@stage-labs/metro 0.1.0-beta.195 → 0.1.0-beta.196

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.195",
+  "version": "0.1.0-beta.196",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.195",
+  "version": "0.1.0-beta.196",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/files-api.ts

@@ -0,0 +1,12 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { sessionRoute } from '@metro-labs/http/api-http';
+import { readAgentPath } from './files.js';
+import { agentUser } from './user.js';
+
+const PATH = '/api/files';
+
+const queryPath = (req: IncomingMessage): string => new URLSearchParams((req.url ?? '').split('?')[1] ?? '').get('path') ?? '';
+
+export function handleFilesRequest(req: IncomingMessage, res: ServerResponse): boolean {
+  return sessionRoute(req, res, { methods: { [PATH]: ['GET'] }, admin: true, label: 'files-api' }, () => Promise.resolve(readAgentPath(agentUser(), queryPath(req))));
+}

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/files.ts

@@ -0,0 +1,117 @@
+import { spawnSync } from 'node:child_process';
+import { closeSync, openSync, readdirSync, readSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ApiError } from '@metro-labs/http/api-error';
+import { asUser, type AgentUser } from './user.js';
+
+export type EntryKind = 'folder' | 'file' | 'other';
+
+export interface FileEntry {
+  name: string;
+  kind: EntryKind;
+  bytes: number;
+  modifiedAt: string;
+}
+
+export type FilesAnswer =
+  | { root: string; path: string; kind: 'folder'; entries: FileEntry[]; more: boolean }
+  | { root: string; path: string; kind: 'file'; bytes: number; modifiedAt: string; text: string | null; truncated: boolean };
+
+const MAX_ENTRIES = 2000;
+const PREVIEW_BYTES = 256 * 1024;
+const SNIFF_BYTES = 8192;
+
+const SCRIPT = [
+  'if [ -d "$1" ]; then',
+  '  printf "D\\0"; find -H "$1" -mindepth 1 -maxdepth 1 -printf "%y\\0%s\\0%T@\\0%f\\0"',
+  'elif [ -f "$1" ]; then',
+  '  printf "F\\0"; stat -L -c "%s %Y" -- "$1" | tr "\\n" "\\0"; head -c "$2" -- "$1"',
+  'else',
+  '  echo "no such file or folder" >&2; exit 2',
+  'fi',
+].join('\n');
+
+export function segmentsOf(path: string): string[] {
+  const parts = path.split('/').filter((part) => part !== '');
+  if (parts.some((part) => part === '.' || part === '..' || part.includes('\0')))
+    throw new ApiError('that path is not inside the home folder', 400);
+  return parts;
+}
+
+const stamp = (seconds: number): string => (Number.isFinite(seconds) && seconds > 0 ? new Date(seconds * 1000).toISOString() : '');
+
+const kindOf = (letter: string): EntryKind => (letter === 'd' ? 'folder' : letter === 'f' ? 'file' : 'other');
+
+const byKindThenName = (a: FileEntry, b: FileEntry): number =>
+  a.kind === 'folder' && b.kind !== 'folder' ? -1 : b.kind === 'folder' && a.kind !== 'folder' ? 1 : a.name.localeCompare(b.name, undefined, { numeric: true, sensitivity: 'base' });
+
+function preview(bytes: Buffer, size: number): { text: string | null; truncated: boolean } {
+  const binary = bytes.subarray(0, SNIFF_BYTES).includes(0);
+  return { text: binary ? null : bytes.subarray(0, PREVIEW_BYTES).toString('utf8'), truncated: size > PREVIEW_BYTES };
+}
+
+function folderAnswer(root: string, path: string, entries: FileEntry[]): FilesAnswer {
+  const sorted = entries.sort(byKindThenName);
+  return { root, path, kind: 'folder', entries: sorted.slice(0, MAX_ENTRIES), more: sorted.length > MAX_ENTRIES };
+}
+
+function parseListing(out: Buffer): FileEntry[] {
+  const fields = out.toString('utf8').split('\0');
+  const entries: FileEntry[] = [];
+  for (let at = 0; at + 3 < fields.length; at += 4)
+    entries.push({ kind: kindOf(fields[at] ?? ''), bytes: Number(fields[at + 1]), modifiedAt: stamp(Number(fields[at + 2])), name: fields[at + 3] ?? '' });
+  return entries;
+}
+
+function parseFile(root: string, path: string, out: Buffer): FilesAnswer {
+  const end = out.indexOf(0);
+  const [size = '0', mtime = '0'] = out.subarray(0, end).toString('utf8').trim().split(' ');
+  const bytes = Number(size);
+  return { root, path, kind: 'file', bytes, modifiedAt: stamp(Number(mtime)), ...preview(out.subarray(end + 1), bytes) };
+}
+
+function readAsAgent(user: AgentUser, path: string): FilesAnswer {
+  const target = join(user.home, ...segmentsOf(path));
+  const [file, argv] = asUser(user, 'sh', ['-c', SCRIPT, 'metro', target, String(PREVIEW_BYTES + 1)]);
+  const run = spawnSync(file, argv, { stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 64 * 1024 * 1024, timeout: 20_000 });
+  if (run.error !== undefined) throw new ApiError(`could not read that path: ${run.error.message}`, 500);
+  if (run.status !== 0) throw new ApiError(run.stderr.toString('utf8').trim() || 'the agent cannot read that path', 404);
+  const out = run.stdout;
+  const body = out.subarray(2);
+  return out.subarray(0, 1).toString() === 'D' ? folderAnswer(user.home, path, parseListing(body)) : parseFile(user.home, path, body);
+}
+
+function readHead(target: string): Buffer {
+  const fd = openSync(target, 'r');
+  try {
+    const buffer = Buffer.alloc(PREVIEW_BYTES + 1);
+    return buffer.subarray(0, readSync(fd, buffer, 0, buffer.length, 0));
+  } finally {
+    closeSync(fd);
+  }
+}
+
+function readLocal(root: string, path: string): FilesAnswer {
+  const target = join(root, ...segmentsOf(path));
+  let stat;
+  try {
+    stat = statSync(target);
+  } catch {
+    throw new ApiError('no such file or folder', 404);
+  }
+  if (stat.isFile()) return { root, path, kind: 'file', bytes: stat.size, modifiedAt: stat.mtime.toISOString(), ...preview(readHead(target), stat.size) };
+  const entries = readdirSync(target, { withFileTypes: true }).map((entry): FileEntry => {
+    const inner = join(target, entry.name);
+    try {
+      const s = statSync(inner);
+      return { name: entry.name, kind: s.isDirectory() ? 'folder' : s.isFile() ? 'file' : 'other', bytes: s.size, modifiedAt: s.mtime.toISOString() };
+    } catch {
+      return { name: entry.name, kind: 'other', bytes: 0, modifiedAt: '' };
+    }
+  });
+  return folderAnswer(root, path, entries);
+}
+
+export const readAgentPath = (user: AgentUser | null, path: string, localRoot = homedir()): FilesAnswer =>
+  user === null ? readLocal(localRoot, path) : readAsAgent(user, path);

package/runtime/node_modules/@metro-labs/daemon/src/agents/accounts-api.ts

@@ -10,6 +10,7 @@ import { type AccountRef } from './account-attach.js';
 import { type AccountRoute } from './account-routes.js';
 import { handlePolicy, type SetPolicy } from './policy-route.js';
 import { LOOKUPS } from './account-lookups.js';
+import { unconfirmedSenders } from './sender-cards.js';
 import { stationByName } from '../stations/registry.js';
 import type { StationName } from '@metro-labs/core/station-names';
 import {
@@ -243,6 +244,9 @@ async function handleAllowlist(
   const wanted = normalizeAllowlist(bodyField(body, 'allowlist'));
   const asked = isRecord(body) && 'approvers' in body ? body.approvers : approversForAccount(target.station, target.accountId);
   const approvers = normalizeApprovers(asked, wanted);
+  const before = new Set(approversForAccount(target.station, target.accountId).map((a) => a.toLowerCase()));
+  const unknown = await unconfirmedSenders(deps, target.station, target.accountId, approvers.filter((a) => !before.has(a.toLowerCase())));
+  if (unknown.length > 0) throw new ApiError(`${target.station} does not know ${unknown.join(', ')}. Check the id, or have them write to the agent once, then try again.`, 400);
   const allowlist = await deps.setAllowlist(agentId, target.station, target.accountId, wanted, approvers);
   log.info({ agentId, station: target.station, account: target.accountId, senders: allowlist.length }, 'account-api: allowlist set');
   sendJson(req, res, 200, {

package/runtime/node_modules/@metro-labs/daemon/src/agents/sender-cards.ts

@@ -64,6 +64,18 @@ export async function senderCards(deps: SenderCardDeps, station: StationName, ac
   );
 }
 
+const known = (profile: unknown): boolean =>
+  isRecord(profile) && ['name', 'display_name', 'about', 'avatar', 'address'].some((key) => filled(profile[key]) !== undefined);
+
+export async function unconfirmedSenders(deps: SenderCardDeps, station: StationName, accountId: string, ids: string[]): Promise<string[]> {
+  if (stationByName(station)?.readsProfiles !== true || ids.length === 0) return [];
+  const seen = new Set(deps.recentSenders(station, accountId).map((s) => s.id.toLowerCase()));
+  const checks = await Promise.all(
+    ids.map(async (id) => (seen.has(id.toLowerCase()) || known(await lookup(deps, station, accountId, id)) ? null : id)),
+  );
+  return checks.filter((id): id is string => id !== null);
+}
+
 export async function handleSenderCards(
   req: IncomingMessage,
   res: ServerResponse,

package/runtime/node_modules/@metro-labs/daemon/src/mcp/profile-lookup.ts

@@ -13,7 +13,7 @@ export const GET_PROFILE_TOOL: ToolDef = {
     '(`metro://<station>/<account>/user/<id>`) and get what their network says about them: ' +
     '{id, name, display_name, about, avatar, address}. XMTP answers the Basename ' +
     '(<label>.stage.base.eth), its name, description and avatar records, and the wallet address; ' +
-    'WhatsApp the about line and the picture; Telegram the handle, the name and the bio; Discord ' +
+    'WhatsApp the phone number, the name they last used, the about line and the picture; Telegram the handle, the name and the bio; Discord ' +
     'the username, the global name and the avatar. Fields the network does not have are absent. ' +
     'The answer is cached for ten minutes, so ask when you want to know someone, not on every message.',
   inputSchema: {

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -196,6 +196,7 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
     updateApi: { restart: deps.restart },
     controlApi: { restart: deps.restart, stop: deps.stop },
     schedulesApi: true,
+    filesApi: true,
     ownerApi: { setOwner: (owner) => setLocalOwner(owner) },
     machineApi: {},
     modelApi: {},

package/runtime/node_modules/@metro-labs/daemon/src/routes/session-apis.ts

@@ -18,6 +18,7 @@ import { handleModelRequest, type ModelApiDeps } from '../gateway/model-api.js';
 import type { GatewayDeps } from '../gateway/gateway.js';
 import { handleTerminalRequest, type TerminalApiDeps } from '../terminal/api.js';
 import { handleSchedulesRequest } from '../agent-user/schedules-api.js';
+import { handleFilesRequest } from '../agent-user/files-api.js';
 
 export interface SessionApis {
   agentApi?: AgentApiDeps;
@@ -25,6 +26,7 @@ export interface SessionApis {
   updateApi?: UpdateApiDeps;
   controlApi?: ControlApiDeps;
   schedulesApi?: true;
+  filesApi?: true;
   ownerApi?: OwnerApiDeps;
   machineApi?: MachineApiDeps;
   modelApi?: ModelApiDeps;
@@ -52,6 +54,7 @@ export function handleSessionApis(
     ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),
     ...when(apis.controlApi, (d) => handleControlRequest(req, res, d)),
     ...when(apis.schedulesApi, () => handleSchedulesRequest(req, res)),
+    ...when(apis.filesApi, () => handleFilesRequest(req, res)),
     ...when(apis.ownerApi, (d) => handleOwnerRequest(req, res, d)),
     ...when(apis.machineApi, (d) => handleMachineRequest(req, res, d)),
     ...when(apis.modelApi, (d) => handleModelRequest(req, res, d)),

package/runtime/node_modules/@metro-labs/whatsapp/src/client.ts

@@ -17,6 +17,7 @@ import type { ProfileChange } from '@metro-labs/core/stations/profile';
 import { makeProfileCache, nonEmpty, type SenderProfile } from '@metro-labs/core/stations/sender-profile';
 import { toInbound, toReaction, type ReactionEvent, type SelfRef } from './parse.js';
 import { baileysLogger } from './logger.js';
+import { makeNameBook, phoneOf, type NameBook } from './names.js';
 import { useAccountAuthState } from './auth-state.js';
 import { knownKey, makeKeyCache, targetKey, type KeyCache } from './keys.js';
 import { makeOutbox, type Outbox } from './outbox.js';
@@ -68,6 +69,7 @@ interface State {
   keys: KeyCache;
   outbox: Outbox;
   acks: AckWatch;
+  names: NameBook;
 }
 
 type SendOpts = Parameters<WASocket['sendMessage']>[2];
@@ -94,9 +96,13 @@ function bindInbound(st: State, sock: WASocket): void {
     for (const m of messages) {
       if (m.key.fromMe) continue;
       const inbound = toInbound(st.account.id, m, selfRef(st, sock));
+      if (inbound) st.names.note(inbound.senderJid, inbound.pushName);
       if (inbound) st.handlers.onMessage(inbound, m);
     }
   });
+  sock.ev.on('contacts.upsert', (contacts) => {
+    for (const c of contacts) st.names.note(c.id, c.name ?? c.notify);
+  });
   sock.ev.on('messages.reaction', (events: ReactionEvent[]) => {
     if (!st.handlers) return;
     for (const event of events) {
@@ -270,6 +276,22 @@ function mediaContent(m: WAMedia): SendContent {
   };
 }
 
+async function readProfile(st: State, jid: string): Promise<SenderProfile> {
+  const sock = await ready(st);
+  const [statuses, avatar] = await Promise.all([sock.fetchStatus(jid).catch(() => undefined), sock.profilePictureUrl(jid, 'image').catch(() => undefined)]);
+  const about = nonEmpty((statuses?.[0]?.status as { status?: unknown } | undefined)?.status);
+  const picture = nonEmpty(avatar);
+  const phone = phoneOf(jid.endsWith('@lid') ? await sock.signalRepository.lidMapping.getPNForLID(jid).catch(() => null) : jid);
+  const name = st.names.get(jid);
+  return {
+    id: jid,
+    ...(name === undefined ? {} : { display_name: name }),
+    ...(phone === undefined ? {} : { name: phone, address: phone }),
+    ...(about === undefined ? {} : { about }),
+    ...(picture === undefined ? {} : { avatar: picture }),
+  };
+}
+
 export function createClient(account: WhatsAppAccount): WAClient {
   const st: State = {
     account,
@@ -278,18 +300,12 @@ export function createClient(account: WhatsAppAccount): WAClient {
     keys: makeKeyCache(),
     outbox: makeOutbox(),
     acks: makeAckWatch(),
+    names: makeNameBook(),
   };
   resetGate(st);
-  const senders = makeProfileCache<SenderProfile>(
-    async (jid) => {
-      const sock = await ready(st);
-      const [statuses, avatar] = await Promise.all([sock.fetchStatus(jid).catch(() => undefined), sock.profilePictureUrl(jid, 'image').catch(() => undefined)]);
-      const about = nonEmpty((statuses?.[0]?.status as { status?: unknown } | undefined)?.status);
-      const picture = nonEmpty(avatar);
-      return { id: jid, ...(about === undefined ? {} : { about }), ...(picture === undefined ? {} : { avatar: picture }) };
-    },
-    { onError: (jid, err) => process.stderr.write(`whatsapp[${st.account.id}] could not read the profile of ${jid}: ${errMsg(err)}\n`) },
-  );
+  const senders = makeProfileCache<SenderProfile>((jid) => readProfile(st, jid), {
+    onError: (jid, err) => process.stderr.write(`whatsapp[${st.account.id}] could not read the profile of ${jid}: ${errMsg(err)}\n`),
+  });
   return {
     account,
     self() {

package/runtime/node_modules/@metro-labs/whatsapp/src/names.ts

@@ -0,0 +1,28 @@
+const MAX_NAMES = 2000;
+
+export interface NameBook {
+  note(jid: string | null | undefined, name: string | null | undefined): void;
+  get(jid: string): string | undefined;
+}
+
+export function makeNameBook(): NameBook {
+  const names = new Map<string, string>();
+  return {
+    note(jid, name) {
+      const clean = name?.trim() ?? '';
+      if (!jid || clean === '') return;
+      names.delete(jid);
+      names.set(jid, clean);
+      if (names.size > MAX_NAMES) {
+        const oldest = names.keys().next().value;
+        if (oldest !== undefined) names.delete(oldest);
+      }
+    },
+    get: (jid) => names.get(jid),
+  };
+}
+
+export const phoneOf = (jid: string | null | undefined): string | undefined => {
+  const digits = /^(\d{6,})(?::\d+)?@s\.whatsapp\.net$/.exec(jid ?? '')?.[1];
+  return digits === undefined ? undefined : `+${digits}`;
+};

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.195"
+  "version": "0.1.0-beta.196"
 }