@stage-labs/metro 0.1.0-beta.175 → 0.1.0-beta.176

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.175",
+  "version": "0.1.0-beta.176",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.175",
+  "version": "0.1.0-beta.176",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/agents/accounts-api.ts

@@ -26,6 +26,7 @@ import {
   isInteractiveStation,
   type InteractiveStation,
 } from '../stations/attach-interactive.js';
+import type { StepInput } from '../stations/attach-driver.js';
 import {
   type AttachOwner,
   type AttachView,
@@ -41,7 +42,7 @@ export interface AttachSessionApi {
   submit: (
     owner: AttachOwner,
     attachId: string,
-    input: { code?: unknown; password?: unknown },
+    input: StepInput,
   ) => Promise<AttachView>;
   cancel: (owner: AttachOwner, attachId: string) => Promise<void>;
 }
@@ -319,9 +320,14 @@ async function handleStep(
   attachId: string,
 ): Promise<void> {
   const body = await readJsonBody(req);
+  const field = (key: string): unknown => bodyField(body, key);
   const view = await deps.attachSessions.submit(owner, attachId, {
-    code: bodyField(body, 'code'),
-    password: bodyField(body, 'password'),
+    code: field('code'),
+    password: field('password'),
+    state: field('state'),
+    mode: field('mode'),
+    error: field('error'),
+    errorDescription: field('errorDescription'),
   });
   sendJson(req, res, 200, view);
 }

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-driver.ts

@@ -0,0 +1,42 @@
+export type AttachStep = 'code' | 'password' | 'scan' | 'pair' | 'device' | 'browser';
+
+export interface AttachPrompt {
+  step: AttachStep;
+  prompt: string;
+  qr?: string;
+  pairingCode?: string;
+  userCode?: string;
+  verificationUri?: string;
+  authorizeUrl?: string;
+}
+
+export interface AttachOutcome {
+  config: Record<string, unknown>;
+  identity: Record<string, string>;
+}
+
+export interface DriverHooks {
+  prompt: (p: AttachPrompt) => void;
+  done: (o: AttachOutcome) => void;
+  fail: (message: string) => void;
+}
+
+export interface StepInput {
+  code?: unknown;
+  password?: unknown;
+  state?: unknown;
+  mode?: unknown;
+  error?: unknown;
+  errorDescription?: unknown;
+}
+
+export interface AttachDriver {
+  submit: (input: StepInput) => Promise<void>;
+  cancel: () => Promise<void>;
+}
+
+export interface StartedAttach {
+  driver: AttachDriver;
+  prompt: AttachPrompt;
+  expiresAt?: number;
+}

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-interactive.ts

@@ -1,42 +1,11 @@
 import { StationAttachError } from './attach.js';
+import type { DriverHooks, StartedAttach } from './attach-driver.js';
+import { startOutlook } from './attach-outlook.js';
 
 export const INTERACTIVE_STATIONS = ['telegram', 'whatsapp', 'outlook'] as const;
 
 export type InteractiveStation = (typeof INTERACTIVE_STATIONS)[number];
 
-export type AttachStep = 'code' | 'password' | 'scan' | 'pair' | 'device';
-
-export interface AttachPrompt {
-  step: AttachStep;
-  prompt: string;
-  qr?: string;
-  pairingCode?: string;
-  userCode?: string;
-  verificationUri?: string;
-}
-
-export interface AttachOutcome {
-  config: Record<string, unknown>;
-  identity: Record<string, string>;
-}
-
-export interface DriverHooks {
-  prompt: (p: AttachPrompt) => void;
-  done: (o: AttachOutcome) => void;
-  fail: (message: string) => void;
-}
-
-export interface AttachDriver {
-  submit: (input: { code?: unknown; password?: unknown }) => Promise<void>;
-  cancel: () => Promise<void>;
-}
-
-export interface StartedAttach {
-  driver: AttachDriver;
-  prompt: AttachPrompt;
-  expiresAt?: number;
-}
-
 const CODE_PROMPT =
   'Telegram sent a login code to that number. Enter it here.';
 const PASSWORD_PROMPT =
@@ -153,28 +122,6 @@ async function startWhatsapp(
   };
 }
 
-const DEVICE_PROMPT =
-  'Open the Microsoft sign-in page, type this code, and sign in with the mailbox this agent should read.';
-
-async function startOutlook(hooks: DriverHooks): Promise<StartedAttach> {
-  const { OutlookLogin, OutlookLoginError } = await import('@metro-labs/outlook/login');
-  const login = new OutlookLogin({ onDone: hooks.done, onFailed: hooks.fail });
-  const code = await login.start().catch((err: unknown) =>
-    refuse(err instanceof OutlookLoginError ? err : null, 'Microsoft refused to start the sign-in'),
-  );
-  return {
-    prompt: { step: 'device', prompt: DEVICE_PROMPT, userCode: code.userCode, verificationUri: code.verificationUri },
-    expiresAt: code.expiresAt,
-    driver: {
-      cancel: () => login.cancel(),
-      submit: () =>
-        Promise.reject(
-          new StationAttachError('this sign-in finishes on the Microsoft page, there is nothing to submit here', 409),
-        ),
-    },
-  };
-}
-
 export async function startInteractiveAttach(
   station: InteractiveStation,
   input: Record<string, unknown>,

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-outlook.ts

@@ -0,0 +1,62 @@
+import type { OutlookLogin } from '@metro-labs/outlook/login';
+import { StationAttachError } from './attach.js';
+import type { DriverHooks, StartedAttach, StepInput } from './attach-driver.js';
+
+const BROWSER_PROMPT =
+  'Sign in with Microsoft in a new tab, with the mailbox this agent should read. This page updates on its own once you are done.';
+const DEVICE_PROMPT =
+  'Open the Microsoft sign-in page, type this code, and sign in with the mailbox this agent should read.';
+const OTHER_ATTEMPT = 'This sign-in link belongs to another attempt. Start again from the Channels page.';
+const BROWSER_TTL_MS = 15 * 60_000;
+
+const text = (v: unknown): string => (typeof v === 'string' ? v.trim() : '');
+
+export async function startOutlook(hooks: DriverHooks): Promise<StartedAttach> {
+  const { OutlookBrowserLogin, OutlookLogin: DeviceLogin, OutlookLoginError, failureOf } = await import('@metro-labs/outlook/login');
+  const said = (err: unknown, fallback: string): string =>
+    err instanceof OutlookLoginError && err.message !== '' ? err.message : fallback;
+  const browser = (() => {
+    try {
+      return new OutlookBrowserLogin();
+    } catch (err) {
+      throw new StationAttachError(said(err, 'Microsoft refused to start the sign-in'), 400);
+    }
+  })();
+  let device: OutlookLogin | null = null;
+
+  const toDevice = async (): Promise<void> => {
+    if (device !== null) return;
+    const login = new DeviceLogin({ onDone: hooks.done, onFailed: hooks.fail });
+    const code = await login.start().catch((err: unknown) => {
+      throw new StationAttachError(said(err, 'Microsoft refused to start the sign-in'), 400);
+    });
+    device = login;
+    hooks.prompt({ step: 'device', prompt: DEVICE_PROMPT, userCode: code.userCode, verificationUri: code.verificationUri });
+  };
+
+  const finish = async (input: StepInput): Promise<void> => {
+    const state = text(input.state);
+    if (state !== browser.state) throw new StationAttachError(OTHER_ATTEMPT, 400);
+    const error = text(input.error);
+    if (error !== '') {
+      hooks.fail(failureOf({ error, error_description: text(input.errorDescription) }));
+      return;
+    }
+    const code = text(input.code);
+    if (code === '') throw new StationAttachError('Microsoft did not send a sign-in code back', 400);
+    try {
+      hooks.done(await browser.finish(code, state));
+    } catch (err) {
+      hooks.fail(said(err, 'Metro could not finish the Microsoft sign-in.'));
+    }
+  };
+
+  return {
+    prompt: { step: 'browser', prompt: BROWSER_PROMPT, authorizeUrl: browser.authorizeUrl },
+    expiresAt: Date.now() + BROWSER_TTL_MS,
+    driver: {
+      cancel: () => device?.cancel() ?? Promise.resolve(),
+      submit: (input) => (input.mode === 'device' ? toDevice() : finish(input)),
+    },
+  };
+}

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-session.ts

@@ -3,16 +3,16 @@ import { ApiError } from '@metro-labs/http/api-error';
 import { errMsg, log } from '@metro-labs/core/log';
 import type { StationName } from '@metro-labs/core/station-names';
 import { ensureStationDeps } from './runtime-deps.js';
-import {
-  startInteractiveAttach,
-  type AttachDriver,
-  type AttachOutcome,
-  type AttachPrompt,
-  type AttachStep,
-  type DriverHooks,
-  type InteractiveStation,
-  type StartedAttach,
-} from './attach-interactive.js';
+import { startInteractiveAttach, type InteractiveStation } from './attach-interactive.js';
+import type {
+  AttachDriver,
+  AttachOutcome,
+  AttachPrompt,
+  AttachStep,
+  DriverHooks,
+  StartedAttach,
+  StepInput,
+} from './attach-driver.js';
 
 export type StartAttach = (
   station: InteractiveStation,
@@ -42,6 +42,7 @@ export interface AttachView {
   pairingCode: string | null;
   userCode: string | null;
   verificationUri: string | null;
+  authorizeUrl: string | null;
   accountId: string | null;
   identity: Record<string, string>;
   activated: boolean;
@@ -86,6 +87,7 @@ function blankView(attachId: string, station: string): AttachView {
     pairingCode: null,
     userCode: null,
     verificationUri: null,
+    authorizeUrl: null,
     accountId: null,
     identity: {},
     activated: false,
@@ -138,6 +140,7 @@ export class AttachSessions {
       pairingCode: null,
       userCode: null,
       verificationUri: null,
+      authorizeUrl: null,
       step: null,
       expiresAt: Date.now() + SETTLED_TTL_MS,
     });
@@ -187,6 +190,7 @@ export class AttachSessions {
         session.view.pairingCode = p.pairingCode ?? null;
         session.view.userCode = p.userCode ?? null;
         session.view.verificationUri = p.verificationUri ?? null;
+        session.view.authorizeUrl = p.authorizeUrl ?? null;
       },
       done: (o: AttachOutcome): void => {
         this.finish(attachId, station, o).catch((err: unknown) => {
@@ -247,7 +251,7 @@ export class AttachSessions {
   async submit(
     owner: AttachOwner,
     attachId: string,
-    input: { code?: unknown; password?: unknown },
+    input: StepInput,
   ): Promise<AttachView> {
     const session = this.own(owner, attachId);
     const driver = session.driver;

package/runtime/node_modules/@metro-labs/outlook/src/auth.ts

@@ -29,6 +29,7 @@ type Body = Record<string, unknown>;
 
 const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
 const CONSENT_CODES = new Set([65001, 90094, 90095]);
+const POLICY_CODES = new Set([530035, 53003]);
 
 const text = (v: unknown): string => (typeof v === 'string' ? v : '');
 const seconds = (v: unknown, fallback: number): number =>
@@ -39,7 +40,7 @@ export function requireClientId(id = clientId()): string {
   return id;
 }
 
-async function postForm(path: string, fields: Record<string, string>, fetchImpl: FetchLike): Promise<{ status: number; body: Body }> {
+export async function postForm(path: string, fields: Record<string, string>, fetchImpl: FetchLike): Promise<{ status: number; body: Body }> {
   let res: Response;
   try {
     res = await fetchImpl(`${loginBase()}/oauth2/v2.0/${path}`, {
@@ -63,13 +64,20 @@ function codesOf(body: Body): number[] {
 const needsConsent = (error: string, codes: number[]): boolean =>
   error === 'consent_required' || codes.some((c) => CONSENT_CODES.has(c));
 
-export function failureOf(body: Body, id = clientId()): string {
-  const error = text(body.error);
-  const codes = codesOf(body);
+function knownFailure(error: string, codes: number[], id: string): string | null {
   if (needsConsent(error, codes))
-    return `An administrator of this Microsoft 365 organization must approve Metro once before it can read this mailbox. They can do it at https://login.microsoftonline.com/common/adminconsent?client_id=${id} and then you can start again.`;
+    return `An administrator of this Microsoft 365 organization must approve Metro once before it can read this mailbox. They can do it at https://login.microsoftonline.com/organizations/adminconsent?client_id=${id} and then you can start again.`;
+  if (codes.some((c) => POLICY_CODES.has(c)))
+    return 'Your company blocks this kind of sign-in. Ask your Microsoft 365 administrator, or use the Microsoft sign-in page instead of a code.';
   if (error === 'expired_token' || codes.includes(70020)) return 'The sign-in code expired before it was used. Start again.';
   if (error === 'access_denied' || codes.includes(65004)) return 'The sign-in was declined, so nothing was connected.';
+  return null;
+}
+
+export function failureOf(body: Body, id = clientId()): string {
+  const error = text(body.error);
+  const known = knownFailure(error, codesOf(body), id);
+  if (known !== null) return known;
   const detail = text(body.error_description).split(/\r?\n/)[0] ?? '';
   return detail === '' ? `Microsoft refused the sign-in (${error === '' ? 'no reason given' : error}).` : `Microsoft refused the sign-in: ${detail}`;
 }
@@ -93,7 +101,7 @@ export function tenantOf(...jwts: string[]): string | null {
   return null;
 }
 
-function tokensOf(body: Body, now: number, previous?: string): Tokens {
+export function tokensOf(body: Body, now: number, previous?: string): Tokens {
   const accessToken = text(body.access_token);
   const refreshToken = text(body.refresh_token) || (previous ?? '');
   if (accessToken === '' || refreshToken === '') throw new OutlookAuthError('Microsoft answered without the tokens Metro needs.');

package/runtime/node_modules/@metro-labs/outlook/src/browser.ts

@@ -0,0 +1,52 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { failureOf, OutlookAuthError, postForm, requireClientId, tenantOf, tokensOf, type FetchLike, type Tokens } from './auth.js';
+import { loginBase, redirectUri, SCOPES } from './config.js';
+
+export interface Pkce {
+  verifier: string;
+  challenge: string;
+}
+
+export function pkcePair(verifier = randomBytes(32).toString('base64url')): Pkce {
+  return { verifier, challenge: createHash('sha256').update(verifier).digest('base64url') };
+}
+
+export const newState = (): string => randomBytes(24).toString('base64url');
+
+export function authorizeUrl(challenge: string, state: string): string {
+  const query = new URLSearchParams({
+    client_id: requireClientId(),
+    response_type: 'code',
+    redirect_uri: redirectUri(),
+    response_mode: 'query',
+    scope: SCOPES,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    prompt: 'select_account',
+  });
+  return `${loginBase()}/oauth2/v2.0/authorize?${query.toString()}`;
+}
+
+export interface Redeemed {
+  tokens: Tokens;
+  tenantId: string | null;
+}
+
+export async function redeemCode(code: string, verifier: string, fetchImpl: FetchLike, now = Date.now()): Promise<Redeemed> {
+  const { status, body } = await postForm(
+    'token',
+    {
+      grant_type: 'authorization_code',
+      client_id: requireClientId(),
+      code,
+      code_verifier: verifier,
+      redirect_uri: redirectUri(),
+      scope: SCOPES,
+    },
+    fetchImpl,
+  );
+  if (status !== 200) throw new OutlookAuthError(failureOf(body));
+  const tokens = tokensOf(body, now);
+  return { tokens, tenantId: tenantOf(typeof body.id_token === 'string' ? body.id_token : '', tokens.accessToken) };
+}

package/runtime/node_modules/@metro-labs/outlook/src/config.ts

@@ -27,5 +27,10 @@ const base = (raw: string | undefined, fallback: string): string => {
 export const loginBase = (): string =>
   base(process.env.METRO_OUTLOOK_LOGIN_URL, 'https://login.microsoftonline.com/common');
 
+export const redirectUri = (): string => {
+  const value = trimmed(process.env.METRO_OUTLOOK_REDIRECT);
+  return value === '' ? 'https://metro.box/' : value;
+};
+
 export const graphBase = (): string =>
   base(process.env.METRO_OUTLOOK_GRAPH_URL, 'https://graph.microsoft.com/v1.0');

package/runtime/node_modules/@metro-labs/outlook/src/login.ts

@@ -5,11 +5,14 @@ import {
   type DeviceCode,
   type FetchLike,
   type Poll,
+  type Tokens,
 } from './auth.js';
-import { verifyMailbox } from './me.js';
+import { authorizeUrl, newState, pkcePair, redeemCode, type Pkce } from './browser.js';
+import { verifyMailbox, type Mailbox } from './me.js';
 
 export { OutlookAuthError as OutlookLoginError } from './auth.js';
 export { NOT_SET_UP } from './config.js';
+export { failureOf } from './auth.js';
 
 export interface OutlookLoginResult {
   config: Record<string, unknown>;
@@ -28,6 +31,44 @@ export interface OutlookLoginDeps {
 
 const SLOW_DOWN_MS = 5_000;
 
+function resultOf(tokens: Tokens, tenantId: string | null, mailbox: Mailbox, now: number): OutlookLoginResult {
+  return {
+    config: {
+      accountEmail: mailbox.email,
+      refreshToken: tokens.refreshToken,
+      accessToken: tokens.accessToken,
+      expiresAt: tokens.expiresAt,
+      tenantId,
+      createdAt: new Date(now).toISOString(),
+    },
+    identity: { email: mailbox.email, ...(mailbox.name === '' ? {} : { name: mailbox.name }) },
+  };
+}
+
+export class OutlookBrowserLogin {
+  readonly state = newState();
+  readonly authorizeUrl: string;
+  private readonly pkce: Pkce = pkcePair();
+  private used = false;
+  private readonly fetchImpl: FetchLike;
+  private readonly now: () => number;
+
+  constructor(deps: OutlookLoginDeps = {}) {
+    this.fetchImpl = deps.fetch ?? ((input, init) => fetch(input, init));
+    this.now = deps.now ?? Date.now;
+    this.authorizeUrl = authorizeUrl(this.pkce.challenge, this.state);
+  }
+
+  async finish(code: string, state: string): Promise<OutlookLoginResult> {
+    if (state !== this.state)
+      throw new OutlookAuthError('This sign-in link belongs to another attempt. Start again from the Channels page.');
+    if (this.used) throw new OutlookAuthError('This sign-in was already used. Start again from the Channels page.');
+    this.used = true;
+    const { tokens, tenantId } = await redeemCode(code, this.pkce.verifier, this.fetchImpl, this.now());
+    return resultOf(tokens, tenantId, await verifyMailbox(tokens.accessToken, this.fetchImpl), this.now());
+  }
+}
+
 export class OutlookLogin {
   private code: DeviceCode | null = null;
   private timer: ReturnType<typeof setTimeout> | null = null;
@@ -97,16 +138,6 @@ export class OutlookLogin {
     const mailbox = await verifyMailbox(poll.tokens.accessToken, this.fetchImpl);
     if (this.stopped) return;
     this.stopped = true;
-    this.events.onDone({
-      config: {
-        accountEmail: mailbox.email,
-        refreshToken: poll.tokens.refreshToken,
-        accessToken: poll.tokens.accessToken,
-        expiresAt: poll.tokens.expiresAt,
-        tenantId: poll.tenantId,
-        createdAt: new Date(this.now()).toISOString(),
-      },
-      identity: { email: mailbox.email, ...(mailbox.name === '' ? {} : { name: mailbox.name }) },
-    });
+    this.events.onDone(resultOf(poll.tokens, poll.tenantId, mailbox, this.now()));
   }
 }

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.175"
+  "version": "0.1.0-beta.176"
 }