@stage-labs/metro 0.1.0-beta.7 → 0.1.0-beta.71

package/runtime/node_modules/@metro-labs/mcp/src/daemon/train-error.ts

@@ -0,0 +1,53 @@
+export interface TrainErrorInfo {
+  code: string;
+  message: string;
+  retryable?: boolean;
+  retryAfterMs?: number;
+}
+
+export class TrainError extends Error {
+  readonly code: string;
+  readonly retryable?: boolean;
+  readonly retryAfterMs?: number;
+  constructor(
+    code: string,
+    message: string,
+    opts?: { retryable?: boolean; retryAfterMs?: number },
+  ) {
+    super(message);
+    this.name = 'TrainError';
+    this.code = code;
+    this.retryable = opts?.retryable;
+    this.retryAfterMs = opts?.retryAfterMs;
+  }
+  toErrorInfo(): TrainErrorInfo {
+    return {
+      code: this.code,
+      message: this.message,
+      ...(this.retryable !== undefined ? { retryable: this.retryable } : {}),
+      ...(this.retryAfterMs !== undefined
+        ? { retryAfterMs: this.retryAfterMs }
+        : {}),
+    };
+  }
+}
+
+export function serializeTrainError(err: unknown): {
+  error: string;
+  errorInfo?: TrainErrorInfo;
+} {
+  if (err instanceof TrainError)
+    return { error: err.message, errorInfo: err.toErrorInfo() };
+  return { error: err instanceof Error ? err.message : String(err) };
+}
+
+export function coerceErrorInfo(v: unknown): TrainErrorInfo | undefined {
+  if (!v || typeof v !== 'object') return undefined;
+  const o = v as Record<string, unknown>;
+  if (typeof o.code !== 'string' || typeof o.message !== 'string')
+    return undefined;
+  const info: TrainErrorInfo = { code: o.code, message: o.message };
+  if (typeof o.retryable === 'boolean') info.retryable = o.retryable;
+  if (typeof o.retryAfterMs === 'number') info.retryAfterMs = o.retryAfterMs;
+  return info;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/tunnel.ts

@@ -0,0 +1,352 @@
+import { execFile, spawn, type ChildProcess } from 'node:child_process';
+import { timingSafeEqual } from 'node:crypto';
+import { Resolver } from 'node:dns/promises';
+import { request as httpsRequest } from 'node:https';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { errMsg, log } from './log.js';
+import { readJson } from './secure-fs.js';
+import { localOwner } from '../db/file-admin.js';
+
+const RESTART_DELAY_MS = 2_000;
+const RESTART_DELAY_MAX_MS = 30_000;
+const TAKEN_RE = /listener already exists/i;
+const FUNNEL_ON_RE = /\(Funnel on\)/i;
+
+export const tunnelWanted = (): boolean => process.env.METRO_TUNNEL?.trim() === 'tailscale';
+
+const FUNNEL_URL_RE = /https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)+\.ts\.net(?::\d{2,5})?(?=[\s/]|$)/i;
+const SILENT_MS = 20_000;
+
+export const funnelUrlIn = (text: string): string | null =>
+  FUNNEL_URL_RE.exec(text)?.[0]?.toLowerCase() ?? null;
+
+export interface Adopted {
+  url: string | null;
+  hint: string;
+}
+
+export interface TunnelDriver {
+  name: string;
+  command: string;
+  args: string[];
+  urlIn: (text: string) => string | null;
+  waitsForDns: boolean;
+  adopt?: () => Promise<Adopted>;
+}
+
+const runText = (command: string, args: string[]): Promise<string> =>
+  new Promise((resolve) => {
+    execFile(command, args, { encoding: 'utf8', timeout: 10_000 }, (_err, stdout, stderr) => {
+      resolve(`${stdout}\n${stderr}`);
+    });
+  });
+
+export type Probe = (url: string, owner: string | null) => Promise<boolean>;
+
+const PROBE_MS = 5_000;
+
+async function publicAddresses(host: string): Promise<string[]> {
+  const found = await Promise.all(
+    PUBLIC_RESOLVERS.map(async (server) => {
+      const resolver = new Resolver();
+      resolver.setServers([server]);
+      const [v4, v6] = await Promise.all([resolver.resolve4(host).catch(() => []), resolver.resolve6(host).catch(() => [])]);
+      return [...v4, ...v6];
+    }),
+  );
+  return [...new Set(found.flat())];
+}
+
+function modeThrough(ip: string, host: string): Promise<{ mode?: unknown; owner?: unknown } | null> {
+  return new Promise((resolve) => {
+    const req = httpsRequest(
+      { host: ip, servername: host, port: 443, path: '/api/mode', method: 'GET', headers: { host }, timeout: PROBE_MS },
+      (res) => {
+        const chunks: Buffer[] = [];
+        res.on('data', (c: Buffer) => chunks.push(c));
+        res.on('end', () => {
+          try {
+            resolve(res.statusCode === 200 ? (JSON.parse(Buffer.concat(chunks).toString('utf8')) as { mode?: unknown }) : null);
+          } catch {
+            resolve(null);
+          }
+        });
+      },
+    );
+    req.on('timeout', () => {
+      req.destroy();
+    });
+    req.on('error', () => {
+      resolve(null);
+    });
+    req.end();
+  });
+}
+
+export async function daemonAnswersAt(url: string, owner: string | null): Promise<boolean> {
+  const host = new URL(url).host;
+  const addresses = await publicAddresses(host);
+  if (addresses.length === 0) return false;
+  const body = await modeThrough(addresses[0] ?? '', host);
+  return body !== null && body.mode === 'local' && (owner === null || body.owner === owner);
+}
+
+export function nodeNameIn(statusJson: string): string | null {
+  try {
+    const parsed: unknown = JSON.parse(statusJson);
+    const self = typeof parsed === 'object' && parsed !== null ? (parsed as { Self?: { DNSName?: unknown } }).Self : undefined;
+    const name = typeof self?.DNSName === 'string' ? self.DNSName.replace(/\.$/, '').toLowerCase() : '';
+    return name === '' ? null : name;
+  } catch {
+    return null;
+  }
+}
+
+async function adoptFunnel(bin: string, port: number, probe: Probe, owner: () => string | null): Promise<Adopted> {
+  const name = nodeNameIn(await runText(bin, ['status', '--json']));
+  if (name !== null) {
+    const url = `https://${name}`;
+    if (await probe(url, owner())) return { url, hint: `a Funnel already publishes this daemon at ${url}; using it` };
+  }
+  return funnelAlreadyServing(await runText(bin, ['funnel', 'status']), port);
+}
+
+export function funnelAlreadyServing(status: string, port: number): Adopted {
+  const lines = status.split('\n');
+  const target = `http://127.0.0.1:${String(port)}`;
+  for (const [i, line] of lines.entries()) {
+    if (line.trimStart().startsWith('#')) continue;
+    const url = funnelUrlIn(line);
+    if (url === null) continue;
+    const body = lines.slice(i + 1, i + 6).join('\n');
+    if (!body.includes(target)) continue;
+    if (FUNNEL_ON_RE.test(line)) return { url, hint: `a Funnel already publishes this daemon at ${url}; using it` };
+    return {
+      url: null,
+      hint: `${url} is a tailnet-only serve config on this node, not a Funnel; run: tailscale serve reset`,
+    };
+  }
+  return { url: null, hint: 'port 443 is held by another serve config on this node; run: tailscale serve reset' };
+}
+
+function tailscaleBin(): string {
+  const configured = process.env.METRO_TAILSCALE_BIN?.trim() ?? '';
+  return configured === '' ? 'tailscale' : configured;
+}
+
+export const funnelDriver = (
+  port: number,
+  bin = tailscaleBin(),
+  probe: Probe = daemonAnswersAt,
+  owner: () => string | null = localOwner,
+): TunnelDriver => ({
+  name: 'tailscale funnel',
+  command: bin,
+  args: ['funnel', String(port)],
+  urlIn: funnelUrlIn,
+  waitsForDns: true,
+  adopt: () => adoptFunnel(bin, port, probe, owner),
+});
+
+let liveUrl: string | null = null;
+
+export const currentTunnelUrl = (): string | null => liveUrl;
+
+export type Resolves = (host: string) => Promise<boolean>;
+
+const PUBLIC_RESOLVERS = ['1.1.1.1', '8.8.8.8'];
+const RESOLVE_EVERY_MS = 3_000;
+const RESOLVE_GIVE_UP_MS = 180_000;
+
+async function resolvesAt(server: string, host: string): Promise<boolean> {
+  const resolver = new Resolver();
+  resolver.setServers([server]);
+  const answers = await Promise.all([
+    resolver.resolve4(host).catch(() => []),
+    resolver.resolve6(host).catch(() => []),
+  ]);
+  return answers.some((a) => a.length > 0);
+}
+
+export async function resolvesPublicly(host: string): Promise<boolean> {
+  const found = await Promise.all(PUBLIC_RESOLVERS.map((server) => resolvesAt(server, host)));
+  return found.some(Boolean);
+}
+
+async function untilResolvable(host: string, resolves: Resolves): Promise<boolean> {
+  const deadline = Date.now() + RESOLVE_GIVE_UP_MS;
+  while (Date.now() < deadline) {
+    if (await resolves(host)) return true;
+    await new Promise((r) => setTimeout(r, RESOLVE_EVERY_MS));
+  }
+  return false;
+}
+
+export interface Endpoint {
+  id: string;
+  webhookId?: string;
+  label: string;
+  secret?: string;
+  createdAt: string;
+}
+interface AccountRecord {
+  id?: unknown;
+  webhookId?: unknown;
+  label?: unknown;
+  secret?: unknown;
+  createdAt?: unknown;
+}
+
+export const webhookPort = (): number =>
+  Number(process.env.METRO_WEBHOOK_PORT) || 8420;
+
+const accountsFile = (): string =>
+  process.env.WEBHOOK_ACCOUNTS_FILE ??
+  join(homedir(), '.metro', 'webhook-accounts.json');
+
+const str = (v: unknown): string | undefined =>
+  typeof v === 'string' && v !== '' ? v : undefined;
+
+function toEndpoint(raw: AccountRecord): Endpoint | null {
+  const id = str(raw.id);
+  if (id === undefined) return null;
+  return {
+    id,
+    webhookId: str(raw.webhookId),
+    label: str(raw.label) ?? id,
+    secret: str(raw.secret),
+    createdAt: str(raw.createdAt) ?? '',
+  };
+}
+
+export function listEndpoints(): Endpoint[] {
+  const raw = readJson<AccountRecord[]>(accountsFile(), [], {
+    warn: 'webhook-accounts.json: malformed, ignoring',
+  });
+  if (!Array.isArray(raw)) return [];
+  return raw.map(toEndpoint).filter((e): e is Endpoint => e !== null);
+}
+
+export const findEndpointByWebhookId = (
+  webhookId: string,
+): Endpoint | undefined =>
+  listEndpoints().find((e) => e.webhookId === webhookId);
+
+export function tokenMatches(secret: string, given: string): boolean {
+  const want = Buffer.from(secret);
+  const got = Buffer.from(given);
+  return want.length === got.length && timingSafeEqual(want, got);
+}
+
+export class Tunnel {
+  private child: ChildProcess | null = null;
+  private closed = false;
+  private output: string[] = [];
+  private restartDelay = RESTART_DELAY_MS;
+
+  constructor(
+    private driver: TunnelDriver,
+    private onUrl: (url: string) => void = () => undefined,
+    private resolves: Resolves = resolvesPublicly,
+  ) {}
+
+  private noticeUrl(text: string): void {
+    const url = this.driver.urlIn(text);
+    if (url === null || url === liveUrl) return;
+    liveUrl = url;
+    this.restartDelay = RESTART_DELAY_MS;
+    if (!this.driver.waitsForDns) {
+      log.info({ url }, `${this.driver.name} up`);
+      this.onUrl(url);
+      return;
+    }
+    log.info({ url }, `${this.driver.name} up; waiting for its name to resolve`);
+    this.announceWhenResolvable(url).catch((err: unknown) => {
+      log.warn({ err: errMsg(err) }, `${this.driver.name}: announce failed`);
+    });
+  }
+
+  private async announceWhenResolvable(url: string): Promise<void> {
+    const resolved = await untilResolvable(new URL(url).host, this.resolves);
+    if (liveUrl !== url) return;
+    if (!resolved) log.warn({ url }, `${this.driver.name} name still not resolving; announcing anyway`);
+    this.onUrl(url);
+  }
+
+  private read(d: Buffer | string): void {
+    const text = (typeof d === 'string' ? d : d.toString('utf8')).trim();
+    if (text === '') return;
+    this.output.push(text);
+    log.debug({ output: text }, this.driver.name);
+    this.noticeUrl(text);
+  }
+
+  private silentCheck(): void {
+    if (this.closed || liveUrl !== null || this.child === null) return;
+    log.warn(
+      { output: this.output.join('\n') },
+      `${this.driver.name}: no public address after ${String(SILENT_MS / 1000)}s; its own output follows`,
+    );
+  }
+
+  start(): void {
+    if (this.closed) return;
+    log.info({ command: this.driver.command, args: this.driver.args }, `${this.driver.name} starting`);
+    this.output = [];
+    const child = spawn(this.driver.command, this.driver.args, { stdio: ['ignore', 'pipe', 'pipe'] });
+    this.child = child;
+    child.stdout?.on('data', (d: Buffer | string) => {
+      this.read(d);
+    });
+    child.stderr?.on('data', (d: Buffer | string) => {
+      this.read(d);
+    });
+    setTimeout(() => {
+      this.silentCheck();
+    }, SILENT_MS).unref();
+    child.on('exit', (code) => {
+      this.child = null;
+      liveUrl = null;
+      if (this.closed) return;
+      this.afterExit(code).catch((err: unknown) => {
+        log.warn({ err: errMsg(err) }, `${this.driver.name}: exit handling failed`);
+      });
+    });
+    child.on('error', (err) => {
+      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {
+        this.closed = true;
+        log.error(
+          { command: this.driver.command },
+          `${this.driver.name}: the binary is not installed, so there is no public address; install it and restart`,
+        );
+        return;
+      }
+      log.warn({ err: errMsg(err) }, `${this.driver.name} spawn error`);
+    });
+  }
+
+  private async afterExit(code: number | null): Promise<void> {
+    const output = this.output.join('\n');
+    if (this.driver.adopt !== undefined && TAKEN_RE.test(output)) {
+      const found = await this.driver.adopt();
+      if (this.closed) return;
+      if (found.url !== null) {
+        log.info({ url: found.url }, `${this.driver.name}: ${found.hint}`);
+        this.noticeUrl(found.url);
+        return;
+      }
+      log.error({ output }, `${this.driver.name}: ${found.hint}`);
+    } else log.warn({ code, output: this.output.slice(-5).join('\n') }, `${this.driver.name} exited; restarting`);
+    setTimeout(() => {
+      this.start();
+    }, this.restartDelay);
+    this.restartDelay = Math.min(this.restartDelay * 2, RESTART_DELAY_MAX_MS);
+  }
+
+  stop(): void {
+    this.closed = true;
+    this.child?.kill('SIGINT');
+    this.child = null;
+  }
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/update-api.ts

@@ -0,0 +1,116 @@
+import { execFile } from 'node:child_process';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from './log.js';
+import { ApiError } from './api-error.js';
+import { apiFailure, apiSession, cors, sendJson } from './api-http.js';
+import { isRecord } from './is-record.js';
+import { METRO_VERSION } from './version.js';
+
+const PATH = '/api/update';
+const CHECK_TTL_MS = 10 * 60_000;
+const CHECK_TIMEOUT_MS = 30_000;
+const UPDATE_TIMEOUT_MS = 5 * 60_000;
+const RESTART_DELAY_MS = 500;
+const OUTPUT_TAIL = 800;
+
+export interface UpdateCheck {
+  current: string;
+  latest: string;
+  newer: boolean;
+}
+
+export interface UpdateResult {
+  updated: boolean;
+  version: string;
+  restarting: boolean;
+}
+
+export interface UpdateApiDeps {
+  authorize: (subject: string) => void;
+  restart: () => void;
+  cliBin?: () => string;
+}
+
+const cliBinFromEnv = (): string => process.env.METRO_CLI_BIN?.trim() ?? '';
+
+function runCli(bin: string, args: string[], timeout: number): Promise<{ stdout: string; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    execFile(process.execPath, [bin, ...args], { timeout, maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+      if (err === null) resolve({ stdout, stderr });
+      else reject(new ApiError(`metro update failed: ${(stderr || err.message).trim().slice(-OUTPUT_TAIL)}`, 502));
+    });
+  });
+}
+
+let cached: { at: number; check: UpdateCheck } | null = null;
+
+function parseCheck(raw: string): UpdateCheck {
+  let body: unknown;
+  try {
+    body = JSON.parse(raw.trim().split('\n').at(-1) ?? '');
+  } catch {
+    throw new ApiError('metro update --check returned no report', 502);
+  }
+  if (!isRecord(body) || typeof body.current !== 'string' || typeof body.latest !== 'string')
+    throw new ApiError('metro update --check returned an unexpected report', 502);
+  return { current: body.current, latest: body.latest, newer: body.newer === true };
+}
+
+async function check(bin: string, now = Date.now()): Promise<UpdateCheck> {
+  if (cached !== null && now - cached.at < CHECK_TTL_MS) return cached.check;
+  const out = await runCli(bin, ['update', '--check'], CHECK_TIMEOUT_MS);
+  cached = { at: now, check: parseCheck(out.stdout) };
+  return cached.check;
+}
+
+async function apply(bin: string, deps: UpdateApiDeps): Promise<UpdateResult> {
+  const before = await check(bin);
+  if (!before.newer) return { updated: false, version: before.current, restarting: false };
+  const out = await runCli(bin, ['update'], UPDATE_TIMEOUT_MS);
+  cached = null;
+  log.info({ from: before.current, to: before.latest, output: out.stderr.trim().slice(-OUTPUT_TAIL) }, 'update-api: metro updated, restarting');
+  setTimeout(() => {
+    deps.restart();
+  }, RESTART_DELAY_MS).unref();
+  return { updated: true, version: before.latest, restarting: true };
+}
+
+function binOrThrow(deps: UpdateApiDeps): string {
+  const bin = (deps.cliBin ?? cliBinFromEnv)();
+  if (bin === '')
+    throw new ApiError('this daemon was not started by metro serve, so it cannot update itself: run metro update on the machine', 400);
+  return bin;
+}
+
+export function handleUpdateRequest(req: IncomingMessage, res: ServerResponse, deps: UpdateApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET' && req.method !== 'POST') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  Promise.resolve()
+    .then(async (): Promise<unknown> => {
+      const session = await apiSession(req);
+      if (!session) throw new ApiError('unauthorized', 401);
+      deps.authorize(session.subject);
+      const bin = binOrThrow(deps);
+      if (req.method === 'GET') return { ...(await check(bin)), running: METRO_VERSION };
+      return apply(bin, deps);
+    })
+    .then((body) => {
+      sendJson(req, res, 200, body);
+    })
+    .catch((err: unknown) => {
+      if (err instanceof ApiError) apiFailure(req, res, err, 'update-api');
+      else {
+        log.warn({ err: errMsg(err) }, 'update-api: request failed');
+        if (!res.headersSent) sendJson(req, res, 500, { error: 'update api failed' });
+      }
+    });
+  return true;
+}