@stage-labs/metro 0.1.0-beta.115 → 0.1.0-beta.117

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.115",
+  "version": "0.1.0-beta.117",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.115",
+  "version": "0.1.0-beta.117",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, the standing rules loaded at each session start, and a refresh skill for when the daemon could not keep the server list current. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/marketplace/plugin/bin/guard.mjs

@@ -20,6 +20,8 @@ const ORCHESTRATION = new Set([
   'TaskUpdate',
 ]);
 const IMAGE = /\.(png|jpe?g|gif|webp|bmp)$/i;
+const MCP = /^mcp__/;
+const METRO_MCP = /^mcp__metro__/;
 
 function deny(reason) {
   process.stdout.write(
@@ -35,7 +37,10 @@ function verdict(payload) {
   if (typeof payload.agent_id === 'string' && payload.agent_id !== '') return null;
   if (tool === 'Agent' && input.run_in_background === false)
     return 'A foreground subagent blinds the main thread: it cannot see or acknowledge inbound metro messages until the agent finishes. Re-issue the identical Agent call with run_in_background: true, then wait for the task notification.';
-  if (ORCHESTRATION.has(tool) || tool.startsWith('mcp__')) return null;
+  if (ORCHESTRATION.has(tool)) return null;
+  if (METRO_MCP.test(tool)) return null;
+  if (MCP.test(tool))
+    return `A connector call is work, not orchestration: ${tool} reads somebody's files, mail or records, and its answer can be long enough to crowd out the chat you are here to follow. Only metro's own tools run on this thread. Delegate it to a subagent with the Agent tool (run_in_background: true; the worker reaches every connector) and relay what it finds.`;
   if (tool === 'Read' && typeof input.file_path === 'string' && IMAGE.test(input.file_path)) return null;
   return `The main thread is orchestrator-only, so ${tool === '' ? 'this tool' : tool} is not available here. Delegate the work to a subagent with the Agent tool (run_in_background: true; the worker agent has full tool access) or to a Workflow, and report the result over metro.`;
 }

package/runtime/marketplace/plugin/orchestrator.md

@@ -7,7 +7,7 @@ You are the main thread of a Claude Code session that is connected to chat throu
 
 **Inbound.** A message arrives as a `<channel source="metro" …>` block. Read `addressed` first: `direct`, `mention` or `reply` means it is for you; without it the message merely happened in a room you watch, so treat it as context and stay silent unless the person plainly wants you. For a message that is for you, the first tool call is `react` on it (👀, then 👍 or ✅ once done) so the person knows you saw it, and any reply goes on the same `line`, passed verbatim.
 
-**Delegate everything that is work.** Reading files, running commands, searching, fetching pages, editing: hand it to a subagent with the `Agent` tool, `subagent_type: "worker"`, always `run_in_background: true`, then keep answering chat while it runs and relay the result when the task notification arrives. A foreground subagent blinds you to chat and the guard refuses it. You may read image files yourself, so a screenshot someone sends is yours to look at.
+**Delegate everything that is work.** Reading files, running commands, searching, fetching pages, editing, and every connector tool: hand it to a subagent with the `Agent` tool, `subagent_type: "worker"`, always `run_in_background: true`, then keep answering chat while it runs and relay the result when the task notification arrives. A foreground subagent blinds you to chat and the guard refuses it. You may read image files yourself, so a screenshot someone sends is yours to look at.
 
 **Never wait on the terminal.** `AskUserQuestion`, plan mode and anything that blocks for a person at the keyboard are denied everywhere, main thread and subagents alike. When something is ambiguous, do what does not depend on it, choose the most reasonable reading, say so in your reply, and if a real decision is needed ask over chat with `send` and carry on. Tool-approval prompts reach the chat too; the person answers `yes <id>` or `no <id>` there.
 

package/runtime/node_modules/@metro-labs/core/src/stations/types.ts

@@ -97,6 +97,7 @@ export interface Station {
   hasTrain: boolean;
   messageVerbs: ReadonlySet<Verb>;
   groupOps?: ReadonlySet<GroupOp>;
+  resolvesSenders?: boolean;
   attachmentMode: AttachmentMode;
   sendAttachments?(
     line: string,

package/runtime/node_modules/@metro-labs/daemon/src/agents/account-routes.ts

@@ -0,0 +1,70 @@
+import { isStationName, parseAccountId } from './account-attach.js';
+import type { StationName } from '@metro-labs/core/station-names';
+import { ATTACH_ID_RE } from '../stations/attach-session.js';
+
+export type AccountRoute =
+  | { kind: 'start' }
+  | { kind: 'session'; attachId: string }
+  | { kind: 'step'; attachId: string }
+  | { kind: 'account'; station: StationName; accountId: string }
+  | { kind: 'allowlist'; station: StationName; accountId: string }
+  | { kind: 'senders'; station: StationName; accountId: string }
+  | { kind: 'resolve'; station: StationName; accountId: string }
+  | { kind: 'enabled'; station: StationName; accountId: string };
+
+const ROUTE_METHODS: Record<AccountRoute['kind'], string[]> = {
+  start: ['POST'],
+  session: ['GET', 'DELETE'],
+  step: ['POST'],
+  account: ['DELETE'],
+  allowlist: ['PUT'],
+  senders: ['GET'],
+  resolve: ['GET'],
+  enabled: ['PUT'],
+};
+
+const SUB_ROUTES = ['allowlist', 'senders', 'resolve', 'enabled'] as const;
+
+type SubRoute = (typeof SUB_ROUTES)[number];
+
+const isSubRoute = (value: string | undefined): value is SubRoute =>
+  SUB_ROUTES.some((sub) => sub === value);
+
+function twoSegmentRoute(head: string, tail: string): AccountRoute | null {
+  if (ATTACH_ID_RE.test(head))
+    return tail === 'step' ? { kind: 'step', attachId: head } : null;
+  if (!isStationName(head)) return null;
+  const accountId = parseAccountId(tail);
+  return accountId === null ? null : { kind: 'account', station: head, accountId };
+}
+
+function accountSubRoute(
+  head: string,
+  tail: string,
+  sub: string | undefined,
+): AccountRoute | null {
+  if (!isStationName(head) || !isSubRoute(sub)) return null;
+  const accountId = parseAccountId(tail);
+  return accountId === null ? null : { kind: sub, station: head, accountId };
+}
+
+export function accountRoute(rest: string[]): AccountRoute | null {
+  const [head, tail] = rest;
+  if (head === undefined) return null;
+  if (rest.length === 1)
+    return head === 'start'
+      ? { kind: 'start' }
+      : ATTACH_ID_RE.test(head)
+        ? { kind: 'session', attachId: head }
+        : null;
+  if (rest.length === 3 && tail !== undefined) return accountSubRoute(head, tail, rest[2]);
+  if (rest.length !== 2 || tail === undefined) return null;
+  return twoSegmentRoute(head, tail);
+}
+
+export function accountRouteAllows(
+  route: AccountRoute,
+  method: string | undefined,
+): boolean {
+  return ROUTE_METHODS[route.kind].includes(method ?? '');
+}

package/runtime/node_modules/@metro-labs/daemon/src/agents/accounts-api.ts

@@ -10,11 +10,9 @@ import {
   sendJson,
   type ApiSession,
 } from '@metro-labs/http/api-http';
-import {
-  isStationName,
-  parseAccountId,
-  type AccountRef,
-} from './account-attach.js';
+import { type AccountRef } from './account-attach.js';
+import { type AccountRoute } from './account-routes.js';
+import { stationByName } from '../stations/registry.js';
 import type { StationName } from '@metro-labs/core/station-names';
 import {
   ATTACHABLE_STATIONS,
@@ -30,7 +28,6 @@ import {
   type InteractiveStation,
 } from '../stations/attach-interactive.js';
 import {
-  ATTACH_ID_RE,
   type AttachOwner,
   type AttachView,
 } from '../stations/attach-session.js';
@@ -75,6 +72,11 @@ export interface AccountApiDeps {
     allowlist: string[],
   ) => Promise<string[]>;
   recentSenders: (station: StationName, accountId: string) => RecentSender[];
+  resolveSender: (
+    station: StationName,
+    accountId: string,
+    query: string,
+  ) => Promise<unknown>;
   setAccountEnabled: (
     subject: string,
     agentId: string,
@@ -84,63 +86,28 @@ export interface AccountApiDeps {
   ) => Promise<boolean>;
 }
 
-export type AccountRoute =
-  | { kind: 'start' }
-  | { kind: 'session'; attachId: string }
-  | { kind: 'step'; attachId: string }
-  | { kind: 'account'; station: StationName; accountId: string }
-  | { kind: 'allowlist'; station: StationName; accountId: string }
-  | { kind: 'senders'; station: StationName; accountId: string }
-  | { kind: 'enabled'; station: StationName; accountId: string };
-
 export const ATTACHABLE: string[] = [
   ...ATTACHABLE_STATIONS,
   ...INTERACTIVE_STATIONS,
 ];
 
-const ROUTE_METHODS: Record<AccountRoute['kind'], string[]> = {
-  start: ['POST'],
-  session: ['GET', 'DELETE'],
-  step: ['POST'],
-  account: ['DELETE'],
-  allowlist: ['PUT'],
-  senders: ['GET'],
-  enabled: ['PUT'],
-};
-
-function twoSegmentRoute(head: string, tail: string): AccountRoute | null {
-  if (ATTACH_ID_RE.test(head))
-    return tail === 'step' ? { kind: 'step', attachId: head } : null;
-  if (!isStationName(head)) return null;
-  const accountId = parseAccountId(tail);
-  return accountId === null ? null : { kind: 'account', station: head, accountId };
-}
-
-export function accountRoute(rest: string[]): AccountRoute | null {
-  const [head, tail] = rest;
-  if (head === undefined) return null;
-  if (rest.length === 1)
-    return head === 'start'
-      ? { kind: 'start' }
-      : ATTACH_ID_RE.test(head)
-        ? { kind: 'session', attachId: head }
-        : null;
-  if (rest.length === 3 && tail !== undefined) return accountSubRoute(head, tail, rest[2]);
-  if (rest.length !== 2 || tail === undefined) return null;
-  return twoSegmentRoute(head, tail);
+function lookupQuery(req: IncomingMessage): string {
+  const params = new URLSearchParams((req.url ?? '').split('?')[1] ?? '');
+  return (params.get('q') ?? '').trim();
 }
 
-function accountSubRoute(head: string, tail: string, sub: string | undefined): AccountRoute | null {
-  if (!isStationName(head) || (sub !== 'allowlist' && sub !== 'senders' && sub !== 'enabled')) return null;
-  const accountId = parseAccountId(tail);
-  return accountId === null ? null : { kind: sub, station: head, accountId };
-}
-
-export function accountRouteAllows(
-  route: AccountRoute,
-  method: string | undefined,
-): boolean {
-  return ROUTE_METHODS[route.kind].includes(method ?? '');
+async function handleResolve(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: AccountApiDeps,
+  target: { station: StationName; accountId: string },
+): Promise<void> {
+  if (stationByName(target.station)?.resolvesSenders !== true)
+    throw new ApiError(`metro cannot look a sender up on ${target.station}`, 400);
+  const query = lookupQuery(req);
+  if (query === '') throw new ApiError('a number to look up is required', 400);
+  const found = await deps.resolveSender(target.station, target.accountId, query);
+  sendJson(req, res, 200, found);
 }
 
 async function activate(
@@ -374,6 +341,7 @@ async function dispatchRoute(
     return handleStep(req, res, deps, ownerOf(session, agentId), route.attachId);
   if (route.kind === 'allowlist') return handleAllowlist(req, res, deps, session, agentId, route);
   if (route.kind === 'enabled') return handleEnabled(req, res, deps, session, agentId, route);
+  if (route.kind === 'resolve') return handleResolve(req, res, deps, route);
   if (route.kind === 'senders') {
     sendJson(req, res, 200, { senders: deps.recentSenders(route.station, route.accountId) });
     return;

package/runtime/node_modules/@metro-labs/daemon/src/agents/api.ts

@@ -11,14 +11,12 @@ import {
   sendJson,
   type ApiSession,
 } from '@metro-labs/http/api-http';
+import { ATTACHABLE, handleAccountRoute, type AccountApiDeps } from './accounts-api.js';
 import {
   accountRoute,
   accountRouteAllows,
-  ATTACHABLE,
-  handleAccountRoute,
-  type AccountApiDeps,
   type AccountRoute,
-} from './accounts-api.js';
+} from './account-routes.js';
 import {
   type AgentSummary,
   type CreatedAgent,

package/runtime/node_modules/@metro-labs/daemon/src/gateway/openrouter.ts

@@ -9,6 +9,7 @@ export interface OpenRouterModel {
   name: string;
   prompt: number | null;
   completion: number | null;
+  created: number | null;
 }
 
 const str = (value: unknown): string => (typeof value === 'string' ? value : '');
@@ -18,12 +19,27 @@ function price(raw: unknown): number | null {
   return Number.isFinite(value) && value >= 0 ? value : null;
 }
 
+function released(raw: unknown): number | null {
+  return typeof raw === 'number' && Number.isFinite(raw) && raw > 0 ? raw : null;
+}
+
 function modelOf(entry: unknown): OpenRouterModel | null {
   if (!isRecord(entry)) return null;
   const id = str(entry.id);
   if (id === '') return null;
   const pricing = isRecord(entry.pricing) ? entry.pricing : {};
-  return { id, name: str(entry.name) || id, prompt: price(pricing.prompt), completion: price(pricing.completion) };
+  return {
+    id,
+    name: str(entry.name) || id,
+    prompt: price(pricing.prompt),
+    completion: price(pricing.completion),
+    created: released(entry.created),
+  };
+}
+
+export function newestFirst(a: OpenRouterModel, b: OpenRouterModel): number {
+  const when = (b.created ?? 0) - (a.created ?? 0);
+  return when !== 0 ? when : a.id.localeCompare(b.id);
 }
 
 export async function openrouterModels(base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<OpenRouterModel[]> {
@@ -35,8 +51,8 @@ export async function openrouterModels(base = OPENROUTER_BASE, fetchImpl: typeof
   return data
     .map(modelOf)
     .filter((model): model is OpenRouterModel => model !== null)
-    .slice(0, MODELS_MAX)
-    .sort((a, b) => a.id.localeCompare(b.id));
+    .sort(newestFirst)
+    .slice(0, MODELS_MAX);
 }
 
 export async function openrouterZdrModels(base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<string[]> {

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -2,6 +2,7 @@ import { ApiError } from '@metro-labs/http/api-error';
 import { errMsg, log } from '@metro-labs/core/log';
 import { AttachSessions } from '../stations/attach-session.js';
 import { recentSenders } from '../agents/senders.js';
+import { forwardTrainCall } from '../stations/train-call.js';
 import { syncPluginServers } from '../connectors/plugin-sync.js';
 import type { AgentApiDeps } from '../agents/api.js';
 import { ATTACHABLE, type AccountApiDeps } from '../agents/accounts-api.js';
@@ -106,6 +107,7 @@ function agentApi(deps: LocalModeDeps): AgentApiDeps {
     setAllowlist: localSetAllowlist,
     setAccountEnabled: localSetAccountEnabled,
     recentSenders,
+    resolveSender,
     reloadAgents: deps.reloadAgents,
   };
 }
@@ -179,6 +181,27 @@ function localModeInfo(): ModeInfo {
   return { mode: 'local', owner: localOwner(), project: LOCAL_PROJECT_ID, version: METRO_VERSION };
 }
 
+async function resolveSender(
+  station: StationName,
+  accountId: string,
+  query: string,
+): Promise<unknown> {
+  let response;
+  try {
+    response = await forwardTrainCall(station, 'resolve_sender', {
+      account: accountId,
+      query,
+    });
+  } catch (err) {
+    throw new ApiError(
+      `metro could not reach the ${station} train: ${errMsg(err)}`,
+      503,
+    );
+  }
+  if (response.error !== undefined) throw new ApiError(response.error, 400);
+  return response.result;
+}
+
 export function localSessionApis(deps: LocalModeDeps): SessionApis {
   allowLocalConnectors(true);
   return {

package/runtime/node_modules/@metro-labs/whatsapp/src/actions.ts

@@ -9,6 +9,7 @@ import {
 } from '@metro-labs/core/stations/station-runtime';
 import { accountFor, accounts, targetOf } from './accounts.js';
 import { normalizeWhatsApp } from './normalize.js';
+import { phoneNumberOf, senderLookup } from './resolve.js';
 import type { WAClient } from './client.js';
 
 type Args = Record<string, unknown>;
@@ -162,6 +163,16 @@ function makeAccounts(clientFor: ClientFor): StationHandler {
   };
 }
 
+function makeResolveSender(clientFor: ClientFor): StationHandler {
+  return async (id, args) => {
+    const accountId = accountFor({ account: str(args.account) });
+    const query = str(args.query) ?? '';
+    const number = phoneNumberOf(query);
+    const found = await guard(() => clientFor(accountId).lookupSender(number));
+    respond(id, { result: { account: accountId, ...senderLookup(query, number, found) } });
+  };
+}
+
 export function makeHandleCall(
   clientFor: ClientFor,
 ): (msg: CallMsg) => Promise<void> {
@@ -172,6 +183,7 @@ export function makeHandleCall(
       react: makeReact(clientFor),
       edit: makeEdit(clientFor),
       delete: makeDelete(clientFor),
+      resolve_sender: makeResolveSender(clientFor),
     },
     normalize: normalizeWhatsApp,
   });

package/runtime/node_modules/@metro-labs/whatsapp/src/client.ts

@@ -12,6 +12,7 @@ import { TrainError } from '@metro-labs/core/train-error';
 import { errMsg } from '@metro-labs/core/log';
 import type { WhatsAppAccount } from './types.js';
 import type { InboundMessage, ReactionInput } from './format.js';
+import type { SenderFound } from './resolve.js';
 import { toInbound, toReaction, type ReactionEvent, type SelfRef } from './parse.js';
 import { baileysLogger } from './logger.js';
 import { useAccountAuthState } from './auth-state.js';
@@ -49,6 +50,7 @@ export interface WAClient {
   editMessage(jid: string, messageId: string, text: string): Promise<void>;
   deleteMessage(jid: string, messageId: string): Promise<void>;
   reuploadMedia(m: WAMessage): Promise<WAMessage>;
+  lookupSender(number: string): Promise<SenderFound>;
   disconnect(): Promise<void>;
 }
 
@@ -200,6 +202,17 @@ async function connect(st: State): Promise<void> {
   bindDelivery(st, sock);
 }
 
+async function lidFor(st: State, sock: WASocket, jid: string): Promise<string | null> {
+  try {
+    return await sock.signalRepository.lidMapping.getLIDForPN(jid);
+  } catch (e) {
+    process.stderr.write(
+      `whatsapp[${st.account.id}] no lid on file for ${jid}: ${errMsg(e)}\n`,
+    );
+    return null;
+  }
+}
+
 async function ready(st: State): Promise<WASocket> {
   await st.openPromise;
   if (!st.sock) throw new TrainError('whatsapp_call', 'socket not connected');
@@ -315,6 +328,13 @@ export function createClient(account: WhatsAppAccount): WAClient {
       const sock = await ready(st);
       return sock.updateMediaMessage(m);
     },
+    async lookupSender(number) {
+      const sock = await ready(st);
+      const found = (await sock.onWhatsApp(number))?.[0];
+      if (found?.exists !== true) return { exists: false, jid: null, lid: null };
+      const jid = jidNormalizedUser(found.jid);
+      return { exists: true, jid, lid: await lidFor(st, sock, jid) };
+    },
     async disconnect() {
       st.closed = true;
       try {

package/runtime/node_modules/@metro-labs/whatsapp/src/resolve.ts

@@ -0,0 +1,52 @@
+import { TrainError } from '@metro-labs/core/train-error';
+
+const INTERNATIONAL = /^[1-9]\d{5,17}$/;
+
+export interface SenderFound {
+  exists: boolean;
+  jid: string | null;
+  lid: string | null;
+}
+
+export interface SenderLookup extends SenderFound {
+  query: string;
+  number: string;
+  id: string | null;
+}
+
+function refuse(query: string, why: string): never {
+  throw new TrainError('bad_request', `'${query}' ${why}`);
+}
+
+function international(query: string, digits: string): string {
+  if (digits.startsWith('00')) return digits.slice(2);
+  if (digits.startsWith('0'))
+    refuse(
+      query,
+      'is a national number, so metro cannot tell which country it is in; write it in full international form, as in 41791234567 for a Swiss 079 123 45 67',
+    );
+  return digits;
+}
+
+export function phoneNumberOf(raw: string): string {
+  const query = raw.trim();
+  if (query.toLowerCase().endsWith('@lid'))
+    refuse(query, 'is already a sender id, so add it directly instead of looking it up');
+  const local = query.split('@')[0] ?? '';
+  const digits = local.replace(/\D/g, '');
+  const number = local.startsWith('+') ? digits : international(query, digits);
+  if (!INTERNATIONAL.test(number))
+    refuse(query, 'is not a phone number metro can look up; write it in full international form, as in 41791234567');
+  return number;
+}
+
+export function senderLookup(query: string, number: string, found: SenderFound): SenderLookup {
+  return {
+    query: query.trim(),
+    number,
+    exists: found.exists,
+    jid: found.jid,
+    lid: found.lid,
+    id: found.lid ?? found.jid,
+  };
+}

package/runtime/node_modules/@metro-labs/whatsapp/src/station.ts

@@ -13,5 +13,6 @@ export const whatsappStation: Station = {
     'delete',
   ]),
   attachmentMode: 'canonical',
+  resolvesSenders: true,
   tools: [],
 };

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.115"
+  "version": "0.1.0-beta.117"
 }