@stage-labs/metro 0.1.0-beta.181 → 0.1.0-beta.182

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.181",
+  "version": "0.1.0-beta.182",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.181",
+  "version": "0.1.0-beta.182",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/approvals/needs.ts

@@ -0,0 +1,2 @@
+export const NEEDS_APPROVAL = (where: string, tool: string): string =>
+  `Needs the owner's approval for ${where} (${tool}). Make this exact call from a background worker so Claude Code asks the owner in chat, and wait for the answer. An approval given only in the terminal does not count.`;

package/runtime/node_modules/@metro-labs/daemon/src/approvals/pending.ts

@@ -27,6 +27,27 @@ const HOUR_MS = 3_600_000;
 
 const held = new Map<string, Held>();
 
+interface Grant {
+  tool: string;
+  preview: string;
+  at: number;
+}
+
+const GRANT_TTL_MS = 10 * 60_000;
+const GRANTS_MAX = 200;
+let grants: Grant[] = [];
+
+function grant(entry: Held, now = Date.now()): void {
+  grants = [...grants.filter((g) => now - g.at < GRANT_TTL_MS), { tool: entry.tool, preview: entry.preview, at: now }].slice(-GRANTS_MAX);
+}
+
+export function takeGrant(toolMatches: (tool: string) => boolean, args: Record<string, unknown>, now = Date.now()): boolean {
+  const at = grants.findIndex((g) => now - g.at < GRANT_TTL_MS && toolMatches(g.tool) && previewMatches(g.preview, args));
+  if (at < 0) return false;
+  grants = grants.filter((_, i) => i !== at);
+  return true;
+}
+
 export function approvalTtlMs(env: NodeJS.ProcessEnv = process.env): number {
   const hours = Number(env.METRO_APPROVAL_TTL_H);
   return (Number.isFinite(hours) && hours > 0 ? hours : DEFAULT_TTL_H) * HOUR_MS;
@@ -82,6 +103,7 @@ export async function answerPrompt(
   const entry = held.get(requestId);
   if (entry === undefined) return undefined;
   held.delete(requestId);
+  if (behavior === 'allow' && via !== 'expiry') grant(entry);
   log.info({ requestId, tool: entry.tool, behavior, by: who === via ? via : `${via} ${who}` }, 'approvals: a Claude Code permission prompt answered');
   await entry.send(behavior);
   await tellChat(entry, via, behavior);
@@ -123,4 +145,5 @@ export function startPromptExpiry(): () => void {
 
 export function forgetAllPrompts(): void {
   held.clear();
+  grants = [];
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/gates.ts

@@ -1,6 +1,8 @@
 import type { ToolGroup } from '@metro-labs/core/stations/types';
 import { policyFor, setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
 import { serverKeysOf } from './plugin-sync.js';
+import { takeGrant } from '../approvals/pending.js';
+import { NEEDS_APPROVAL } from '../approvals/needs.js';
 
 interface GateRow {
   id: string;
@@ -39,11 +41,18 @@ export const connectorGates = (): readonly ConnectorGate[] => gates;
 
 export const toolGroupOf = (gate: ConnectorGate, tool: string): ToolGroup => (gate.tools[tool] === 'read' ? 'read' : 'write');
 
-export function blockedReason(connectorId: string, tool: string): string | null {
+const promptFor = (connectorId: string, tool: string) => (asked: string): boolean => {
+  const found = connectorToolOf(asked);
+  return found?.gate.id === connectorId && found.tool === tool;
+};
+
+export function blockedReason(connectorId: string, tool: string, args: Record<string, unknown> = {}): string | null {
   const gate = gates.find((g) => g.id === connectorId);
   if (gate === undefined) return null;
   const access = policyFor({ kind: 'connector', id: connectorId }, { name: tool, group: toolGroupOf(gate, tool) });
-  return access === 'deny' ? `Blocked by the owner's policy for ${gate.name} (${tool}).` : null;
+  if (access === 'deny') return `Blocked by the owner's policy for ${gate.name} (${tool}).`;
+  if (access === 'allow' || takeGrant(promptFor(connectorId, tool), args)) return null;
+  return NEEDS_APPROVAL(gate.name, tool);
 }
 
 function prefixesOf(gate: ConnectorGate): string[] {

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay-policy.ts

@@ -2,7 +2,7 @@ import type { ServerResponse } from 'node:http';
 import { isRecord } from '@metro-labs/core/is-record';
 import { log } from '@metro-labs/core/log';
 
-export type BlockedReason = (connectorId: string, tool: string) => string | null;
+export type BlockedReason = (connectorId: string, tool: string, args: Record<string, unknown>) => string | null;
 
 export interface Screened {
   forward: Uint8Array<ArrayBuffer> | null;
@@ -31,9 +31,14 @@ function blockedAnswer(message: Record<string, unknown>, reason: string): Record
   return { jsonrpc: '2.0', id: message.id, result: { isError: true, content: [{ type: 'text', text: reason }] } };
 }
 
+function argsOf(message: unknown): Record<string, unknown> {
+  if (!isRecord(message) || !isRecord(message.params)) return {};
+  return isRecord(message.params.arguments) ? message.params.arguments : {};
+}
+
 function reasonFor(message: unknown, connectorId: string, blocked: BlockedReason): string | null {
   const tool = toolOf(message);
-  return tool === null ? null : blocked(connectorId, tool);
+  return tool === null ? null : blocked(connectorId, tool, argsOf(message));
 }
 
 export function screenCalls(body: Uint8Array<ArrayBuffer>, connectorId: string, blocked: BlockedReason): Screened | null {

package/runtime/node_modules/@metro-labs/daemon/src/mcp/policy-gate.ts

@@ -3,6 +3,9 @@ import type { ToolResult } from '@metro-labs/core/stations/types';
 import { accountFromLine, knownAccounts } from '../agents/map.js';
 import { policyFor, storedPolicy, strictest, type Access, type PolicyTarget } from '../policy/policy.js';
 import { errResult } from './ctx.js';
+import { takeGrant } from '../approvals/pending.js';
+import { NEEDS_APPROVAL } from '../approvals/needs.js';
+import { connectorToolOf } from '../connectors/gates.js';
 import { profileScopeLine } from './profile-lookup.js';
 import { stationOfAccount } from './read-tool.js';
 import { stationForTool, toolGroupOf } from './tool-catalog.js';
@@ -48,10 +51,13 @@ export function channelDecision(name: string, a: Record<string, unknown>): Polic
   return verdict;
 }
 
+const isChannelTool = (name: string) => (tool: string): boolean => tool.endsWith(`__${name}`) && connectorToolOf(tool) === undefined;
+
 export function policyGate(name: string, a: Record<string, unknown>): ToolResult | undefined {
   const { access, target } = channelDecision(name, a);
-  if (access !== 'deny' || target === undefined) return undefined;
-  return errResult(`Blocked by the owner's policy for ${target.station} (${name}).`);
+  if (access === 'allow' || target === undefined) return undefined;
+  if (access === 'deny') return errResult(`Blocked by the owner's policy for ${target.station} (${name}).`);
+  return takeGrant(isChannelTool(name), a) ? undefined : errResult(NEEDS_APPROVAL(target.station, name));
 }
 
 export interface EffectivePolicy {

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.181"
+  "version": "0.1.0-beta.182"
 }