@stage-labs/metro 0.1.0-beta.175 → 0.1.0-beta.177

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.175",
+  "version": "0.1.0-beta.177",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.175",
+  "version": "0.1.0-beta.177",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/core/package.json

@@ -19,6 +19,7 @@
     "./lines": "./src/lines.ts",
     "./endpoints": "./src/endpoints.ts",
     "./stations/types": "./src/stations/types.ts",
+    "./stations/account-files": "./src/stations/account-files.ts",
     "./stations/station-runtime": "./src/stations/station-runtime.ts",
     "./stations/account-store": "./src/stations/account-store.ts",
     "./stations/attachments": "./src/stations/attachments.ts",

package/runtime/node_modules/@metro-labs/core/src/stations/account-files.ts

@@ -0,0 +1,41 @@
+import { readdirSync, rmSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { log } from '../log.js';
+
+export interface AccountFiles {
+  path: (accountId: string) => string;
+  forget: (accountId: string) => void;
+  forgetExcept: (keptAccountIds: readonly string[]) => void;
+}
+
+const safeSegment = (s: string): string => s.replace(/[^A-Za-z0-9_-]/g, '_');
+
+function listed(dir: string): string[] {
+  try {
+    return readdirSync(dir);
+  } catch {
+    return [];
+  }
+}
+
+export function accountFiles(dirEnv: string, prefix: string): AccountFiles {
+  const dir = (): string => process.env[dirEnv] ?? join(homedir(), '.metro');
+  const name = (accountId: string): string => `${prefix}${safeSegment(accountId)}.json`;
+  const remove = (file: string, reason: string): void => {
+    rmSync(join(dir(), file), { force: true });
+    log.info({ file: join(dir(), file) }, reason);
+  };
+  return {
+    path: (accountId) => join(dir(), name(accountId)),
+    forget: (accountId) => {
+      remove(name(accountId), 'station: removed the files of a detached account');
+    },
+    forgetExcept: (keptAccountIds) => {
+      const kept = new Set(keptAccountIds.map(name));
+      for (const file of listed(dir()))
+        if (file.startsWith(prefix) && file.endsWith('.json') && !kept.has(file))
+          remove(file, 'station: removed the files of an account that is no longer attached');
+    },
+  };
+}

package/runtime/node_modules/@metro-labs/core/src/stations/types.ts

@@ -108,6 +108,8 @@ export interface Station {
   readFilters?: ReadonlySet<ReadFilter>;
   approvals?: boolean;
   attachmentMode: AttachmentMode;
+  forget?: (accountId: string) => void;
+  forgetExcept?: (keptAccountIds: readonly string[]) => void;
   sendAttachments?(
     line: string,
     atts: CanonicalAttachment[],

package/runtime/node_modules/@metro-labs/daemon/src/agents/accounts-api.ts

@@ -26,6 +26,7 @@ import {
   isInteractiveStation,
   type InteractiveStation,
 } from '../stations/attach-interactive.js';
+import type { StepInput } from '../stations/attach-driver.js';
 import {
   type AttachOwner,
   type AttachView,
@@ -41,7 +42,7 @@ export interface AttachSessionApi {
   submit: (
     owner: AttachOwner,
     attachId: string,
-    input: { code?: unknown; password?: unknown },
+    input: StepInput,
   ) => Promise<AttachView>;
   cancel: (owner: AttachOwner, attachId: string) => Promise<void>;
 }
@@ -245,6 +246,18 @@ async function handleDetach(
     detached: true,
     activated: await activate(deps, ref.station),
   });
+  forgetAccount(ref.station, ref.accountId);
+}
+
+function forgetAccount(station: StationName, accountId: string): void {
+  try {
+    stationByName(station)?.forget?.(accountId);
+  } catch (err) {
+    log.warn(
+      { station, account: accountId, err: errMsg(err) },
+      'account-api: could not remove the files of a detached account',
+    );
+  }
 }
 
 async function applied(deps: AccountApiDeps): Promise<boolean> {
@@ -319,9 +332,14 @@ async function handleStep(
   attachId: string,
 ): Promise<void> {
   const body = await readJsonBody(req);
+  const field = (key: string): unknown => bodyField(body, key);
   const view = await deps.attachSessions.submit(owner, attachId, {
-    code: bodyField(body, 'code'),
-    password: bodyField(body, 'password'),
+    code: field('code'),
+    password: field('password'),
+    state: field('state'),
+    mode: field('mode'),
+    error: field('error'),
+    errorDescription: field('errorDescription'),
   });
   sendJson(req, res, 200, view);
 }

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -36,9 +36,11 @@ import { createMetroMcp } from '../mcp/index.js';
 import { gatherAccountsForAgents } from '../mcp/accounts.js';
 import {
   accountStationCapabilities,
+  forgetOrphans,
   stationByName,
 } from '../stations/registry.js';
 import { prepareAccount } from '../stations/attach.js';
+import { knownAccounts } from '../agents/map.js';
 import { materializeFrom, reloadFrom } from '../stations/materialize.js';
 import type { StationName } from '@metro-labs/core/station-names';
 import { startUploadReaper } from '../files/upload-store.js';
@@ -116,6 +118,7 @@ installBearerSessions(agentsDir(), localOwner);
   migrateAgentLayout();
   log.info({ agent: await ensureLocalAgent() }, 'local daemon: agent');
   await materializeFrom(fileSource);
+  forgetOrphans(knownAccounts());
   supervisor.start();
   const metroMcp = await createMetroMcp();
   webhookServer = await startWebhookServer(

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-driver.ts

@@ -0,0 +1,42 @@
+export type AttachStep = 'code' | 'password' | 'scan' | 'pair' | 'device' | 'browser';
+
+export interface AttachPrompt {
+  step: AttachStep;
+  prompt: string;
+  qr?: string;
+  pairingCode?: string;
+  userCode?: string;
+  verificationUri?: string;
+  authorizeUrl?: string;
+}
+
+export interface AttachOutcome {
+  config: Record<string, unknown>;
+  identity: Record<string, string>;
+}
+
+export interface DriverHooks {
+  prompt: (p: AttachPrompt) => void;
+  done: (o: AttachOutcome) => void;
+  fail: (message: string) => void;
+}
+
+export interface StepInput {
+  code?: unknown;
+  password?: unknown;
+  state?: unknown;
+  mode?: unknown;
+  error?: unknown;
+  errorDescription?: unknown;
+}
+
+export interface AttachDriver {
+  submit: (input: StepInput) => Promise<void>;
+  cancel: () => Promise<void>;
+}
+
+export interface StartedAttach {
+  driver: AttachDriver;
+  prompt: AttachPrompt;
+  expiresAt?: number;
+}

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-interactive.ts

@@ -1,42 +1,11 @@
 import { StationAttachError } from './attach.js';
+import type { DriverHooks, StartedAttach } from './attach-driver.js';
+import { startOutlook } from './attach-outlook.js';
 
 export const INTERACTIVE_STATIONS = ['telegram', 'whatsapp', 'outlook'] as const;
 
 export type InteractiveStation = (typeof INTERACTIVE_STATIONS)[number];
 
-export type AttachStep = 'code' | 'password' | 'scan' | 'pair' | 'device';
-
-export interface AttachPrompt {
-  step: AttachStep;
-  prompt: string;
-  qr?: string;
-  pairingCode?: string;
-  userCode?: string;
-  verificationUri?: string;
-}
-
-export interface AttachOutcome {
-  config: Record<string, unknown>;
-  identity: Record<string, string>;
-}
-
-export interface DriverHooks {
-  prompt: (p: AttachPrompt) => void;
-  done: (o: AttachOutcome) => void;
-  fail: (message: string) => void;
-}
-
-export interface AttachDriver {
-  submit: (input: { code?: unknown; password?: unknown }) => Promise<void>;
-  cancel: () => Promise<void>;
-}
-
-export interface StartedAttach {
-  driver: AttachDriver;
-  prompt: AttachPrompt;
-  expiresAt?: number;
-}
-
 const CODE_PROMPT =
   'Telegram sent a login code to that number. Enter it here.';
 const PASSWORD_PROMPT =
@@ -153,34 +122,12 @@ async function startWhatsapp(
   };
 }
 
-const DEVICE_PROMPT =
-  'Open the Microsoft sign-in page, type this code, and sign in with the mailbox this agent should read.';
-
-async function startOutlook(hooks: DriverHooks): Promise<StartedAttach> {
-  const { OutlookLogin, OutlookLoginError } = await import('@metro-labs/outlook/login');
-  const login = new OutlookLogin({ onDone: hooks.done, onFailed: hooks.fail });
-  const code = await login.start().catch((err: unknown) =>
-    refuse(err instanceof OutlookLoginError ? err : null, 'Microsoft refused to start the sign-in'),
-  );
-  return {
-    prompt: { step: 'device', prompt: DEVICE_PROMPT, userCode: code.userCode, verificationUri: code.verificationUri },
-    expiresAt: code.expiresAt,
-    driver: {
-      cancel: () => login.cancel(),
-      submit: () =>
-        Promise.reject(
-          new StationAttachError('this sign-in finishes on the Microsoft page, there is nothing to submit here', 409),
-        ),
-    },
-  };
-}
-
 export async function startInteractiveAttach(
   station: InteractiveStation,
   input: Record<string, unknown>,
   hooks: DriverHooks,
 ): Promise<StartedAttach> {
-  if (station === 'outlook') return startOutlook(hooks);
+  if (station === 'outlook') return startOutlook(input, hooks);
   return station === 'telegram'
     ? startTelegramUser(input, hooks)
     : startWhatsapp(input, hooks);

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-outlook.ts

@@ -0,0 +1,63 @@
+import type { OutlookLogin } from '@metro-labs/outlook/login';
+import { StationAttachError } from './attach.js';
+import type { DriverHooks, StartedAttach, StepInput } from './attach-driver.js';
+
+const BROWSER_PROMPT =
+  'Sign in with Microsoft in a new tab, with the mailbox this agent should read. This page updates on its own once you are done.';
+const DEVICE_PROMPT =
+  'Open the Microsoft sign-in page, type this code, and sign in with the mailbox this agent should read.';
+const OTHER_ATTEMPT = 'This sign-in link belongs to another attempt. Start again from the Channels page.';
+const BROWSER_TTL_MS = 15 * 60_000;
+
+const text = (v: unknown): string => (typeof v === 'string' ? v.trim() : '');
+
+export async function startOutlook(input: Record<string, unknown>, hooks: DriverHooks): Promise<StartedAttach> {
+  const { OutlookBrowserLogin, OutlookLogin: DeviceLogin, OutlookLoginError, failureOf, parseMailbox } = await import('@metro-labs/outlook/login');
+  const said = (err: unknown, fallback: string): string =>
+    err instanceof OutlookLoginError && err.message !== '' ? err.message : fallback;
+  const { browser, mailbox } = (() => {
+    try {
+      const wanted = parseMailbox(input.mailbox);
+      return { browser: new OutlookBrowserLogin({ mailbox: wanted }), mailbox: wanted };
+    } catch (err) {
+      throw new StationAttachError(said(err, 'Microsoft refused to start the sign-in'), 400);
+    }
+  })();
+  let device: OutlookLogin | null = null;
+
+  const toDevice = async (): Promise<void> => {
+    if (device !== null) return;
+    const login = new DeviceLogin({ onDone: hooks.done, onFailed: hooks.fail }, { mailbox });
+    const code = await login.start().catch((err: unknown) => {
+      throw new StationAttachError(said(err, 'Microsoft refused to start the sign-in'), 400);
+    });
+    device = login;
+    hooks.prompt({ step: 'device', prompt: DEVICE_PROMPT, userCode: code.userCode, verificationUri: code.verificationUri });
+  };
+
+  const finish = async (input: StepInput): Promise<void> => {
+    const state = text(input.state);
+    if (state !== browser.state) throw new StationAttachError(OTHER_ATTEMPT, 400);
+    const error = text(input.error);
+    if (error !== '') {
+      hooks.fail(failureOf({ error, error_description: text(input.errorDescription) }));
+      return;
+    }
+    const code = text(input.code);
+    if (code === '') throw new StationAttachError('Microsoft did not send a sign-in code back', 400);
+    try {
+      hooks.done(await browser.finish(code, state));
+    } catch (err) {
+      hooks.fail(said(err, 'Metro could not finish the Microsoft sign-in.'));
+    }
+  };
+
+  return {
+    prompt: { step: 'browser', prompt: BROWSER_PROMPT, authorizeUrl: browser.authorizeUrl },
+    expiresAt: Date.now() + BROWSER_TTL_MS,
+    driver: {
+      cancel: () => device?.cancel() ?? Promise.resolve(),
+      submit: (input) => (input.mode === 'device' ? toDevice() : finish(input)),
+    },
+  };
+}

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-session.ts

@@ -3,16 +3,16 @@ import { ApiError } from '@metro-labs/http/api-error';
 import { errMsg, log } from '@metro-labs/core/log';
 import type { StationName } from '@metro-labs/core/station-names';
 import { ensureStationDeps } from './runtime-deps.js';
-import {
-  startInteractiveAttach,
-  type AttachDriver,
-  type AttachOutcome,
-  type AttachPrompt,
-  type AttachStep,
-  type DriverHooks,
-  type InteractiveStation,
-  type StartedAttach,
-} from './attach-interactive.js';
+import { startInteractiveAttach, type InteractiveStation } from './attach-interactive.js';
+import type {
+  AttachDriver,
+  AttachOutcome,
+  AttachPrompt,
+  AttachStep,
+  DriverHooks,
+  StartedAttach,
+  StepInput,
+} from './attach-driver.js';
 
 export type StartAttach = (
   station: InteractiveStation,
@@ -42,6 +42,7 @@ export interface AttachView {
   pairingCode: string | null;
   userCode: string | null;
   verificationUri: string | null;
+  authorizeUrl: string | null;
   accountId: string | null;
   identity: Record<string, string>;
   activated: boolean;
@@ -86,6 +87,7 @@ function blankView(attachId: string, station: string): AttachView {
     pairingCode: null,
     userCode: null,
     verificationUri: null,
+    authorizeUrl: null,
     accountId: null,
     identity: {},
     activated: false,
@@ -138,6 +140,7 @@ export class AttachSessions {
       pairingCode: null,
       userCode: null,
       verificationUri: null,
+      authorizeUrl: null,
       step: null,
       expiresAt: Date.now() + SETTLED_TTL_MS,
     });
@@ -187,6 +190,7 @@ export class AttachSessions {
         session.view.pairingCode = p.pairingCode ?? null;
         session.view.userCode = p.userCode ?? null;
         session.view.verificationUri = p.verificationUri ?? null;
+        session.view.authorizeUrl = p.authorizeUrl ?? null;
       },
       done: (o: AttachOutcome): void => {
         this.finish(attachId, station, o).catch((err: unknown) => {
@@ -247,7 +251,7 @@ export class AttachSessions {
   async submit(
     owner: AttachOwner,
     attachId: string,
-    input: { code?: unknown; password?: unknown },
+    input: StepInput,
   ): Promise<AttachView> {
     const session = this.own(owner, attachId);
     const driver = session.driver;

package/runtime/node_modules/@metro-labs/daemon/src/stations/registry.ts

@@ -1,5 +1,6 @@
 import type { Station } from '@metro-labs/core/stations/types';
 import { Line } from '@metro-labs/core/lines';
+import { errMsg, log } from '@metro-labs/core/log';
 import { xmtpStation } from '@metro-labs/xmtp';
 import { telegramBotStation } from '@metro-labs/telegram-bot';
 import { telegramStation } from '@metro-labs/telegram';
@@ -37,3 +38,14 @@ export const accountStationCapabilities = (): Record<string, string[]> => {
     if (s.hasAccounts) out[s.name] = [...s.messageVerbs].sort();
   return out;
 };
+
+export function forgetOrphans(known: readonly { station: string; id: string }[]): void {
+  for (const s of STATIONS) {
+    if (s.forgetExcept === undefined) continue;
+    try {
+      s.forgetExcept(known.filter((a) => a.station === s.name).map((a) => a.id));
+    } catch (err) {
+      log.warn({ station: s.name, err: errMsg(err) }, 'stations: could not remove the files of detached accounts');
+    }
+  }
+}

package/runtime/node_modules/@metro-labs/outlook/src/auth.ts

@@ -29,6 +29,7 @@ type Body = Record<string, unknown>;
 
 const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
 const CONSENT_CODES = new Set([65001, 90094, 90095]);
+const POLICY_CODES = new Set([530035, 53003]);
 
 const text = (v: unknown): string => (typeof v === 'string' ? v : '');
 const seconds = (v: unknown, fallback: number): number =>
@@ -39,7 +40,7 @@ export function requireClientId(id = clientId()): string {
   return id;
 }
 
-async function postForm(path: string, fields: Record<string, string>, fetchImpl: FetchLike): Promise<{ status: number; body: Body }> {
+export async function postForm(path: string, fields: Record<string, string>, fetchImpl: FetchLike): Promise<{ status: number; body: Body }> {
   let res: Response;
   try {
     res = await fetchImpl(`${loginBase()}/oauth2/v2.0/${path}`, {
@@ -63,13 +64,20 @@ function codesOf(body: Body): number[] {
 const needsConsent = (error: string, codes: number[]): boolean =>
   error === 'consent_required' || codes.some((c) => CONSENT_CODES.has(c));
 
-export function failureOf(body: Body, id = clientId()): string {
-  const error = text(body.error);
-  const codes = codesOf(body);
+function knownFailure(error: string, codes: number[], id: string): string | null {
   if (needsConsent(error, codes))
-    return `An administrator of this Microsoft 365 organization must approve Metro once before it can read this mailbox. They can do it at https://login.microsoftonline.com/common/adminconsent?client_id=${id} and then you can start again.`;
+    return `An administrator of this Microsoft 365 organization must approve Metro once before it can read this mailbox. They can do it at https://login.microsoftonline.com/organizations/adminconsent?client_id=${id} and then you can start again.`;
+  if (codes.some((c) => POLICY_CODES.has(c)))
+    return 'Your company blocks this kind of sign-in. Ask your Microsoft 365 administrator, or use the Microsoft sign-in page instead of a code.';
   if (error === 'expired_token' || codes.includes(70020)) return 'The sign-in code expired before it was used. Start again.';
   if (error === 'access_denied' || codes.includes(65004)) return 'The sign-in was declined, so nothing was connected.';
+  return null;
+}
+
+export function failureOf(body: Body, id = clientId()): string {
+  const error = text(body.error);
+  const known = knownFailure(error, codesOf(body), id);
+  if (known !== null) return known;
   const detail = text(body.error_description).split(/\r?\n/)[0] ?? '';
   return detail === '' ? `Microsoft refused the sign-in (${error === '' ? 'no reason given' : error}).` : `Microsoft refused the sign-in: ${detail}`;
 }
@@ -93,7 +101,7 @@ export function tenantOf(...jwts: string[]): string | null {
   return null;
 }
 
-function tokensOf(body: Body, now: number, previous?: string): Tokens {
+export function tokensOf(body: Body, now: number, previous?: string): Tokens {
   const accessToken = text(body.access_token);
   const refreshToken = text(body.refresh_token) || (previous ?? '');
   if (accessToken === '' || refreshToken === '') throw new OutlookAuthError('Microsoft answered without the tokens Metro needs.');

package/runtime/node_modules/@metro-labs/outlook/src/browser.ts

@@ -0,0 +1,53 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { failureOf, OutlookAuthError, postForm, requireClientId, tenantOf, tokensOf, type FetchLike, type Tokens } from './auth.js';
+import { loginBase, redirectUri, SCOPES } from './config.js';
+
+export interface Pkce {
+  verifier: string;
+  challenge: string;
+}
+
+export function pkcePair(verifier = randomBytes(32).toString('base64url')): Pkce {
+  return { verifier, challenge: createHash('sha256').update(verifier).digest('base64url') };
+}
+
+export const newState = (): string => randomBytes(24).toString('base64url');
+
+export function authorizeUrl(challenge: string, state: string, loginHint: string | null = null): string {
+  const query = new URLSearchParams({
+    ...(loginHint === null ? {} : { login_hint: loginHint }),
+    client_id: requireClientId(),
+    response_type: 'code',
+    redirect_uri: redirectUri(),
+    response_mode: 'query',
+    scope: SCOPES,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    prompt: 'select_account',
+  });
+  return `${loginBase()}/oauth2/v2.0/authorize?${query.toString()}`;
+}
+
+export interface Redeemed {
+  tokens: Tokens;
+  tenantId: string | null;
+}
+
+export async function redeemCode(code: string, verifier: string, fetchImpl: FetchLike, now = Date.now()): Promise<Redeemed> {
+  const { status, body } = await postForm(
+    'token',
+    {
+      grant_type: 'authorization_code',
+      client_id: requireClientId(),
+      code,
+      code_verifier: verifier,
+      redirect_uri: redirectUri(),
+      scope: SCOPES,
+    },
+    fetchImpl,
+  );
+  if (status !== 200) throw new OutlookAuthError(failureOf(body));
+  const tokens = tokensOf(body, now);
+  return { tokens, tenantId: tenantOf(typeof body.id_token === 'string' ? body.id_token : '', tokens.accessToken) };
+}

package/runtime/node_modules/@metro-labs/outlook/src/config.ts

@@ -27,5 +27,10 @@ const base = (raw: string | undefined, fallback: string): string => {
 export const loginBase = (): string =>
   base(process.env.METRO_OUTLOOK_LOGIN_URL, 'https://login.microsoftonline.com/common');
 
+export const redirectUri = (): string => {
+  const value = trimmed(process.env.METRO_OUTLOOK_REDIRECT);
+  return value === '' ? 'https://metro.box/' : value;
+};
+
 export const graphBase = (): string =>
   base(process.env.METRO_OUTLOOK_GRAPH_URL, 'https://graph.microsoft.com/v1.0');

package/runtime/node_modules/@metro-labs/outlook/src/login.ts

@@ -5,11 +5,16 @@ import {
   type DeviceCode,
   type FetchLike,
   type Poll,
+  type Tokens,
 } from './auth.js';
-import { verifyMailbox } from './me.js';
+import { authorizeUrl, newState, pkcePair, redeemCode, type Pkce } from './browser.js';
+import { verifyMailbox, type Mailbox } from './me.js';
+
+export { parseMailbox } from './me.js';
 
 export { OutlookAuthError as OutlookLoginError } from './auth.js';
 export { NOT_SET_UP } from './config.js';
+export { failureOf } from './auth.js';
 
 export interface OutlookLoginResult {
   config: Record<string, unknown>;
@@ -24,20 +29,63 @@ export interface OutlookLoginEvents {
 export interface OutlookLoginDeps {
   fetch?: FetchLike;
   now?: () => number;
+  mailbox?: string | null;
 }
 
 const SLOW_DOWN_MS = 5_000;
 
+function resultOf(tokens: Tokens, tenantId: string | null, mailbox: Mailbox, now: number): OutlookLoginResult {
+  return {
+    config: {
+      accountEmail: mailbox.email,
+      refreshToken: tokens.refreshToken,
+      accessToken: tokens.accessToken,
+      expiresAt: tokens.expiresAt,
+      tenantId,
+      createdAt: new Date(now).toISOString(),
+    },
+    identity: { email: mailbox.email, ...(mailbox.name === '' ? {} : { name: mailbox.name }) },
+  };
+}
+
+export class OutlookBrowserLogin {
+  readonly state = newState();
+  readonly authorizeUrl: string;
+  private readonly pkce: Pkce = pkcePair();
+  private used = false;
+  private readonly fetchImpl: FetchLike;
+  private readonly now: () => number;
+  private readonly mailbox: string | null;
+
+  constructor(deps: OutlookLoginDeps = {}) {
+    this.fetchImpl = deps.fetch ?? ((input, init) => fetch(input, init));
+    this.now = deps.now ?? Date.now;
+    this.mailbox = deps.mailbox ?? null;
+    this.authorizeUrl = authorizeUrl(this.pkce.challenge, this.state, this.mailbox);
+  }
+
+  async finish(code: string, state: string): Promise<OutlookLoginResult> {
+    if (state !== this.state)
+      throw new OutlookAuthError('This sign-in link belongs to another attempt. Start again from the Channels page.');
+    if (this.used) throw new OutlookAuthError('This sign-in was already used. Start again from the Channels page.');
+    this.used = true;
+    const { tokens, tenantId } = await redeemCode(code, this.pkce.verifier, this.fetchImpl, this.now());
+    return resultOf(tokens, tenantId, await verifyMailbox(tokens.accessToken, this.fetchImpl, this.mailbox), this.now());
+  }
+}
+
 export class OutlookLogin {
   private code: DeviceCode | null = null;
   private timer: ReturnType<typeof setTimeout> | null = null;
   private stopped = false;
   private readonly fetchImpl: FetchLike;
   private readonly now: () => number;
+  private readonly mailbox: string | null;
 
   constructor(private readonly events: OutlookLoginEvents, deps: OutlookLoginDeps = {}) {
     this.fetchImpl = deps.fetch ?? ((input, init) => fetch(input, init));
     this.now = deps.now ?? Date.now;
+    this.mailbox = deps.mailbox ?? null;
   }
 
   async start(): Promise<DeviceCode> {
@@ -94,19 +142,9 @@ export class OutlookLogin {
       this.fail(poll.message);
       return;
     }
-    const mailbox = await verifyMailbox(poll.tokens.accessToken, this.fetchImpl);
+    const mailbox = await verifyMailbox(poll.tokens.accessToken, this.fetchImpl, this.mailbox);
     if (this.stopped) return;
     this.stopped = true;
-    this.events.onDone({
-      config: {
-        accountEmail: mailbox.email,
-        refreshToken: poll.tokens.refreshToken,
-        accessToken: poll.tokens.accessToken,
-        expiresAt: poll.tokens.expiresAt,
-        tenantId: poll.tenantId,
-        createdAt: new Date(this.now()).toISOString(),
-      },
-      identity: { email: mailbox.email, ...(mailbox.name === '' ? {} : { name: mailbox.name }) },
-    });
+    this.events.onDone(resultOf(poll.tokens, poll.tenantId, mailbox, this.now()));
   }
 }

package/runtime/node_modules/@metro-labs/outlook/src/me.ts

@@ -8,7 +8,20 @@ export interface Mailbox {
 
 const text = (v: unknown): string => (typeof v === 'string' ? v.trim() : '');
 
-export async function verifyMailbox(accessToken: string, fetchImpl: FetchLike): Promise<Mailbox> {
+const MAILBOX_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+export function parseMailbox(value: unknown): string | null {
+  const mailbox = text(value).toLowerCase();
+  if (mailbox === '') return null;
+  if (!MAILBOX_RE.test(mailbox))
+    throw new OutlookAuthError('Type the whole address of the mailbox, like andy@company.com, or leave it blank.');
+  return mailbox;
+}
+
+const wrongMailbox = (actual: string, wanted: string): string =>
+  `You signed in as ${actual}, not ${wanted}. Nothing was connected. Start again and pick ${wanted} on Microsoft's page, or use "Use another account".`;
+
+export async function verifyMailbox(accessToken: string, fetchImpl: FetchLike, wanted: string | null = null): Promise<Mailbox> {
   let res: Response;
   try {
     res = await fetchImpl(`${graphBase()}/me?$select=mail,userPrincipalName,displayName`, {
@@ -19,7 +32,10 @@ export async function verifyMailbox(accessToken: string, fetchImpl: FetchLike):
   }
   if (!res.ok) throw new OutlookAuthError(`Microsoft Graph refused the new sign-in (${String(res.status)}), so nothing was connected.`);
   const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-  const email = text(body.mail) || text(body.userPrincipalName);
+  const mail = text(body.mail).toLowerCase();
+  const principal = text(body.userPrincipalName).toLowerCase();
+  const email = mail || principal;
   if (email === '') throw new OutlookAuthError('Microsoft Graph did not say which mailbox this is, so nothing was connected.');
-  return { email: email.toLowerCase(), name: text(body.displayName) };
+  if (wanted !== null && wanted !== mail && wanted !== principal) throw new OutlookAuthError(wrongMailbox(email, wanted));
+  return { email, name: text(body.displayName) };
 }

package/runtime/node_modules/@metro-labs/outlook/src/state.ts

@@ -1,6 +1,5 @@
-import { homedir } from 'node:os';
-import { join } from 'node:path';
 import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { accountFiles } from '@metro-labs/core/stations/account-files';
 
 export interface AccountState {
   accessToken: string;
@@ -13,12 +12,9 @@ export interface AccountState {
 
 const SEEN_MAX = 500;
 
-const safeSegment = (s: string): string => s.replace(/[^A-Za-z0-9_-]/g, '_');
+export const stateFiles = accountFiles('OUTLOOK_STATE_DIR', 'outlook-state-');
 
-export function statePath(accountId: string): string {
-  const dir = process.env.OUTLOOK_STATE_DIR ?? join(homedir(), '.metro');
-  return join(dir, `outlook-state-${safeSegment(accountId)}.json`);
-}
+const statePath =(accountId: string): string => stateFiles.path(accountId);
 
 const text = (v: unknown): string => (typeof v === 'string' ? v : '');
 const nullable = (v: unknown): string | null => (typeof v === 'string' && v !== '' ? v : null);

package/runtime/node_modules/@metro-labs/outlook/src/station.ts

@@ -1,4 +1,5 @@
 import type { ReadFilter, Station, Verb } from '@metro-labs/core/stations/types';
+import { stateFiles } from './state.js';
 
 export const outlookStation: Station = {
   name: 'outlook',
@@ -8,5 +9,7 @@ export const outlookStation: Station = {
   readFilters: new Set<ReadFilter>(['account', 'query', 'from', 'until', 'unread_only', 'message_id']),
   approvals: false,
   attachmentMode: 'canonical',
+  forget: stateFiles.forget,
+  forgetExcept: stateFiles.forgetExcept,
   tools: [],
 };

package/runtime/node_modules/@metro-labs/threema/src/groups.ts

@@ -1,6 +1,6 @@
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname } from 'node:path';
+import { accountFiles } from '@metro-labs/core/stations/account-files';
 import type { GroupRef } from './messages.js';
 
 export const GROUP_RE = /^([A-Z0-9]{8}|\*[A-Z0-9]{7})-([0-9a-f]{16})$/i;
@@ -19,8 +19,9 @@ export function parseGroupKey(resource: string): GroupRef | null {
   return m === null ? null : { creator: (m[1] ?? '').toUpperCase(), groupId: (m[2] ?? '').toLowerCase() };
 }
 
-const groupsFile = (accountId: string): string =>
-  join(process.env.THREEMA_GROUPS_DIR ?? join(homedir(), '.metro'), `threema-groups-${accountId}.json`);
+export const groupFiles = accountFiles('THREEMA_GROUPS_DIR', 'threema-groups-');
+
+const groupsFile = (accountId: string): string => groupFiles.path(accountId);
 
 function readRosters(accountId: string): Map<string, GroupRoster> {
   try {

package/runtime/node_modules/@metro-labs/threema/src/station.ts

@@ -1,4 +1,5 @@
 import type { Station, Verb } from '@metro-labs/core/stations/types';
+import { groupFiles } from './groups.js';
 
 export const threemaStation: Station = {
   name: 'threema',
@@ -6,5 +7,7 @@ export const threemaStation: Station = {
   hasTrain: true,
   messageVerbs: new Set<Verb>(['send', 'reply', 'react', 'unreact']),
   attachmentMode: 'canonical',
+  forget: groupFiles.forget,
+  forgetExcept: groupFiles.forgetExcept,
   tools: [],
 };

package/runtime/node_modules/@metro-labs/whatsapp/src/station.ts

@@ -1,5 +1,6 @@
 import type { Station, Verb } from '@metro-labs/core/stations/types';
 import { PROFILE_FIELDS, type ProfileField } from '@metro-labs/core/stations/profile';
+import { tokenFiles } from './token-store.js';
 
 export const whatsappStation: Station = {
   name: 'whatsapp',
@@ -17,5 +18,7 @@ export const whatsappStation: Station = {
   profileFields: new Set<ProfileField>(PROFILE_FIELDS),
   readsProfiles: true,
   resolvesSenders: true,
+  forget: tokenFiles.forget,
+  forgetExcept: tokenFiles.forgetExcept,
   tools: [],
 };

package/runtime/node_modules/@metro-labs/whatsapp/src/token-store.ts

@@ -1,6 +1,5 @@
-import { homedir } from 'node:os';
-import { join } from 'node:path';
 import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { accountFiles } from '@metro-labs/core/stations/account-files';
 import { errMsg } from '@metro-labs/core/log';
 
 export const PERSISTED_KEY_TYPES = ['tctoken', 'lid-mapping'] as const;
@@ -14,12 +13,9 @@ const WRITE_DEBOUNCE_MS = 1000;
 export const isPersistedKeyType = (type: string): boolean =>
   PERSISTED.has(type);
 
-const safeSegment = (s: string): string => s.replace(/[^A-Za-z0-9_-]/g, '_');
+export const tokenFiles = accountFiles('WHATSAPP_TOKEN_DIR', 'whatsapp-tokens-');
 
-export function tokenStorePath(accountId: string): string {
-  const dir = process.env.WHATSAPP_TOKEN_DIR ?? join(homedir(), '.metro');
-  return join(dir, `whatsapp-tokens-${safeSegment(accountId)}.json`);
-}
+export const tokenStorePath = (accountId: string): string => tokenFiles.path(accountId);
 
 export function persistedSubset(table: KeyTable): KeyTable {
   const out: KeyTable = {};

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.175"
+  "version": "0.1.0-beta.177"
 }