@stage-labs/metro 0.1.0-beta.177 → 0.1.0-beta.179

package/dist/onboarding.js

@@ -28,16 +28,17 @@ export function markOnboardingDone(path = claudeConfigPath()) {
     return 'marked';
 }
 const FEATURES = 'cachedGrowthBookFeatures';
-const CHANNELS_FLAG = 'tengu_harbor';
+const CHANNEL_FLAGS = ['tengu_harbor', 'tengu_harbor_permissions'];
 const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 export function seedChannels(path = claudeConfigPath()) {
     const config = readConfig(path);
     if (config === null)
         return 'unreadable';
     const features = isRecord(config[FEATURES]) ? config[FEATURES] : {};
-    if (features[CHANNELS_FLAG] === true)
+    if (CHANNEL_FLAGS.every((flag) => features[flag] === true))
         return 'already';
-    const next = { ...config, [FEATURES]: { ...features, [CHANNELS_FLAG]: true } };
+    const seeded = Object.fromEntries(CHANNEL_FLAGS.map((flag) => [flag, true]));
+    const next = { ...config, [FEATURES]: { ...features, ...seeded } };
     writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
     return 'marked';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.177",
+  "version": "0.1.0-beta.179",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.177",
+  "version": "0.1.0-beta.179",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/marketplace/plugin/bin/guard.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { readFileSync } from 'node:fs';
+import { policyVerdict } from './policy.mjs';
 
 const BLOCKING = new Set(['AskUserQuestion', 'ExitPlanMode', 'EnterPlanMode']);
 const ORCHESTRATION = new Set([
@@ -23,15 +24,26 @@ const IMAGE = /\.(png|jpe?g|gif|webp|bmp)$/i;
 const MCP = /^mcp__/;
 const METRO_MCP = /^mcp__metro__/;
 
-function deny(reason) {
+function answer(decision, reason) {
   process.stdout.write(
-    `${JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } })}\n`,
+    `${JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: decision, permissionDecisionReason: reason } })}\n`,
   );
 }
 
-function verdict(payload) {
+function ownerPolicy(tool, input, subagent) {
+  const verdict = policyVerdict(tool, input);
+  if (verdict === null) return null;
+  const { where } = verdict;
+  if (verdict.access === 'deny') return { decision: 'deny', reason: `Blocked by the owner's policy for ${verdict.owner} (${verdict.tool}).` };
+  if (subagent) return { decision: 'ask', reason: `The owner asked to approve ${where}.` };
+  return {
+    decision: 'deny',
+    reason: `${where} needs the owner's approval, and waiting for it here would stop the whole session. Run this exact call from a background worker (Agent, run_in_background: true): the worker waits for the owner's answer while you keep answering.`,
+  };
+}
+
+function verdict(payload, input) {
   const tool = typeof payload.tool_name === 'string' ? payload.tool_name : '';
-  const input = payload.tool_input !== null && typeof payload.tool_input === 'object' ? payload.tool_input : {};
   if (BLOCKING.has(tool))
     return `${tool} blocks the session waiting on the terminal, and nobody is watching it. Decide with your best judgement and state the assumption, or ask over chat with the metro tools and keep working in the meantime.`;
   if (typeof payload.agent_id === 'string' && payload.agent_id !== '') return null;
@@ -51,5 +63,9 @@ try {
 } catch {
   payload = {};
 }
-const reason = verdict(payload !== null && typeof payload === 'object' ? payload : {});
-if (reason !== null) deny(reason);
+const shaped = payload !== null && typeof payload === 'object' ? payload : {};
+const input = shaped.tool_input !== null && typeof shaped.tool_input === 'object' ? shaped.tool_input : {};
+const reason = verdict(shaped, input);
+const policy = reason === null && typeof shaped.tool_name === 'string' ? ownerPolicy(shaped.tool_name, input, typeof shaped.agent_id === 'string' && shaped.agent_id !== '') : null;
+if (reason !== null) answer('deny', reason);
+else if (policy !== null) answer(policy.decision, policy.reason);

package/runtime/marketplace/plugin/bin/policy.mjs

@@ -0,0 +1,97 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const METRO_TOOL = /^mcp__metro__(.+)$/;
+const RANK = { allow: 0, ask: 1, deny: 2 };
+const LINE_FIELD = { get_profile: 'from' };
+const STATION_ARG = new Set(['create_group', 'set_profile']);
+
+const isRecord = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+const text = (v) => (typeof v === 'string' ? v : '');
+const agentsDir = () => process.env.METRO_AGENTS_DIR?.trim() || join(homedir(), '.metro', 'agents');
+
+function readSnapshot() {
+  try {
+    const parsed = JSON.parse(readFileSync(join(agentsDir(), 'policy.json'), 'utf8'));
+    return isRecord(parsed) && parsed.version === 1 ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+const fromLine = (line, override) => {
+  const parts = line.split('/');
+  return line.startsWith('metro://') && parts[2] && parts[3] ? [{ station: parts[2], account: override || parts[3] }] : [];
+};
+
+function stationOfAccount(snap, account) {
+  const hits = Object.entries(isRecord(snap.stations) ? snap.stations : {}).filter(
+    ([, ids]) => Array.isArray(ids) && ids.includes(account),
+  );
+  return hits.length === 1 ? hits[0][0] : undefined;
+}
+
+function targets(snap, name, input) {
+  if (Array.isArray(snap.ungated) && snap.ungated.includes(name)) return [];
+  const account = text(input.account);
+  const line = text(input[LINE_FIELD[name] ?? 'line']);
+  if (line) return fromLine(line, name in LINE_FIELD ? '' : account);
+  const owners = isRecord(snap.owners) ? snap.owners : {};
+  const station = (STATION_ARG.has(name) ? text(input.station) : text(owners[name])) || (account ? stationOfAccount(snap, account) : undefined);
+  if (!station) return [];
+  if (account) return [{ station, account }];
+  const ids = isRecord(snap.stations) && Array.isArray(snap.stations[station]) ? snap.stations[station] : [];
+  return ids.map((id) => ({ station, account: id }));
+}
+
+function decide(policy, name, group) {
+  if (!isRecord(policy)) return 'allow';
+  const byTool = isRecord(policy.tools) ? policy.tools[name] : undefined;
+  const access = byTool ?? policy[group] ?? 'allow';
+  return access in RANK ? access : 'allow';
+}
+
+const normalized = (name) => name.replace(/[^a-zA-Z0-9_-]/g, '_');
+
+function connectorCall(snap, toolName) {
+  for (const [server, entry] of Object.entries(isRecord(snap.connectors) ? snap.connectors : {})) {
+    if (!isRecord(entry)) continue;
+    const name = text(entry.name);
+    const prefixes = [`mcp__plugin_metro_${server}__`, `mcp__${server}__`, `mcp__${normalized(`metro.box ${name}`)}__`];
+    const prefix = prefixes.find((p) => toolName.startsWith(p) && toolName.length > p.length);
+    if (prefix === undefined) continue;
+    const called = toolName.slice(prefix.length);
+    const tools = isRecord(entry.tools) ? entry.tools : {};
+    const policy = isRecord(entry.policy) ? entry.policy : {};
+    const known = [...Object.keys(tools), ...Object.keys(isRecord(policy.tools) ? policy.tools : {})];
+    const tool = known.find((k) => k === called) ?? known.find((k) => normalized(k) === called) ?? called;
+    return { name: name || server, tool, group: tools[tool] === 'read' ? 'read' : 'write', policy };
+  }
+  return null;
+}
+
+function connectorVerdict(snap, toolName) {
+  const call = connectorCall(snap, toolName);
+  if (call === null) return null;
+  const access = decide(call.policy, call.tool, call.group);
+  return access === 'allow' ? null : { access, tool: call.tool, owner: call.name, where: `${call.tool} on ${call.name}` };
+}
+
+export function policyVerdict(toolName, input) {
+  const name = METRO_TOOL.exec(toolName)?.[1];
+  if (name === undefined && !toolName.startsWith('mcp__')) return null;
+  const snap = readSnapshot();
+  if (snap === null) return null;
+  if (name === undefined) return connectorVerdict(snap, toolName);
+  const tools = isRecord(snap.tools) ? snap.tools : {};
+  const group = tools[name] === 'read' ? 'read' : 'write';
+  const accounts = isRecord(snap.accounts) ? snap.accounts : {};
+  let verdict = null;
+  for (const target of targets(snap, name, input)) {
+    const access = decide(accounts[`${target.station}/${target.account}`], name, group);
+    if (access !== 'allow' && (verdict === null || RANK[access] > RANK[verdict.access]))
+      verdict = { access, tool: name, owner: target.station, where: `${name} on ${target.station} (${target.account})` };
+  }
+  return verdict;
+}

package/runtime/marketplace/plugin/orchestrator.md

@@ -11,6 +11,8 @@ You are the main thread of a Claude Code session that is connected to chat throu
 
 **Never wait on the terminal.** `AskUserQuestion`, plan mode and anything that blocks for a person at the keyboard are denied everywhere, main thread and subagents alike. When something is ambiguous, do what does not depend on it, choose the most reasonable reading, say so in your reply, and if a real decision is needed ask over chat with `send` and carry on. Tool-approval prompts reach the chat too; the person answers `yes <id>` or `no <id>` there.
 
+**Calls that need the owner's approval run in a worker.** The owner can make a metro tool on a channel wait for approval. On the main thread such a call is refused, because waiting for the answer would stop the whole session: hand that exact call to a background worker (`run_in_background: true`) and keep answering. The worker waits for the owner's answer on its own.
+
 **Finish what was asked.** You work on your own. Nobody is watching a screen, and a question sent to chat may go unanswered for hours, so asking "Shall I?" about work already requested simply stops it. Anything reversible that follows from the request, do. Stop only for a destructive action or a genuine change of scope. Before you end a turn, read your own last paragraph: if it is a plan, a question, a list of next steps or a promise ("I'll…", "Next…"), then the work is not done, so do it now, retries and missing information included. End the turn when the task is finished, or when you are truly blocked on something only the person can give you.
 
 The exception is a person describing a problem, asking a question or thinking out loud. There the answer IS the deliverable: reply, and change nothing until they ask.

package/runtime/node_modules/@metro-labs/core/src/stations/types.ts

@@ -34,10 +34,14 @@ export interface ToolContext {
   readFile(path: string): Promise<Buffer>;
 }
 
+export type ToolGroup = 'read' | 'write';
+
 export interface StationTool {
   name: string;
   description: string;
   inputSchema: Record<string, unknown>;
+  group?: ToolGroup;
+  destructive?: boolean;
   handle(args: Record<string, unknown>, ctx: ToolContext): Promise<ToolResult>;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/agents/account-routes.ts

@@ -11,6 +11,7 @@ export type AccountRoute =
   | { kind: 'senders'; station: StationName; accountId: string }
   | { kind: 'resolve'; station: StationName; accountId: string }
   | { kind: 'enabled'; station: StationName; accountId: string }
+  | { kind: 'policy'; station: StationName; accountId: string }
   | { kind: 'name'; station: StationName; accountId: string };
 
 const ROUTE_METHODS: Record<AccountRoute['kind'], string[]> = {
@@ -22,10 +23,11 @@ const ROUTE_METHODS: Record<AccountRoute['kind'], string[]> = {
   senders: ['GET'],
   resolve: ['GET'],
   enabled: ['PUT'],
+  policy: ['PUT'],
   name: ['GET', 'POST'],
 };
 
-const SUB_ROUTES = ['allowlist', 'senders', 'resolve', 'enabled', 'name'] as const;
+const SUB_ROUTES = ['allowlist', 'senders', 'resolve', 'enabled', 'name', 'policy'] as const;
 
 type SubRoute = (typeof SUB_ROUTES)[number];
 

package/runtime/node_modules/@metro-labs/daemon/src/agents/accounts-api.ts

@@ -11,6 +11,7 @@ import {
 } from '@metro-labs/http/api-http';
 import { type AccountRef } from './account-attach.js';
 import { type AccountRoute } from './account-routes.js';
+import { handlePolicy, type SetPolicy } from './policy-route.js';
 import { stationByName } from '../stations/registry.js';
 import type { StationName } from '@metro-labs/core/station-names';
 import {
@@ -68,6 +69,7 @@ export interface AccountApiDeps {
     accountId: string,
     allowlist: string[],
   ) => Promise<string[]>;
+  setPolicy: SetPolicy;
   recentSenders: (station: StationName, accountId: string) => RecentSender[];
   resolveSender: (
     station: StationName,
@@ -175,7 +177,7 @@ async function storeAccount(
 
 function asInput(body: unknown): Record<string, unknown> {
   const out: Record<string, unknown> = {};
-  for (const key of ['apiId', 'apiHash', 'phone'])
+  for (const key of ['apiId', 'apiHash', 'phone', 'mailbox'])
     out[key] = bodyField(body, key);
   return out;
 }
@@ -365,6 +367,7 @@ async function dispatchRoute(
     return handleStep(req, res, deps, { agentId }, route.attachId);
   if (route.kind === 'allowlist') return handleAllowlist(req, res, deps, agentId, route);
   if (route.kind === 'enabled') return handleEnabled(req, res, deps, agentId, route);
+  if (route.kind === 'policy') return handlePolicy(req, res, deps, agentId, route);
   if (route.kind === 'resolve') return handleResolve(req, res, deps, route);
   if (route.kind === 'name') return handleName(req, res, deps, route);
   if (route.kind === 'senders') {

package/runtime/node_modules/@metro-labs/daemon/src/agents/api.ts

@@ -23,6 +23,7 @@ export interface AgentApiDeps extends AccountApiDeps {
     unavailable: string[];
   }>;
   capabilities: () => Record<string, string[]>;
+  toolGroups?: () => Record<string, { name: string; group: string }[]>;
   attachable?: string[];
   connectorIds: (agentIds: string[]) => Promise<Map<string, string[]>>;
 }
@@ -69,6 +70,7 @@ async function handleList(
     agents: list.map((a) => agentPayload(a, connectors)),
     capabilities: deps.capabilities(),
     attachable: deps.attachable ?? ATTACHABLE,
+    ...(deps.toolGroups === undefined ? {} : { tools: deps.toolGroups() }),
   };
   if (!wantsAccounts(req)) {
     sendJson(req, res, 200, base);

package/runtime/node_modules/@metro-labs/daemon/src/agents/bundle.ts

@@ -1,3 +1,4 @@
+import { parsePolicy } from '../policy/policy.js';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from '@metro-labs/core/log';
 import { apiFailure, apiSession, cors, readJsonBody, requireAdmin, sendJson } from '@metro-labs/http/api-http';
@@ -54,7 +55,15 @@ function stationOf(raw: unknown): LoadedAccount {
   const allowlist = Array.isArray(raw.allowlist)
     ? raw.allowlist.filter((s): s is string => typeof s === 'string')
     : null;
-  return { station: raw.station as LoadedAccount['station'], id: raw.id, allowlist, enabled: raw.enabled !== false, config: raw.config };
+  const policy = parsePolicy(raw.policy, `bundle ${raw.station}/${raw.id}`);
+  return {
+    station: raw.station as LoadedAccount['station'],
+    id: raw.id,
+    allowlist,
+    enabled: raw.enabled !== false,
+    ...(policy === undefined ? {} : { policy }),
+    config: raw.config,
+  };
 }
 
 function connectorOf(raw: unknown): LoadedConnector {

package/runtime/node_modules/@metro-labs/daemon/src/agents/file-admin.ts

@@ -24,6 +24,7 @@ import { newId } from '@metro-labs/core/ids';
 import { registerKey } from './keys.js';
 import { MOVABLE_STATIONS, type LoadedAgent } from '../stations/materialize.js';
 import type { StationName } from '@metro-labs/core/station-names';
+import type { ToolPolicy } from '../policy/policy.js';
 
 const OWNER_FILE = '.owner';
 
@@ -252,6 +253,22 @@ export async function localSetAllowlist(
   return Promise.resolve(allowlist);
 }
 
+export async function localSetPolicy(
+  agentId: string,
+  station: StationName,
+  accountId: string,
+  policy: ToolPolicy,
+  dir = agentsDir(),
+): Promise<ToolPolicy> {
+  const stored = agentOrThrow(agentId, dir);
+  const account = stored.file.stations.find((a) => a.station === station && a.id === accountId);
+  if (account === undefined) throw new AgentAdminError('no such account on this agent', 404);
+  if (policy.read === undefined && policy.write === undefined && policy.tools === undefined) delete account.policy;
+  else account.policy = policy;
+  save(stored);
+  return Promise.resolve(policy);
+}
+
 export async function localSetAccountEnabled(
   agentId: string,
   station: StationName,

package/runtime/node_modules/@metro-labs/daemon/src/agents/files.ts

@@ -6,6 +6,7 @@ import { AGENT_NAME_RE, ID_RE } from '@metro-labs/core/ids';
 import { STATIONS, type StationName } from '@metro-labs/core/station-names';
 import type { LoadedAccount, LoadedAgent, StationSource } from '../stations/materialize.js';
 import { isRecord } from '@metro-labs/core/is-record';
+import { parsePolicy } from '../policy/policy.js';
 
 export const AGENT_FILE = 'agent.json';
 
@@ -56,7 +57,15 @@ function stationOf(raw: unknown, path: string, index: number): LoadedAccount {
   if (typeof id !== 'string' || !ID_RE.test(id))
     fail(path, `${where}.id is not an 11-character id`);
   if (!isRecord(config)) fail(path, `${where}.config is not an object`);
-  return { station, id, allowlist: allowlistOf(raw.allowlist, path, where), enabled: raw.enabled !== false, config };
+  const policy = parsePolicy(raw.policy, `${path} ${where}`);
+  return {
+    station,
+    id,
+    allowlist: allowlistOf(raw.allowlist, path, where),
+    enabled: raw.enabled !== false,
+    ...(policy === undefined ? {} : { policy }),
+    config,
+  };
 }
 
 function optionalMatch(

package/runtime/node_modules/@metro-labs/daemon/src/agents/policy-route.ts

@@ -0,0 +1,27 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from '@metro-labs/core/log';
+import { bodyField, readJsonBody, sendJson } from '@metro-labs/http/api-http';
+import type { StationName } from '@metro-labs/core/station-names';
+import { normalizePolicy, type ToolPolicy } from '../policy/policy.js';
+
+export type SetPolicy = (agentId: string, station: StationName, accountId: string, policy: ToolPolicy) => Promise<ToolPolicy>;
+
+export async function handlePolicy(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: { setPolicy: SetPolicy; reloadAgents: () => Promise<void> },
+  agentId: string,
+  target: { station: StationName; accountId: string },
+): Promise<void> {
+  const wanted = normalizePolicy(bodyField(await readJsonBody(req), 'policy'));
+  const policy = await deps.setPolicy(agentId, target.station, target.accountId, wanted);
+  log.info({ agentId, station: target.station, account: target.accountId, policy }, 'account-api: tool policy set');
+  const activated = await deps.reloadAgents().then(
+    () => true,
+    (err: unknown) => {
+      log.warn({ err: errMsg(err) }, 'account-api: policy reload failed, the change lands at the next boot');
+      return false;
+    },
+  );
+  sendJson(req, res, 200, { agentId, station: target.station, accountId: target.accountId, policy, activated });
+}

package/runtime/node_modules/@metro-labs/daemon/src/approvals/api.ts

@@ -0,0 +1,55 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { apiFailure, apiSession, bodyField, cors, readJsonBody, sendJson } from '@metro-labs/http/api-http';
+import { answerPrompt, pendingPrompts, type Behavior, type PendingPrompt } from './pending.js';
+
+const PREFIX = '/api/approvals';
+const ID_RE = /^[a-km-z]{5}$/;
+
+const approvalView = (p: PendingPrompt): Record<string, unknown> => ({
+  id: p.requestId,
+  tool: p.tool,
+  description: p.description,
+  preview: p.preview,
+  line: p.line ?? null,
+  requestedAt: new Date(p.at).toISOString(),
+});
+
+function decisionOf(body: unknown): Behavior {
+  const value = bodyField(body, 'decision');
+  if (value !== 'allow' && value !== 'deny') throw new ApiError("decision is 'allow' or 'deny'", 400);
+  return value;
+}
+
+async function answer(req: IncomingMessage, id: string | undefined, subject: string): Promise<unknown> {
+  if (id === undefined) {
+    if (req.method !== 'GET') throw new ApiError('method not allowed', 405);
+    return { approvals: pendingPrompts().map(approvalView) };
+  }
+  if (req.method !== 'POST') throw new ApiError('method not allowed', 405);
+  if (!ID_RE.test(id)) throw new ApiError('no such approval', 404);
+  const decision = decisionOf(await readJsonBody(req));
+  const answered = await answerPrompt(id, decision, 'page', subject);
+  if (answered === undefined) throw new ApiError('no such approval', 404);
+  return { approval: approvalView(answered), decision };
+}
+
+export function handleApprovalsRequest(req: IncomingMessage, res: ServerResponse): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PREFIX && !path.startsWith(`${PREFIX}/`)) return false;
+  const rest = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
+  if (rest.length > 1) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  apiSession(req)
+    .then(async (session) => {
+      if (!session) throw new ApiError('unauthorized', 401);
+      sendJson(req, res, 200, await answer(req, rest[0], session.subject));
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'approvals-api');
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/approvals/pending.ts

@@ -0,0 +1,126 @@
+import { errMsg, log } from '@metro-labs/core/log';
+import { previewMatches } from './preview.js';
+
+export type Behavior = 'allow' | 'deny';
+
+export type AnsweredVia = 'chat' | 'page' | 'expiry';
+
+export interface PendingPrompt {
+  requestId: string;
+  tool: string;
+  description: string;
+  preview: string;
+  line: string | undefined;
+  at: number;
+}
+
+interface Held extends PendingPrompt {
+  owner: object;
+  send: (behavior: Behavior) => Promise<void>;
+  tell: ((text: string) => Promise<void>) | undefined;
+}
+
+const PENDING_MAX = 500;
+const SWEEP_MS = 60_000;
+const DEFAULT_TTL_H = 24;
+const HOUR_MS = 3_600_000;
+
+const held = new Map<string, Held>();
+
+export function approvalTtlMs(env: NodeJS.ProcessEnv = process.env): number {
+  const hours = Number(env.METRO_APPROVAL_TTL_H);
+  return (Number.isFinite(hours) && hours > 0 ? hours : DEFAULT_TTL_H) * HOUR_MS;
+}
+
+const shown = ({ requestId, tool, description, preview, line, at }: Held): PendingPrompt => ({
+  requestId,
+  tool,
+  description,
+  preview,
+  line,
+  at,
+});
+
+export function holdPrompt(
+  prompt: PendingPrompt,
+  owner: object,
+  send: (behavior: Behavior) => Promise<void>,
+  tell?: (text: string) => Promise<void>,
+): void {
+  held.set(prompt.requestId, { ...prompt, owner, send, tell });
+  while (held.size > PENDING_MAX) {
+    const oldest = held.keys().next();
+    if (oldest.done) break;
+    held.delete(oldest.value);
+  }
+}
+
+export const pendingPrompts = (): PendingPrompt[] => [...held.values()].map(shown).sort((a, b) => b.at - a.at);
+
+export const promptLine = (requestId: string): string | undefined => held.get(requestId)?.line;
+
+function chatNotice(via: AnsweredVia, behavior: Behavior): string | undefined {
+  if (via === 'expiry') return 'Expired, denied.';
+  if (via === 'page') return behavior === 'allow' ? 'Approved on the page.' : 'Denied on the page.';
+  return undefined;
+}
+
+async function tellChat(entry: Held, via: AnsweredVia, behavior: Behavior): Promise<void> {
+  const text = chatNotice(via, behavior);
+  if (text === undefined || entry.tell === undefined) return;
+  await entry.tell(text).catch((err: unknown) => {
+    log.warn({ requestId: entry.requestId, err: errMsg(err) }, 'approvals: the chat could not be told the answer');
+  });
+}
+
+export async function answerPrompt(
+  requestId: string,
+  behavior: Behavior,
+  via: AnsweredVia,
+  who: string = via,
+): Promise<PendingPrompt | undefined> {
+  const entry = held.get(requestId);
+  if (entry === undefined) return undefined;
+  held.delete(requestId);
+  log.info({ requestId, tool: entry.tool, behavior, by: who === via ? via : `${via} ${who}` }, 'approvals: a Claude Code permission prompt answered');
+  await entry.send(behavior);
+  await tellChat(entry, via, behavior);
+  return shown(entry);
+}
+
+export function forgetPromptsOf(owner: object): void {
+  for (const [id, entry] of held) if (entry.owner === owner) held.delete(id);
+}
+
+export function settlePromptsFor(name: string, args: Record<string, unknown>): void {
+  for (const [id, entry] of held)
+    if (entry.tool.endsWith(`__${name}`) && previewMatches(entry.preview, args)) {
+      held.delete(id);
+      log.info({ requestId: id, tool: entry.tool }, 'approvals: the call ran, so the prompt was answered in Claude Code');
+    }
+}
+
+export async function expirePrompts(now = Date.now(), ttl = approvalTtlMs()): Promise<number> {
+  const overdue = [...held.values()].filter((entry) => now - entry.at >= ttl);
+  for (const entry of overdue)
+    await answerPrompt(entry.requestId, 'deny', 'expiry').catch((err: unknown) => {
+      log.warn({ requestId: entry.requestId, err: errMsg(err) }, 'approvals: the expiry answer could not be sent');
+    });
+  return overdue.length;
+}
+
+export function startPromptExpiry(): () => void {
+  const timer = setInterval(() => {
+    expirePrompts().catch((err: unknown) => {
+      log.warn({ err: errMsg(err) }, 'approvals: the expiry sweep failed');
+    });
+  }, SWEEP_MS);
+  timer.unref();
+  return () => {
+    clearInterval(timer);
+  };
+}
+
+export function forgetAllPrompts(): void {
+  held.clear();
+}

package/runtime/node_modules/@metro-labs/daemon/src/approvals/preview.ts

@@ -0,0 +1,66 @@
+import { isDeepStrictEqual } from 'node:util';
+import { isRecord } from '@metro-labs/core/is-record';
+
+export const ELIDED = '\u0000';
+
+const CODE_POINTS = /(?:\\n|\n)⋯ \d+ code points elided ⋯(?:\\n|\n)/g;
+const FIELD_BLOCK = /[\s,]*(?:\\n|\n)?\s*⋯[^]*$/;
+
+export interface ReadPreview {
+  input: Record<string, unknown> | undefined;
+  partial: boolean;
+}
+
+function parsedRecord(text: string): Record<string, unknown> | undefined {
+  try {
+    const parsed: unknown = JSON.parse(text);
+    return isRecord(parsed) ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function readPreview(preview: string): ReadPreview {
+  const text = preview.replace(CODE_POINTS, '\\u0000');
+  const whole = parsedRecord(text);
+  if (whole !== undefined) return { input: whole, partial: false };
+  if (!text.includes('⋯')) return { input: undefined, partial: false };
+  const head = text.replace(FIELD_BLOCK, '').replace(/[\s,]*$/, '');
+  const input = parsedRecord(`${head}}`) ?? parsedRecord(head);
+  return { input, partial: input !== undefined };
+}
+
+export const shownValue = (text: string): string => text.split(ELIDED).join('…');
+
+function stringMatches(shown: string, real: string): boolean {
+  if (!shown.includes(ELIDED)) return shown === real;
+  const [first = '', ...rest] = shown.split(ELIDED);
+  const last = rest.pop() ?? '';
+  if (!real.startsWith(first) || !real.endsWith(last)) return false;
+  let at = first.length;
+  for (const part of rest) {
+    const found = real.indexOf(part, at);
+    if (found < 0) return false;
+    at = found + part.length;
+  }
+  return at <= real.length - last.length;
+}
+
+function valueMatches(shown: unknown, real: unknown): boolean {
+  if (typeof shown === 'string') return typeof real === 'string' && stringMatches(shown, real);
+  if (Array.isArray(shown))
+    return Array.isArray(real) && shown.length === real.length && shown.every((v, i) => valueMatches(v, real[i]));
+  if (isRecord(shown)) return isRecord(real) && recordMatches(shown, real, false);
+  return isDeepStrictEqual(shown, real);
+}
+
+function recordMatches(shown: Record<string, unknown>, real: Record<string, unknown>, partial: boolean): boolean {
+  const keys = Object.keys(shown);
+  if (!partial && keys.length !== Object.keys(real).length) return false;
+  return keys.every((key) => key in real && valueMatches(shown[key], real[key]));
+}
+
+export function previewMatches(preview: string, args: Record<string, unknown>): boolean {
+  const { input, partial } = readPreview(preview);
+  return input !== undefined && recordMatches(input, args, partial);
+}