@stage-labs/metro 0.1.0-beta.104 → 0.1.0-beta.105

package/dist/claude.js

@@ -135,11 +135,10 @@ function gatewayLaunchEnv(key, port) {
     process.stderr.write(`metro claude: inference goes through the daemon at http://127.0.0.1:${String(port)}/gateway (the Model page decides where)\n`);
     const routed = gatewayEnv(process.env, key, port);
     const env = credentialEnv(routed, key, claudeSignedIn());
-    if (env !== routed) {
+    if (env !== routed)
         process.stderr.write("metro claude: Claude Code has no login of its own here, so metro's key stands in as its credential; the Model page must route to Bedrock, OpenRouter or Codex\n");
-        if (seedChannels() === 'marked')
-            process.stderr.write('metro claude: marked Channels as available for Claude Code, which only asks Anthropic about them for a claude.ai login\n');
-    }
+    if (seedChannels() === 'marked')
+        process.stderr.write('metro claude: marked Channels as available in Claude Code cached flags, since a box that sends no telemetry never fetches them\n');
     if (markOnboardingDone() === 'marked')
         process.stderr.write("metro claude: skipped Claude Code's first-run setup, since it already has a credential here\n");
     return env;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.104",
+  "version": "0.1.0-beta.105",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.104",
-  "description": "Metro connectors for Claude Code. Runs beside the metro daemon on this machine: each connector the agent holds is one MCP server relayed through the daemon, the daemon keeps that list current on its own, and /reload-plugins picks up a new one without leaving your session. No vendor credential ever sits in a config file.",
+  "version": "0.1.0-beta.105",
+  "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, the standing rules loaded at each session start, and a refresh skill for when the daemon could not keep the server list current. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",
     "url": "https://metro.box"
@@ -14,5 +14,6 @@
     "connectors",
     "relay"
   ],
-  "skills": "./skills/"
+  "skills": "./skills/",
+  "hooks": "./hooks/hooks.json"
 }

package/runtime/marketplace/plugin/bin/guard.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+
+const BLOCKING = new Set(['AskUserQuestion', 'ExitPlanMode', 'EnterPlanMode']);
+const ORCHESTRATION = new Set([
+  'Agent',
+  'Workflow',
+  'ToolSearch',
+  'Skill',
+  'ScheduleWakeup',
+  'Monitor',
+  'CronCreate',
+  'CronList',
+  'CronDelete',
+  'TaskCreate',
+  'TaskGet',
+  'TaskList',
+  'TaskOutput',
+  'TaskStop',
+  'TaskUpdate',
+]);
+const IMAGE = /\.(png|jpe?g|gif|webp|bmp)$/i;
+
+function deny(reason) {
+  process.stdout.write(
+    `${JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } })}\n`,
+  );
+}
+
+function verdict(payload) {
+  const tool = typeof payload.tool_name === 'string' ? payload.tool_name : '';
+  const input = payload.tool_input !== null && typeof payload.tool_input === 'object' ? payload.tool_input : {};
+  if (BLOCKING.has(tool))
+    return `${tool} blocks the session waiting on the terminal, and nobody is watching it. Decide with your best judgement and state the assumption, or ask over chat with the metro tools and keep working in the meantime.`;
+  if (typeof payload.agent_id === 'string' && payload.agent_id !== '') return null;
+  if (tool === 'Agent' && input.run_in_background === false)
+    return 'A foreground subagent blinds the main thread: it cannot see or acknowledge inbound metro messages until the agent finishes. Re-issue the identical Agent call with run_in_background: true, then wait for the task notification.';
+  if (ORCHESTRATION.has(tool) || tool.startsWith('mcp__')) return null;
+  if (tool === 'Read' && typeof input.file_path === 'string' && IMAGE.test(input.file_path)) return null;
+  return `The main thread is orchestrator-only, so ${tool === '' ? 'this tool' : tool} is not available here. Delegate the work to a subagent with the Agent tool (run_in_background: true; the worker agent has full tool access) or to a Workflow, and report the result over metro.`;
+}
+
+let payload = {};
+try {
+  payload = JSON.parse(readFileSync(0, 'utf8'));
+} catch {
+  payload = {};
+}
+const reason = verdict(payload !== null && typeof payload === 'object' ? payload : {});
+if (reason !== null) deny(reason);

package/runtime/marketplace/plugin/bin/session-start.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const given = (value) => (typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined);
+const claudeDir = given(process.env.CLAUDE_CONFIG_DIR) ?? join(given(process.env.HOME) ?? homedir(), '.claude');
+const SKILL = join(claudeDir, 'skills', 'metro-orchestrator', 'SKILL.md');
+const FALLBACK = join(dirname(dirname(fileURLToPath(import.meta.url))), 'orchestrator.md');
+
+const body = (text) => text.replace(/^---[\s\S]*?\n---\n/, '').trim();
+
+function guidance() {
+  for (const path of [SKILL, FALLBACK]) {
+    if (!existsSync(path)) continue;
+    try {
+      const text = body(readFileSync(path, 'utf8'));
+      if (text !== '') return text;
+    } catch {
+      continue;
+    }
+  }
+  return '';
+}
+
+const text = guidance();
+if (text !== '')
+  process.stdout.write(
+    `${JSON.stringify({ hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: `This machine runs as a metro agent. Standing rules, kept in the metro-orchestrator skill:\n\n${text}` } })}\n`,
+  );

package/runtime/marketplace/plugin/hooks/hooks.json

@@ -0,0 +1,25 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bin/guard.mjs\"",
+            "statusMessage": "Checking the orchestrator boundary"
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bin/session-start.mjs\""
+          }
+        ]
+      }
+    ]
+  }
+}

package/runtime/marketplace/plugin/orchestrator.md

@@ -0,0 +1,16 @@
+---
+name: metro-orchestrator
+description: How this box's agent works on metro. Acknowledge, delegate, relay, answer over chat, never block on the terminal. Loaded at every session start by the metro plugin; edit it here to change the rules on this box.
+---
+
+You are the main thread of a Claude Code session that is connected to chat through metro, on a machine nobody watches. The main thread is an orchestrator: it may only delegate and talk. A guard in the metro plugin denies every other tool on this thread, so this is the shape of the work, not a preference.
+
+**Inbound.** A message arrives as a `<channel source="metro" …>` block. Read `addressed` first: `direct`, `mention` or `reply` means it is for you; without it the message merely happened in a room you watch, so treat it as context and stay silent unless the person plainly wants you. For a message that is for you, the first tool call is `react` on it (👀, then 👍 or ✅ once done) so the person knows you saw it, and any reply goes on the same `line`, passed verbatim.
+
+**Delegate everything that is work.** Reading files, running commands, searching, fetching pages, editing: hand it to a subagent with the `Agent` tool, `subagent_type: "worker"`, always `run_in_background: true`, then keep answering chat while it runs and relay the result when the task notification arrives. A foreground subagent blinds you to chat and the guard refuses it. You may read image files yourself, so a screenshot someone sends is yours to look at.
+
+**Never wait on the terminal.** `AskUserQuestion`, plan mode and anything that blocks for a person at the keyboard are denied everywhere, main thread and subagents alike. When something is ambiguous, do what does not depend on it, choose the most reasonable reading, say so in your reply, and if a real decision is needed ask over chat with `send` and carry on. Tool-approval prompts reach the chat too; the person answers `yes <id>` or `no <id>` there.
+
+**Report like a relay.** A worker's report is the only evidence you have, so pass on what it verified and say plainly what it did not. Short messages on chat: lead with the outcome, one idea per sentence, no tool names, no file paths unless the person needs them. Send a file out with `create_upload` (the curl line it hands back runs in a worker) and then `send` with the upload id.
+
+**Keep going.** Long tasks run as background agents and loops; check in over chat when something lands rather than going quiet. The session is restarted by the daemon if it exits, so an interrupted task is resumed from chat, not from memory.

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -24,6 +24,7 @@ import { ConnectorWatch } from '../connectors/watch.js';
 import { syncPluginServers } from '../connectors/plugin-sync.js';
 import { ensureMetroPlugin } from '../claude/plugin-install.js';
 import { unwatchSession, watchSession } from '../claude/session.js';
+import { tryClaudeSetup } from '../claude/setup.js';
 import { applyLocalOwner } from './local-owner.js';
 import { localOwner } from '../agents/file-admin.js';
 import { ensureStationDeps } from '../stations/runtime-deps.js';
@@ -160,6 +161,7 @@ async function main(): Promise<void> {
     .catch((err: unknown) => {
       log.warn({ err: errMsg(err) }, 'plugin: could not ensure the Claude Code plugin');
     });
+  tryClaudeSetup();
   watchSession();
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/claude/api.ts

@@ -21,6 +21,7 @@ import {
   startClaudeLogin,
   type LoginDeps,
 } from './login.js';
+import { claudeSetupStatus, ensureClaudeSetup, setPrivacy, type SetupDeps } from './setup.js';
 import {
   ensureSession,
   sessionStatus,
@@ -50,6 +51,7 @@ export interface ClaudeApiDeps {
   dir?: () => string;
   login?: LoginDeps;
   session?: SessionDeps;
+  setup?: SetupDeps;
 }
 
 function projectOf(query: URLSearchParams): string {
@@ -111,6 +113,19 @@ async function created(req: IncomingMessage, path: string, dir: string): Promise
 
 const LOGIN = 'login';
 const SESSION = 'session';
+const SETUP = 'setup';
+
+async function setupAnswer(req: IncomingMessage, deps: ClaudeApiDeps): Promise<unknown> {
+  const setup = deps.setup ?? {};
+  const method = req.method ?? 'GET';
+  if (method === 'GET') return claudeSetupStatus(setup);
+  if (method !== 'POST') throw new ApiError('method not allowed', 405);
+  const body = await readJsonBody(req);
+  if (!isRecord(body) || typeof body.privacy !== 'boolean') throw new ApiError('privacy must be true or false', 400);
+  setPrivacy(body.privacy, setup.agents);
+  ensureClaudeSetup(setup);
+  return claudeSetupStatus(setup);
+}
 
 function sessionCommand(body: Record<string, unknown>, session: SessionDeps): unknown {
   if (body.action === 'start') {
@@ -170,11 +185,17 @@ function answer(method: string, path: string, query: URLSearchParams, dir: strin
   return handler(query, dir, item);
 }
 
+const SINGLETONS: Record<string, (req: IncomingMessage, deps: ClaudeApiDeps) => Promise<unknown>> = {
+  [SESSION]: sessionAnswer,
+  [SETUP]: setupAnswer,
+};
+
 function routed(req: IncomingMessage, path: string, search: string, deps: ClaudeApiDeps): unknown {
   const dir = (deps.dir ?? claudeDir)();
   const [head = '', item = ''] = parts(path);
   if (head === LOGIN) return loginAnswer(req, item, deps);
-  if (head === SESSION && item === '') return sessionAnswer(req, deps);
+  const single = item === '' ? SINGLETONS[head] : undefined;
+  if (single !== undefined) return single(req, deps);
   if (req.method === 'PUT') return writeAnswer(req, path, dir);
   if (req.method === 'POST') return created(req, path, dir);
   return answer(req.method ?? 'GET', path, new URLSearchParams(search), dir);

package/runtime/node_modules/@metro-labs/daemon/src/claude/setup.ts

@@ -0,0 +1,170 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { errMsg, log } from '@metro-labs/core/log';
+import { isRecord } from '@metro-labs/core/is-record';
+import { readJson, writeJson } from '@metro-labs/core/secure-fs';
+import { agentsDir } from '../agents/files.js';
+import { claudeDir } from './files.js';
+import { stagedMarketplaceDir } from './plugin-install.js';
+
+export const PRIVACY_ENV: Record<string, string> = {
+  DISABLE_TELEMETRY: '1',
+  DISABLE_ERROR_REPORTING: '1',
+  CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
+  CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF: '1',
+};
+export const RETENTION_DAYS = 7;
+export const SKILL_NAME = 'metro-orchestrator';
+const STATE_FILE = 'claude-setup.json';
+const GUIDANCE = 'orchestrator.md';
+
+export const WORKER_AGENT = `---
+name: worker
+description: Default execution agent for delegated work. Full tool access and maximum reasoning effort. Use for any substantive task the orchestrator main thread cannot perform itself - reading and writing code, running commands, research, analysis.
+effort: xhigh
+---
+
+You are a worker agent. The main thread that dispatched you is an orchestrator with no file, shell or network access; it can only delegate and relay messages. That means you are where the actual work happens, and the quality of your output is the quality of the result.
+
+Work to completion. Do not hand back a partial answer with a suggestion that someone else finish it; there is no one else. If part of the task is genuinely blocked, complete every other part in full and say plainly what you left undone and why.
+
+Never call AskUserQuestion or ExitPlanMode. They are blocked by policy, because nobody is watching the terminal around the clock and a blocking prompt stalls indefinitely. When you hit an ambiguity: do everything that does not depend on it, then choose the most reasonable interpretation, state the assumption explicitly in your report, and continue.
+
+Your final message is a report to the orchestrator, not a message to a human. It gets relayed onward, so make it self-contained and concise. Lead with the outcome. Include concrete evidence, command output, file paths with line numbers, test results, for anything you claim to have verified. Report failures faithfully: if a test failed, say so and show the output; if you skipped a step, say that too.
+`;
+
+export interface SetupDeps {
+  dir?: string;
+  agents?: string;
+  guidance?: string;
+  env?: NodeJS.ProcessEnv;
+}
+
+export type Placed = 'written' | 'present' | 'missing';
+export type SettingsOutcome = 'written' | 'unchanged' | 'unreadable';
+
+export interface SetupReport {
+  privacy: boolean;
+  guard: 'plugin';
+  worker: Placed;
+  skill: Placed;
+  settings: SettingsOutcome;
+}
+
+export interface SetupStatus {
+  privacy: boolean;
+  guard: 'plugin';
+  worker: boolean;
+  skill: boolean;
+  privacyApplied: boolean;
+  retentionDays: number | null;
+}
+
+const statePath = (agents: string): string => join(agents, STATE_FILE);
+
+export function privacyEnabled(agents = agentsDir()): boolean {
+  const raw = readJson<unknown>(statePath(agents), null);
+  return !isRecord(raw) || raw.privacy !== false;
+}
+
+export function setPrivacy(enabled: boolean, agents = agentsDir()): void {
+  writeJson(statePath(agents), { privacy: enabled });
+}
+
+export function guidancePath(env: NodeJS.ProcessEnv = process.env): string {
+  const staged = stagedMarketplaceDir(env);
+  if (staged !== null) {
+    const path = join(staged, 'plugin', GUIDANCE);
+    if (existsSync(path)) return path;
+  }
+  return fileURLToPath(new URL(`../../../../plugin/${GUIDANCE}`, import.meta.url));
+}
+
+function ensureFile(path: string, text: string): Placed {
+  if (existsSync(path)) return 'present';
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, text, { mode: 0o644 });
+  return 'written';
+}
+
+function readSettings(path: string): Record<string, unknown> | null {
+  if (!existsSync(path)) return {};
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(path, 'utf8'));
+    return isRecord(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function withPrivacy(settings: Record<string, unknown>, enabled: boolean): Record<string, unknown> {
+  const current = isRecord(settings.env) ? settings.env : {};
+  if (enabled)
+    return { ...settings, env: { ...current, ...PRIVACY_ENV }, cleanupPeriodDays: settings.cleanupPeriodDays ?? RETENTION_DAYS };
+  const env = Object.fromEntries(Object.entries(current).filter(([key]) => !(key in PRIVACY_ENV)));
+  const rest = Object.fromEntries(Object.entries(settings).filter(([key]) => key !== 'env'));
+  return Object.keys(env).length === 0 ? rest : { ...rest, env };
+}
+
+export function applyPrivacy(dir: string, enabled: boolean): SettingsOutcome {
+  const path = join(dir, 'settings.json');
+  const current = readSettings(path);
+  if (current === null) return 'unreadable';
+  const next = withPrivacy(current, enabled);
+  const text = `${JSON.stringify(next, null, 2)}\n`;
+  if (existsSync(path) && readFileSync(path, 'utf8') === text) return 'unchanged';
+  mkdirSync(dir, { recursive: true });
+  const tmp = `${path}.metro-${String(process.pid)}.tmp`;
+  writeFileSync(tmp, text, { mode: 0o644 });
+  renameSync(tmp, path);
+  return 'written';
+}
+
+const skillPath = (dir: string): string => join(dir, 'skills', SKILL_NAME, 'SKILL.md');
+const workerPath = (dir: string): string => join(dir, 'agents', 'worker.md');
+
+function placeSkill(dir: string, guidance: string): Placed {
+  if (!existsSync(guidance)) return 'missing';
+  return ensureFile(skillPath(dir), readFileSync(guidance, 'utf8'));
+}
+
+export function ensureClaudeSetup(deps: SetupDeps = {}): SetupReport {
+  const dir = deps.dir ?? claudeDir();
+  const agents = deps.agents ?? agentsDir();
+  const privacy = privacyEnabled(agents);
+  const report: SetupReport = {
+    privacy,
+    guard: 'plugin',
+    worker: ensureFile(workerPath(dir), WORKER_AGENT),
+    skill: placeSkill(dir, deps.guidance ?? guidancePath(deps.env)),
+    settings: applyPrivacy(dir, privacy),
+  };
+  if (report.worker === 'written' || report.skill === 'written' || report.settings === 'written')
+    log.info(report, 'claude-setup: applied the Claude Code setup for a metro box');
+  if (report.settings === 'unreadable') log.warn({ path: join(dir, 'settings.json') }, 'claude-setup: settings.json is not valid JSON, so the privacy settings were not written');
+  return report;
+}
+
+export function claudeSetupStatus(deps: SetupDeps = {}): SetupStatus {
+  const dir = deps.dir ?? claudeDir();
+  const settings = readSettings(join(dir, 'settings.json'));
+  const env = settings !== null && isRecord(settings.env) ? settings.env : {};
+  const days = settings?.cleanupPeriodDays;
+  return {
+    privacy: privacyEnabled(deps.agents ?? agentsDir()),
+    guard: 'plugin',
+    worker: existsSync(workerPath(dir)),
+    skill: existsSync(skillPath(dir)),
+    privacyApplied: Object.keys(PRIVACY_ENV).every((key) => env[key] === '1'),
+    retentionDays: typeof days === 'number' ? days : null,
+  };
+}
+
+export function tryClaudeSetup(deps: SetupDeps = {}): void {
+  try {
+    ensureClaudeSetup(deps);
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'claude-setup: could not apply the Claude Code setup');
+  }
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.104"
+  "version": "0.1.0-beta.105"
 }