@stage-labs/metro 0.1.0-beta.9 → 0.1.0-beta.90

package/runtime/node_modules/@metro-labs/daemon/src/routes/session.ts

@@ -0,0 +1,29 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { apiFailure, apiSession, cors, sendJson } from '@metro-labs/http/api-http';
+
+const PATH = '/api/session';
+
+export function handleSessionApiRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  apiSession(req)
+    .then((session) => {
+      if (!session) sendJson(req, res, 401, { error: 'unauthorized' });
+      else sendJson(req, res, 200, { subject: session.subject });
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'session');
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/server/control.ts

@@ -0,0 +1,64 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { apiFailure, apiSession, cors, sendJson } from '@metro-labs/http/api-http';
+import { errMsg, log } from '@metro-labs/core/log';
+
+const STOP = '/api/stop';
+const RESTART = '/api/restart';
+const EXIT_DELAY_MS = 500;
+
+export interface ControlApiDeps {
+  authorize: (subject: string) => void;
+  restart: () => void;
+  stop: () => void;
+  served?: () => boolean;
+}
+
+interface Action {
+  run: () => void;
+  body: Record<string, boolean>;
+}
+
+const servedByCli = (): boolean => (process.env.METRO_CLI_BIN?.trim() ?? '') !== '';
+
+function actionFor(path: string, deps: ControlApiDeps): Action | null {
+  if (path === STOP) return { run: deps.stop, body: { stopping: true } };
+  if (path === RESTART) return { run: deps.restart, body: { restarting: true } };
+  return null;
+}
+
+export function handleControlRequest(req: IncomingMessage, res: ServerResponse, deps: ControlApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  const action = actionFor(path, deps);
+  if (action === null) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'POST') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  Promise.resolve()
+    .then(async () => {
+      const session = await apiSession(req);
+      if (!session) throw new ApiError('unauthorized', 401);
+      deps.authorize(session.subject);
+      if (!(deps.served ?? servedByCli)())
+        throw new ApiError(
+          'this daemon was not started by metro serve, so nothing on the machine would bring it back: use the shell instead',
+          400,
+        );
+      log.info({ path, subject: session.subject }, 'control-api: requested from the page');
+      setTimeout(action.run, EXIT_DELAY_MS).unref();
+      sendJson(req, res, 200, action.body);
+    })
+    .catch((err: unknown) => {
+      if (err instanceof ApiError) apiFailure(req, res, err, 'control-api');
+      else {
+        log.warn({ err: errMsg(err) }, 'control-api: request failed');
+        if (!res.headersSent) sendJson(req, res, 500, { error: 'control api failed' });
+      }
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/server/machine.ts

@@ -0,0 +1,61 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { hostname } from 'node:os';
+import { ApiError } from '@metro-labs/http/api-error';
+import { apiFailure, apiSession, cors, sendJson } from '@metro-labs/http/api-http';
+import { publicBaseUrl } from '../files/attach-serve.js';
+import { claudeDir } from '../claude/files.js';
+import { webhookPort } from '../net/tunnel.js';
+import { METRO_VERSION } from '@metro-labs/core/version';
+import { agentsDir } from '../agents/files.js';
+import { localOwner } from '../agents/file-admin.js';
+
+const PATH = '/api/server';
+
+export interface MachineApiDeps {
+  authorize: (subject: string) => void;
+  startedAt?: string;
+}
+
+const bootedAt = new Date(Date.now() - process.uptime() * 1000).toISOString();
+
+export function machineInfo(startedAt = bootedAt): Record<string, unknown> {
+  const store = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+  return {
+    version: METRO_VERSION,
+    owner: localOwner(),
+    hostname: hostname(),
+    platform: process.platform,
+    arch: process.arch,
+    port: webhookPort(),
+    publicUrl: publicBaseUrl(),
+    uptimeSeconds: Math.round(process.uptime()),
+    startedAt,
+    bun: process.versions.bun ?? null,
+    agentsDir: agentsDir(),
+    claudeDir: claudeDir(),
+    runtimeStore: store === '' ? null : store,
+  };
+}
+
+export function handleMachineRequest(req: IncomingMessage, res: ServerResponse, deps: MachineApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  apiSession(req)
+    .then((session) => {
+      if (!session) throw new ApiError('unauthorized', 401);
+      deps.authorize(session.subject);
+      sendJson(req, res, 200, machineInfo(deps.startedAt));
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'machine-api');
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/server/update.ts

@@ -0,0 +1,116 @@
+import { execFile } from 'node:child_process';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { apiFailure, apiSession, cors, sendJson } from '@metro-labs/http/api-http';
+import { isRecord } from '@metro-labs/core/is-record';
+import { METRO_VERSION } from '@metro-labs/core/version';
+
+const PATH = '/api/update';
+const CHECK_TTL_MS = 10 * 60_000;
+const CHECK_TIMEOUT_MS = 30_000;
+const UPDATE_TIMEOUT_MS = 5 * 60_000;
+const RESTART_DELAY_MS = 500;
+const OUTPUT_TAIL = 800;
+
+export interface UpdateCheck {
+  current: string;
+  latest: string;
+  newer: boolean;
+}
+
+export interface UpdateResult {
+  updated: boolean;
+  version: string;
+  restarting: boolean;
+}
+
+export interface UpdateApiDeps {
+  authorize: (subject: string) => void;
+  restart: () => void;
+  cliBin?: () => string;
+}
+
+const cliBinFromEnv = (): string => process.env.METRO_CLI_BIN?.trim() ?? '';
+
+function runCli(bin: string, args: string[], timeout: number): Promise<{ stdout: string; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    execFile(process.execPath, [bin, ...args], { timeout, maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+      if (err === null) resolve({ stdout, stderr });
+      else reject(new ApiError(`metro update failed: ${(stderr || err.message).trim().slice(-OUTPUT_TAIL)}`, 502));
+    });
+  });
+}
+
+let cached: { at: number; check: UpdateCheck } | null = null;
+
+function parseCheck(raw: string): UpdateCheck {
+  let body: unknown;
+  try {
+    body = JSON.parse(raw.trim().split('\n').at(-1) ?? '');
+  } catch {
+    throw new ApiError('metro update --check returned no report', 502);
+  }
+  if (!isRecord(body) || typeof body.current !== 'string' || typeof body.latest !== 'string')
+    throw new ApiError('metro update --check returned an unexpected report', 502);
+  return { current: body.current, latest: body.latest, newer: body.newer === true };
+}
+
+async function check(bin: string, now = Date.now()): Promise<UpdateCheck> {
+  if (cached !== null && now - cached.at < CHECK_TTL_MS) return cached.check;
+  const out = await runCli(bin, ['update', '--check'], CHECK_TIMEOUT_MS);
+  cached = { at: now, check: parseCheck(out.stdout) };
+  return cached.check;
+}
+
+async function apply(bin: string, deps: UpdateApiDeps): Promise<UpdateResult> {
+  const before = await check(bin);
+  if (!before.newer) return { updated: false, version: before.current, restarting: false };
+  const out = await runCli(bin, ['update'], UPDATE_TIMEOUT_MS);
+  cached = null;
+  log.info({ from: before.current, to: before.latest, output: out.stderr.trim().slice(-OUTPUT_TAIL) }, 'update-api: metro updated, restarting');
+  setTimeout(() => {
+    deps.restart();
+  }, RESTART_DELAY_MS).unref();
+  return { updated: true, version: before.latest, restarting: true };
+}
+
+function binOrThrow(deps: UpdateApiDeps): string {
+  const bin = (deps.cliBin ?? cliBinFromEnv)();
+  if (bin === '')
+    throw new ApiError('this daemon was not started by metro serve, so it cannot update itself: run metro update on the machine', 400);
+  return bin;
+}
+
+export function handleUpdateRequest(req: IncomingMessage, res: ServerResponse, deps: UpdateApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET' && req.method !== 'POST') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  Promise.resolve()
+    .then(async (): Promise<unknown> => {
+      const session = await apiSession(req);
+      if (!session) throw new ApiError('unauthorized', 401);
+      deps.authorize(session.subject);
+      const bin = binOrThrow(deps);
+      if (req.method === 'GET') return { ...(await check(bin)), running: METRO_VERSION };
+      return apply(bin, deps);
+    })
+    .then((body) => {
+      sendJson(req, res, 200, body);
+    })
+    .catch((err: unknown) => {
+      if (err instanceof ApiError) apiFailure(req, res, err, 'update-api');
+      else {
+        log.warn({ err: errMsg(err) }, 'update-api: request failed');
+        if (!res.headersSent) sendJson(req, res, 500, { error: 'update api failed' });
+      }
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/server.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+import './boot/boot.js';

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-inline.ts

@@ -0,0 +1,100 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+export const MAX_INLINE_BYTES = 8 * 1024 * 1024;
+
+const INLINE_TEMP_PREFIX = 'metro-inline-';
+
+const BASE64_RE = /^[A-Za-z0-9+/_-]*={0,2}$/;
+
+const mib = (n: number): string => `${(n / (1024 * 1024)).toFixed(2)} MiB`;
+
+const LIMIT_HINT =
+  `inline \`data\` is capped at ${mib(MAX_INLINE_BYTES)} (${MAX_INLINE_BYTES} bytes) of decoded ` +
+  'bytes per attachment and per send, because the base64 travels inside the MCP request body. ' +
+  'Pass `url`, or a `path` already on the daemon host, for anything larger.';
+
+function assertInlineSize(bytes: number, label: string): void {
+  if (bytes > MAX_INLINE_BYTES)
+    throw new Error(`inline attachment ${label} is ${mib(bytes)}; ${LIMIT_HINT}`);
+}
+
+export function assertInlineTotal(bytes: number): void {
+  if (bytes > MAX_INLINE_BYTES)
+    throw new Error(
+      `inline attachments total ${mib(bytes)} in one send; ${LIMIT_HINT}`,
+    );
+}
+
+const padOf = (b64: string): number =>
+  b64.endsWith('==') ? 2 : b64.endsWith('=') ? 1 : 0;
+
+export const decodedLengthOf = (b64: string): number =>
+  Math.max(0, Math.floor((b64.length * 3) / 4) - padOf(b64));
+
+const malformed = (why: string): Error =>
+  new Error(
+    `inline \`data\` ${why}; pass the file's bytes base64-encoded ` +
+      '(standard or url-safe alphabet, optionally behind a `data:<mime>;base64,` prefix)',
+  );
+
+const DATA_URL_RE = /^data:([^,]*),/i;
+
+export interface InlineSource {
+  data: string;
+  mime?: string;
+}
+
+export function splitInlineData(raw: string): InlineSource {
+  const compact = raw.replace(/\s+/g, '');
+  const match = DATA_URL_RE.exec(compact);
+  if (!match) return { data: raw };
+  const params = (match[1] ?? '').split(';');
+  if (!params.slice(1).some((p) => p.toLowerCase() === 'base64'))
+    throw malformed('is a `data:` url whose payload is not base64');
+  const mime = params[0]?.toLowerCase();
+  const data = compact.slice(match[0].length);
+  return mime === undefined || mime === '' ? { data } : { data, mime };
+}
+
+export function decodeInline(raw: string, label: string): Uint8Array {
+  const b64 = raw.replace(/\s+/g, '');
+  if (!b64) throw malformed('is empty');
+  const expected = decodedLengthOf(b64);
+  assertInlineSize(expected, label);
+  if (!BASE64_RE.test(b64)) throw malformed('is not base64');
+  if (b64.length % 4 === 1 || (padOf(b64) > 0 && b64.length % 4 !== 0))
+    throw malformed('is not a whole number of base64 quanta');
+  const buf = Buffer.from(b64, 'base64');
+  if (buf.length !== expected)
+    throw malformed(`decoded to ${buf.length} bytes instead of ${expected}`);
+  return new Uint8Array(buf);
+}
+
+export const safeFileName = (name: string | undefined): string => {
+  const base = (name ?? '').split(/[\\/]/).pop() ?? '';
+  const clean = base
+    .replace(/[^A-Za-z0-9._-]/g, '_')
+    .replace(/^\.+/, '')
+    .slice(0, 64);
+  return clean || 'attachment';
+};
+
+export interface InlineTemp {
+  dir: string;
+  path: string;
+}
+
+export async function writeInlineTemp(
+  data: Uint8Array,
+  name: string | undefined,
+): Promise<InlineTemp> {
+  const dir = await mkdtemp(join(tmpdir(), INLINE_TEMP_PREFIX));
+  const path = join(dir, safeFileName(name));
+  await writeFile(path, data, { mode: 0o600 });
+  return { dir, path };
+}
+
+export const removeInlineTemp = (dir: string): Promise<void> =>
+  rm(dir, { recursive: true, force: true });

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-interactive.ts

@@ -0,0 +1,161 @@
+import { StationAttachError } from './attach.js';
+
+export const INTERACTIVE_STATIONS = ['telegram', 'whatsapp'] as const;
+
+export type InteractiveStation = (typeof INTERACTIVE_STATIONS)[number];
+
+export type AttachStep = 'code' | 'password' | 'scan' | 'pair';
+
+export interface AttachPrompt {
+  step: AttachStep;
+  prompt: string;
+  qr?: string;
+  pairingCode?: string;
+}
+
+export interface AttachOutcome {
+  config: Record<string, unknown>;
+  identity: Record<string, string>;
+}
+
+export interface DriverHooks {
+  prompt: (p: AttachPrompt) => void;
+  done: (o: AttachOutcome) => void;
+  fail: (message: string) => void;
+}
+
+export interface AttachDriver {
+  submit: (input: { code?: unknown; password?: unknown }) => Promise<void>;
+  cancel: () => Promise<void>;
+}
+
+export interface StartedAttach {
+  driver: AttachDriver;
+  prompt: AttachPrompt;
+}
+
+const CODE_PROMPT =
+  'Telegram sent a login code to that number. Enter it here.';
+const PASSWORD_PROMPT =
+  'This account has two-step verification. Enter its password.';
+const SCAN_PROMPT =
+  'Open WhatsApp on your phone, go to Settings, Linked Devices, Link a Device, and scan this code.';
+const PAIR_PROMPT =
+  'Open WhatsApp on your phone, go to Settings, Linked Devices, Link a Device, Link with phone number, and type this code.';
+
+export function isInteractiveStation(raw: unknown): raw is InteractiveStation {
+  return (
+    typeof raw === 'string' &&
+    (INTERACTIVE_STATIONS as readonly string[]).includes(raw)
+  );
+}
+
+function refuse(err: unknown, fallback: string): never {
+  throw new StationAttachError(
+    err instanceof Error && err.message !== '' ? err.message : fallback,
+    400,
+  );
+}
+
+async function startTelegramUser(
+  input: Record<string, unknown>,
+  hooks: DriverHooks,
+): Promise<StartedAttach> {
+  const { TelegramLogin, TelegramLoginError, validateCredentials } =
+    await import('@metro-labs/telegram/login');
+  const isOwn = (e: unknown): boolean => e instanceof TelegramLoginError;
+  let login;
+  try {
+    login = new TelegramLogin(
+      validateCredentials({
+        apiId: input.apiId,
+        apiHash: input.apiHash,
+        phone: input.phone,
+      }),
+    );
+    await login.requestCode();
+  } catch (err) {
+    await login?.close();
+    refuse(isOwn(err) ? err : null, 'Telegram refused to start the sign-in');
+  }
+  const settled = login;
+  return {
+    prompt: { step: 'code', prompt: CODE_PROMPT },
+    driver: {
+      cancel: () => settled.close(),
+      submit: async (values) => {
+        try {
+          if (typeof values.password === 'string') {
+            hooks.done(await settled.submitPassword(values.password));
+            return;
+          }
+          if (typeof values.code !== 'string')
+            throw new StationAttachError('enter the login code', 400);
+          const result = await settled.submitCode(values.code);
+          if (result === 'password') {
+            hooks.prompt({ step: 'password', prompt: PASSWORD_PROMPT });
+            return;
+          }
+          hooks.done(result);
+        } catch (err) {
+          if (err instanceof StationAttachError) throw err;
+          refuse(isOwn(err) ? err : null, 'Telegram refused the sign-in');
+        }
+      },
+    },
+  };
+}
+
+async function startWhatsapp(
+  input: Record<string, unknown>,
+  hooks: DriverHooks,
+): Promise<StartedAttach> {
+  const { WhatsappLogin, WhatsappLoginError, normalizePhone } = await import(
+    '@metro-labs/whatsapp/login'
+  );
+  const isOwn = (e: unknown): boolean => e instanceof WhatsappLoginError;
+  let login;
+  try {
+    login = new WhatsappLogin(normalizePhone(input.phone), {
+      onQr: (qr) => {
+        hooks.prompt({ step: 'scan', prompt: SCAN_PROMPT, qr });
+      },
+      onPairingCode: (pairingCode) => {
+        hooks.prompt({ step: 'pair', prompt: PAIR_PROMPT, pairingCode });
+      },
+      onPaired: hooks.done,
+      onFailed: hooks.fail,
+    });
+    await login.start();
+  } catch (err) {
+    await login?.cancel();
+    refuse(isOwn(err) ? err : null, 'WhatsApp refused to start the pairing');
+  }
+  const settled = login;
+  const qrMode = settled.mode === 'qr';
+  return {
+    prompt: qrMode
+      ? { step: 'scan', prompt: SCAN_PROMPT }
+      : { step: 'pair', prompt: PAIR_PROMPT },
+    driver: {
+      cancel: () => settled.cancel(),
+      submit: () =>
+        Promise.reject(
+          new StationAttachError(
+            'this pairing finishes on your phone, there is nothing to submit here',
+            409,
+          ),
+        ),
+    },
+  };
+}
+
+export async function startInteractiveAttach(
+  station: InteractiveStation,
+  input: Record<string, unknown>,
+  hooks: DriverHooks,
+): Promise<StartedAttach> {
+  return station === 'telegram'
+    ? startTelegramUser(input, hooks)
+    : startWhatsapp(input, hooks);
+}