@stage-labs/metro 0.1.0-beta.180 → 0.1.0-beta.182

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.180",
+  "version": "0.1.0-beta.182",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.180",
+  "version": "0.1.0-beta.182",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/core/src/lines.ts

@@ -27,7 +27,7 @@ function parseAccountScoped(
 const isSnowflake = (s: string): boolean => /^\d+$/.test(s);
 const isThreemaResource = (s: string): boolean =>
   /^(?:[A-Z0-9]{8}|\*[A-Z0-9]{7})(?:-[0-9a-f]{16})?$/i.test(s);
-const isOutlookResource = (s: string): boolean => /^[A-Za-z0-9=_%.-]+$/.test(s);
+const isOutlookResource = (s: string): boolean => /^[A-Za-z0-9=_%.@+-]+$/.test(s);
 const isSignedInt = (s: string): boolean => /^-?\d+$/.test(s);
 
 function splitTelegramAccount(path: string[]): { accountId: string; rest: string[] } {

package/runtime/node_modules/@metro-labs/daemon/src/approvals/needs.ts

@@ -0,0 +1,2 @@
+export const NEEDS_APPROVAL = (where: string, tool: string): string =>
+  `Needs the owner's approval for ${where} (${tool}). Make this exact call from a background worker so Claude Code asks the owner in chat, and wait for the answer. An approval given only in the terminal does not count.`;

package/runtime/node_modules/@metro-labs/daemon/src/approvals/pending.ts

@@ -27,6 +27,27 @@ const HOUR_MS = 3_600_000;
 
 const held = new Map<string, Held>();
 
+interface Grant {
+  tool: string;
+  preview: string;
+  at: number;
+}
+
+const GRANT_TTL_MS = 10 * 60_000;
+const GRANTS_MAX = 200;
+let grants: Grant[] = [];
+
+function grant(entry: Held, now = Date.now()): void {
+  grants = [...grants.filter((g) => now - g.at < GRANT_TTL_MS), { tool: entry.tool, preview: entry.preview, at: now }].slice(-GRANTS_MAX);
+}
+
+export function takeGrant(toolMatches: (tool: string) => boolean, args: Record<string, unknown>, now = Date.now()): boolean {
+  const at = grants.findIndex((g) => now - g.at < GRANT_TTL_MS && toolMatches(g.tool) && previewMatches(g.preview, args));
+  if (at < 0) return false;
+  grants = grants.filter((_, i) => i !== at);
+  return true;
+}
+
 export function approvalTtlMs(env: NodeJS.ProcessEnv = process.env): number {
   const hours = Number(env.METRO_APPROVAL_TTL_H);
   return (Number.isFinite(hours) && hours > 0 ? hours : DEFAULT_TTL_H) * HOUR_MS;
@@ -82,6 +103,7 @@ export async function answerPrompt(
   const entry = held.get(requestId);
   if (entry === undefined) return undefined;
   held.delete(requestId);
+  if (behavior === 'allow' && via !== 'expiry') grant(entry);
   log.info({ requestId, tool: entry.tool, behavior, by: who === via ? via : `${via} ${who}` }, 'approvals: a Claude Code permission prompt answered');
   await entry.send(behavior);
   await tellChat(entry, via, behavior);
@@ -123,4 +145,5 @@ export function startPromptExpiry(): () => void {
 
 export function forgetAllPrompts(): void {
   held.clear();
+  grants = [];
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/gates.ts

@@ -1,6 +1,8 @@
 import type { ToolGroup } from '@metro-labs/core/stations/types';
 import { policyFor, setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
 import { serverKeysOf } from './plugin-sync.js';
+import { takeGrant } from '../approvals/pending.js';
+import { NEEDS_APPROVAL } from '../approvals/needs.js';
 
 interface GateRow {
   id: string;
@@ -39,11 +41,18 @@ export const connectorGates = (): readonly ConnectorGate[] => gates;
 
 export const toolGroupOf = (gate: ConnectorGate, tool: string): ToolGroup => (gate.tools[tool] === 'read' ? 'read' : 'write');
 
-export function blockedReason(connectorId: string, tool: string): string | null {
+const promptFor = (connectorId: string, tool: string) => (asked: string): boolean => {
+  const found = connectorToolOf(asked);
+  return found?.gate.id === connectorId && found.tool === tool;
+};
+
+export function blockedReason(connectorId: string, tool: string, args: Record<string, unknown> = {}): string | null {
   const gate = gates.find((g) => g.id === connectorId);
   if (gate === undefined) return null;
   const access = policyFor({ kind: 'connector', id: connectorId }, { name: tool, group: toolGroupOf(gate, tool) });
-  return access === 'deny' ? `Blocked by the owner's policy for ${gate.name} (${tool}).` : null;
+  if (access === 'deny') return `Blocked by the owner's policy for ${gate.name} (${tool}).`;
+  if (access === 'allow' || takeGrant(promptFor(connectorId, tool), args)) return null;
+  return NEEDS_APPROVAL(gate.name, tool);
 }
 
 function prefixesOf(gate: ConnectorGate): string[] {

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay-policy.ts

@@ -2,7 +2,7 @@ import type { ServerResponse } from 'node:http';
 import { isRecord } from '@metro-labs/core/is-record';
 import { log } from '@metro-labs/core/log';
 
-export type BlockedReason = (connectorId: string, tool: string) => string | null;
+export type BlockedReason = (connectorId: string, tool: string, args: Record<string, unknown>) => string | null;
 
 export interface Screened {
   forward: Uint8Array<ArrayBuffer> | null;
@@ -31,9 +31,14 @@ function blockedAnswer(message: Record<string, unknown>, reason: string): Record
   return { jsonrpc: '2.0', id: message.id, result: { isError: true, content: [{ type: 'text', text: reason }] } };
 }
 
+function argsOf(message: unknown): Record<string, unknown> {
+  if (!isRecord(message) || !isRecord(message.params)) return {};
+  return isRecord(message.params.arguments) ? message.params.arguments : {};
+}
+
 function reasonFor(message: unknown, connectorId: string, blocked: BlockedReason): string | null {
   const tool = toolOf(message);
-  return tool === null ? null : blocked(connectorId, tool);
+  return tool === null ? null : blocked(connectorId, tool, argsOf(message));
 }
 
 export function screenCalls(body: Uint8Array<ArrayBuffer>, connectorId: string, blocked: BlockedReason): Screened | null {

package/runtime/node_modules/@metro-labs/daemon/src/mcp/call-tools.ts

@@ -32,8 +32,14 @@ const withId = (text: string, messageId: string | undefined): string =>
 interface Sent {
   labels: string[];
   messageId?: string;
+  thread?: string;
 }
 
+const threadOf = (response: { result: unknown }, asked: string): string | undefined => {
+  const line = (response.result as { line?: unknown } | null)?.line;
+  return typeof line === 'string' && line !== '' && line !== asked ? line : undefined;
+};
+
 const deliveredLabels = (response: { result: unknown }): string[] => {
   const list = (response.result as { attachments?: unknown } | null)
     ?.attachments;
@@ -89,17 +95,20 @@ async function sendForwarded(
   const { line, ctx, station } = m;
   const args: Record<string, unknown> = { line };
   if (text) args.text = text;
+  if (typeof m.a.subject === 'string' && m.a.subject.trim() !== '') args.subject = m.a.subject;
   if (replyTo) args.replyTo = replyTo;
   if (atts.length) args.attachments = atts.map(toCanonical);
   const response = await ctx.call('send', args);
   const messageId = messageIdOf(response);
+  const thread = threadOf(response, line);
   const labels: string[] = [];
   if (text) labels.push('text');
-  if (!atts.length) return { labels, messageId };
-  const delivered = deliveredLabels(response);
-  assertDelivered(station, delivered, atts);
-  labels.push(...delivered);
-  return { labels, messageId };
+  if (atts.length) {
+    const delivered = deliveredLabels(response);
+    assertDelivered(station, delivered, atts);
+    labels.push(...delivered);
+  }
+  return thread === undefined ? { labels, messageId } : { labels, messageId, thread };
 }
 
 const unsupported = (station: Station, atts: CanonicalAttachment[]): string =>
@@ -132,7 +141,8 @@ async function handleSend(m: MessageArgs): Promise<ToolResult> {
     if (!sent.labels.length)
       return errResult('send requires `text` or `attachments`');
     noteSent(m, sent.messageId);
-    return ok(withId(`sent: ${sent.labels.join(', ')}`, sent.messageId));
+    const done = withId(`sent: ${sent.labels.join(', ')}`, sent.messageId);
+    return ok(sent.thread === undefined ? done : `${done} — new thread line: ${sent.thread}`);
   } finally {
     await cleanupAttachments(atts);
   }

package/runtime/node_modules/@metro-labs/daemon/src/mcp/policy-gate.ts

@@ -3,6 +3,9 @@ import type { ToolResult } from '@metro-labs/core/stations/types';
 import { accountFromLine, knownAccounts } from '../agents/map.js';
 import { policyFor, storedPolicy, strictest, type Access, type PolicyTarget } from '../policy/policy.js';
 import { errResult } from './ctx.js';
+import { takeGrant } from '../approvals/pending.js';
+import { NEEDS_APPROVAL } from '../approvals/needs.js';
+import { connectorToolOf } from '../connectors/gates.js';
 import { profileScopeLine } from './profile-lookup.js';
 import { stationOfAccount } from './read-tool.js';
 import { stationForTool, toolGroupOf } from './tool-catalog.js';
@@ -48,10 +51,13 @@ export function channelDecision(name: string, a: Record<string, unknown>): Polic
   return verdict;
 }
 
+const isChannelTool = (name: string) => (tool: string): boolean => tool.endsWith(`__${name}`) && connectorToolOf(tool) === undefined;
+
 export function policyGate(name: string, a: Record<string, unknown>): ToolResult | undefined {
   const { access, target } = channelDecision(name, a);
-  if (access !== 'deny' || target === undefined) return undefined;
-  return errResult(`Blocked by the owner's policy for ${target.station} (${name}).`);
+  if (access === 'allow' || target === undefined) return undefined;
+  if (access === 'deny') return errResult(`Blocked by the owner's policy for ${target.station} (${name}).`);
+  return takeGrant(isChannelTool(name), a) ? undefined : errResult(NEEDS_APPROVAL(target.station, name));
 }
 
 export interface EffectivePolicy {

package/runtime/node_modules/@metro-labs/daemon/src/mcp/tool-schemas.ts

@@ -34,7 +34,9 @@ export const COMMON_TOOLS: ToolDef[] = [
     group: 'write',
     description:
       'Send a message (and/or media) to a Metro conversation. Args: line, text?, reply_to?, ' +
-      'attachments?. The station is derived from the line. Each attachment names EXACTLY ONE ' +
+      'subject?, attachments?. The station is derived from the line. Outlook: send to ' +
+      'metro://outlook/<account>/<email address> to start a new email (subject defaults to the ' +
+      'first line of text); the result names the new thread line. Each attachment names EXACTLY ONE ' +
       'source, and the choice matters: `upload` (an `upload_id` from `create_upload`, the ' +
       'route for any real file on your own machine, confidential or not, up to 64 MiB); ' +
       '`data` (base64 inline -- TINY FILES ONLY, a few KB, because the base64 has to be ' +
@@ -55,6 +57,10 @@ export const COMMON_TOOLS: ToolDef[] = [
           type: 'string',
           description: 'Optional message_id to quote/reply to.',
         },
+        subject: {
+          type: 'string',
+          description: 'Outlook only: the subject of a new email.',
+        },
         attachments: {
           type: 'array',
           description: 'Optional files to attach.',

package/runtime/node_modules/@metro-labs/outlook/src/outbound.ts

@@ -2,7 +2,7 @@ import { respond } from '@metro-labs/core/stations/station-runtime';
 import { TrainError } from '@metro-labs/core/train-error';
 import { accountOf, type Account } from './accounts.js';
 import { assertSendable, attachFile, filesOf, type OutgoingFile } from './attachments.js';
-import { conversationOfLine } from './format.js';
+import { conversationOfLine, lineOf } from './format.js';
 import { graph, graphJson, jsonInit, messagePath, odataQuote, queryOf } from './graph.js';
 import { escapeHtml } from './html.js';
 
@@ -43,7 +43,46 @@ async function withFiles(acct: Account, target: string, verb: 'reply' | 'replyAl
   return labels;
 }
 
-async function answer(id: string, args: Args, verb: 'reply' | 'replyAll'): Promise<void> {
+const ADDRESS_RE = /^[^@\s/]+@[^@\s/]+\.[^@\s/]+$/;
+const SUBJECT_MAX = 255;
+
+export const isAddress = (target: string): boolean => target.includes('@');
+
+export function subjectOf(subject: string, text: string): string {
+  const chosen = subject !== '' ? subject : (text.split('\n').find((l) => l.trim() !== '') ?? '').trim();
+  if (chosen === '') throw new TrainError('outlook_subject_required', 'a new email needs a subject or some text', { retryable: false });
+  return chosen.length > SUBJECT_MAX ? `${chosen.slice(0, SUBJECT_MAX - 3)}...` : chosen;
+}
+
+async function compose(id: string, acct: Account, to: string, args: Args, text: string, files: OutgoingFile[]): Promise<void> {
+  if (!ADDRESS_RE.test(to)) throw new TrainError('outlook_bad_address', `not an email address: ${to}`, { retryable: false });
+  const draft = await graphJson<{ id?: string; conversationId?: string }>(acct, '/me/messages', jsonInit('POST', {
+    subject: subjectOf(str(args.subject), text),
+    body: { contentType: 'Text', content: text },
+    toRecipients: [{ emailAddress: { address: to } }],
+  }));
+  if (draft.id === undefined) throw new TrainError('outlook_graph_error', 'Outlook did not open a draft', { retryable: true });
+  const labels: string[] = [];
+  try {
+    for (const file of files) labels.push(await attachFile(acct, draft.id, file));
+    await graph(acct, `${messagePath(draft.id)}/send`, { method: 'POST' });
+  } catch (err) {
+    await discard(acct, draft.id);
+    throw err;
+  }
+  const line = draft.conversationId === undefined ? undefined : lineOf(acct.id, draft.conversationId);
+  respond(id, { result: { account: acct.id, messageId: draft.id, ...(line === undefined ? {} : { line }), ...(labels.length > 0 ? { attachments: labels } : {}) } });
+}
+
+interface Outgoing {
+  target: string;
+  acct: Account;
+  files: OutgoingFile[];
+  text: string;
+  replyTo: string;
+}
+
+async function outgoing(args: Args): Promise<Outgoing> {
   const line = str(args.line);
   const parsed = conversationOfLine(line);
   if (parsed === null) throw new TrainError('outlook_bad_line', `not an outlook line: ${line}`, { retryable: false });
@@ -53,8 +92,18 @@ async function answer(id: string, args: Args, verb: 'reply' | 'replyAll'): Promi
   if (text.trim() === '' && files.length === 0)
     throw new TrainError('outlook_text_required', 'give some text or a file to send', { retryable: false });
   await assertSendable(files);
-  const replyTo = str(args.replyTo);
-  const target = replyTo === '' ? await latestInConversation(acct, parsed.conversationId) : replyTo;
+  return { target: parsed.conversationId, acct, files, text, replyTo: str(args.replyTo) };
+}
+
+async function answer(id: string, args: Args, verb: 'reply' | 'replyAll'): Promise<void> {
+  const { target: conversation, acct, files, text, replyTo } = await outgoing(args);
+  if (isAddress(conversation)) {
+    if (verb === 'reply' || replyTo !== '')
+      throw new TrainError('outlook_reply_needs_thread', 'reply on the thread\'s own line; an address line starts a new email', { retryable: false });
+    await compose(id, acct, conversation.toLowerCase(), args, text, files);
+    return;
+  }
+  const target = replyTo === '' ? await latestInConversation(acct, conversation) : replyTo;
   const comment = escapeHtml(text);
   let labels: string[] = [];
   if (files.length === 0) await graph(acct, `${messagePath(target)}/${verb}`, jsonInit('POST', { comment }));

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.180"
+  "version": "0.1.0-beta.182"
 }