 0o600): void {
+  if (!existsSync(path)) return;
+  try {
+    if ((statSync(path).mode & 0o777) !== mode) chmodSync(path, mode);
+  } catch {
+  }
+}
+
+export function writeSecure(path: string, data: string): void {
+  ensureSecureDir(dirname(path));
+  const tmp = `${path}.tmp-${process.pid}`;
+  writeFileSync(tmp, data, { mode: 0o600 });
+  try {
+    chmodSync(tmp, 0o600);
+  } catch {
+  }
+  renameSync(tmp, path);
+  chmodIfExists(path, 0o600);
+}
+
+export function readJson<T>(
+  path: string,
+  fallback: T,
+  opts?: { warn?: string },
+): T {
+  if (!existsSync(path)) return fallback;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8')) as T;
+  } catch (err) {
+    if (opts?.warn) log.warn({ err: errMsg(err), path }, opts.warn);
+    return fallback;
+  }
+}
+
+export function writeJson(path: string, value: unknown): void {
+  writeFileSync(path, JSON.stringify(value, null, 2));
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/server-types.ts

@@ -0,0 +1,21 @@
+export interface ServerEntry {
+  id: string;
+  host: string;
+  name: string | null;
+  addedAt: string;
+}
+
+const HOST_RE = /^[a-z0-9][a-z0-9.-]*(?::\d{1,5})?$/;
+const HOST_MAX = 253;
+const NAME_MAX = 40;
+
+export function parseServerHost(raw: string): string | null {
+  const host = raw.trim().toLowerCase();
+  return host.length <= HOST_MAX && HOST_RE.test(host) ? host : null;
+}
+
+export function parseServerName(raw: unknown): string | null {
+  if (typeof raw !== 'string') return null;
+  const name = raw.replace(/[\p{Cc}]/gu, '').trim().slice(0, NAME_MAX);
+  return name === '' ? null : name;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/servers-api.ts

@@ -0,0 +1,80 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { log } from './log.js';
+import { apiFailure, cors, readJsonBody, sendJson } from './api-http.js';
+import { signedIdentity } from './signed-identity.js';
+import type { ServerEntry } from './server-types.js';
+import { parseId } from '../db/ids.js';
+
+const PREFIX = '/api/servers';
+
+export interface ServersApiDeps {
+  list: (subject: string) => Promise<ServerEntry[]>;
+  add: (subject: string, body: unknown) => Promise<ServerEntry>;
+  rename: (subject: string, id: string, body: unknown) => Promise<ServerEntry>;
+  remove: (subject: string, id: string) => Promise<{ id: string; host: string }>;
+}
+
+type Target = { kind: 'index' } | { kind: 'server'; id: string } | { kind: 'unknown' } | null;
+
+function target(path: string): Target {
+  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'index' };
+  if (!path.startsWith(`${PREFIX}/`)) return null;
+  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
+  const id = parseId(segments[0] ?? '');
+  return id === null || segments.length !== 1 ? { kind: 'unknown' } : { kind: 'server', id };
+}
+
+const ALLOWED: Record<'index' | 'server', string[]> = { index: ['GET', 'POST'], server: ['PUT', 'DELETE'] };
+
+async function answer(
+  req: IncomingMessage,
+  deps: ServersApiDeps,
+  owner: string,
+  tgt: { kind: 'index' } | { kind: 'server'; id: string },
+): Promise<unknown> {
+  if (tgt.kind === 'index')
+    return req.method === 'GET' ? { servers: await deps.list(owner) } : deps.add(owner, await readJsonBody(req));
+  return req.method === 'DELETE' ? deps.remove(owner, tgt.id) : deps.rename(owner, tgt.id, await readJsonBody(req));
+}
+
+async function route(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ServersApiDeps,
+  tgt: { kind: 'index' } | { kind: 'server'; id: string },
+): Promise<void> {
+  try {
+    const owner = await signedIdentity(req);
+    if (owner === null) {
+      sendJson(req, res, 401, { error: 'unauthorized' });
+      return;
+    }
+    const body = await answer(req, deps, owner, tgt);
+    if (req.method !== 'GET') log.info({ method: req.method, target: tgt }, 'servers-api: list changed');
+    sendJson(req, res, 200, body);
+  } catch (err) {
+    apiFailure(req, res, err, 'servers-api');
+  }
+}
+
+export function handleServersApiRequest(req: IncomingMessage, res: ServerResponse, deps: ServersApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  const tgt = target(path);
+  if (tgt === null) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (tgt.kind === 'unknown') {
+    sendJson(req, res, 404, { error: 'no such server' });
+    return true;
+  }
+  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  route(req, res, deps, tgt).catch((err: unknown) => {
+    apiFailure(req, res, err, 'servers-api');
+  });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-api.ts

@@ -0,0 +1,29 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { apiFailure, apiSession, cors, sendJson } from './api-http.js';
+
+const PATH = '/api/session';
+
+export function handleSessionApiRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  apiSession(req)
+    .then((session) => {
+      if (!session) sendJson(req, res, 401, { error: 'unauthorized' });
+      else sendJson(req, res, 200, { subject: session.subject });
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'session');
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-apis.ts

@@ -0,0 +1,66 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { handleSessionApiRequest } from './session-api.js';
+import { handleAgentApiRequest, type AgentApiDeps } from './agent-api.js';
+import {
+  handleConnectorApiRequest,
+  type ConnectorApiDeps,
+} from './connector-api.js';
+import type { RelayApiDeps } from './relay.js';
+import type { IdentityRouteDeps } from './identity-routes.js';
+import { handleLocalCliRequest, type LocalCliDeps } from './local-cli-api.js';
+import { handleClaudeRequest, type ClaudeApiDeps } from './claude-api.js';
+import type { ModeInfo } from './mode-api.js';
+import { handleVaultApiRequest, type VaultApiDeps } from './vault-api.js';
+import { handleServersApiRequest, type ServersApiDeps } from './servers-api.js';
+import { handleBundleRequest, type BundleApiDeps } from './bundle-api.js';
+import { handleUpdateRequest, type UpdateApiDeps } from './update-api.js';
+import { handleControlRequest, type ControlApiDeps } from './control-api.js';
+import { handleMachineRequest, type MachineApiDeps } from './machine-api.js';
+import { handleModelRequest, type ModelApiDeps } from './model-api.js';
+import type { GatewayDeps } from '../gateway/gateway.js';
+import { handleTerminalRequest, type TerminalApiDeps } from './terminal-api.js';
+
+export interface SessionApis {
+  agentApi?: AgentApiDeps;
+  bundleApi?: BundleApiDeps;
+  vaultApi?: VaultApiDeps;
+  serversApi?: ServersApiDeps;
+  updateApi?: UpdateApiDeps;
+  controlApi?: ControlApiDeps;
+  machineApi?: MachineApiDeps;
+  modelApi?: ModelApiDeps;
+  gateway?: GatewayDeps;
+  terminalApi?: TerminalApiDeps;
+  localCli?: LocalCliDeps;
+  claudeApi?: ClaudeApiDeps;
+  connectorApi?: ConnectorApiDeps;
+  relayApi?: RelayApiDeps;
+  identity?: IdentityRouteDeps;
+  mode?: () => ModeInfo;
+}
+
+const when = <T>(dep: T | undefined, run: (dep: T) => boolean): (() => boolean)[] =>
+  dep === undefined ? [] : [() => run(dep)];
+
+export function handleSessionApis(
+  req: IncomingMessage,
+  res: ServerResponse,
+  apis: SessionApis,
+): boolean {
+  const routes: (() => boolean)[] = [
+    () => handleSessionApiRequest(req, res),
+    ...when(apis.localCli, (d) => handleLocalCliRequest(req, res, d)),
+    ...when(apis.connectorApi, (d) => handleConnectorApiRequest(req, res, d)),
+    ...when(apis.bundleApi, (d) => handleBundleRequest(req, res, d)),
+    ...when(apis.vaultApi, (d) => handleVaultApiRequest(req, res, d)),
+    ...when(apis.serversApi, (d) => handleServersApiRequest(req, res, d)),
+    ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),
+    ...when(apis.controlApi, (d) => handleControlRequest(req, res, d)),
+    ...when(apis.machineApi, (d) => handleMachineRequest(req, res, d)),
+    ...when(apis.modelApi, (d) => handleModelRequest(req, res, d)),
+    ...when(apis.terminalApi, (d) => handleTerminalRequest(req, res, d)),
+    ...when(apis.claudeApi, (d) => handleClaudeRequest(req, res, d)),
+    ...when(apis.agentApi, (d) => handleAgentApiRequest(req, res, d)),
+  ];
+  return routes.some((run) => run());
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/signed-identity.ts

@@ -0,0 +1,36 @@
+import type { IncomingMessage } from 'node:http';
+import { verifyMessage } from 'viem';
+import { normalizeAddress } from '../db/address.js';
+
+export const AUTH_SCHEME = 'Metro';
+const SKEW_MS = 5 * 60_000;
+const SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
+
+export const identityChallenge = (method: string, path: string, at: number): string =>
+  `metro-auth\n${method} ${path}\n${String(at)}`;
+
+export interface SignedHeader {
+  address: string;
+  at: number;
+  signature: `0x${string}`;
+}
+
+export function parseIdentityHeader(header: string): SignedHeader | null {
+  const [scheme, rawAddress, rawAt, signature] = header.trim().split(/\s+/);
+  if (scheme !== AUTH_SCHEME || rawAddress === undefined || rawAt === undefined || signature === undefined) return null;
+  const address = normalizeAddress(rawAddress);
+  const at = Number(rawAt);
+  if (address === null || !Number.isFinite(at) || !SIGNATURE_RE.test(signature)) return null;
+  return { address, at, signature: signature as `0x${string}` };
+}
+
+export async function signedIdentity(req: IncomingMessage, now = Date.now()): Promise<string | null> {
+  const proof = parseIdentityHeader(req.headers.authorization ?? '');
+  if (proof === null || Math.abs(now - proof.at) > SKEW_MS) return null;
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  const message = identityChallenge(req.method ?? '', path, proof.at);
+  const ok = await verifyMessage({ address: proof.address as `0x${string}`, message, signature: proof.signature }).catch(
+    () => false,
+  );
+  return ok ? proof.address : null;
+}