@stage-labs/metro 0.1.0-beta.2 → 0.1.0-beta.200

package/runtime/marketplace/plugin/bin/policy.mjs

@@ -0,0 +1,97 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const METRO_TOOL = /^mcp__metro__(.+)$/;
+const RANK = { allow: 0, ask: 1, deny: 2 };
+const LINE_FIELD = { get_profile: 'from' };
+const STATION_ARG = new Set(['create_group', 'set_profile']);
+
+const isRecord = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+const text = (v) => (typeof v === 'string' ? v : '');
+const agentsDir = () => process.env.METRO_AGENTS_DIR?.trim() || join(homedir(), '.metro', 'agents');
+
+function readSnapshot() {
+  try {
+    const parsed = JSON.parse(readFileSync(join(agentsDir(), 'policy.json'), 'utf8'));
+    return isRecord(parsed) && parsed.version === 1 ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+const fromLine = (line, override) => {
+  const parts = line.split('/');
+  return line.startsWith('metro://') && parts[2] && parts[3] ? [{ station: parts[2], account: override || parts[3] }] : [];
+};
+
+function stationOfAccount(snap, account) {
+  const hits = Object.entries(isRecord(snap.stations) ? snap.stations : {}).filter(
+    ([, ids]) => Array.isArray(ids) && ids.includes(account),
+  );
+  return hits.length === 1 ? hits[0][0] : undefined;
+}
+
+function targets(snap, name, input) {
+  if (Array.isArray(snap.ungated) && snap.ungated.includes(name)) return [];
+  const account = text(input.account);
+  const line = text(input[LINE_FIELD[name] ?? 'line']);
+  if (line) return fromLine(line, name in LINE_FIELD ? '' : account);
+  const owners = isRecord(snap.owners) ? snap.owners : {};
+  const station = (STATION_ARG.has(name) ? text(input.station) : text(owners[name])) || (account ? stationOfAccount(snap, account) : undefined);
+  if (!station) return [];
+  if (account) return [{ station, account }];
+  const ids = isRecord(snap.stations) && Array.isArray(snap.stations[station]) ? snap.stations[station] : [];
+  return ids.map((id) => ({ station, account: id }));
+}
+
+function decide(policy, name, group) {
+  if (!isRecord(policy)) return 'allow';
+  const byTool = isRecord(policy.tools) ? policy.tools[name] : undefined;
+  const access = byTool ?? policy[group] ?? 'allow';
+  return access in RANK ? access : 'allow';
+}
+
+const normalized = (name) => name.replace(/[^a-zA-Z0-9_-]/g, '_');
+
+function connectorCall(snap, toolName) {
+  for (const [server, entry] of Object.entries(isRecord(snap.connectors) ? snap.connectors : {})) {
+    if (!isRecord(entry)) continue;
+    const name = text(entry.name);
+    const prefixes = [`mcp__plugin_metro_${server}__`, `mcp__${server}__`, `mcp__${normalized(`metro.box ${name}`)}__`];
+    const prefix = prefixes.find((p) => toolName.startsWith(p) && toolName.length > p.length);
+    if (prefix === undefined) continue;
+    const called = toolName.slice(prefix.length);
+    const tools = isRecord(entry.tools) ? entry.tools : {};
+    const policy = isRecord(entry.policy) ? entry.policy : {};
+    const known = [...Object.keys(tools), ...Object.keys(isRecord(policy.tools) ? policy.tools : {})];
+    const tool = known.find((k) => k === called) ?? known.find((k) => normalized(k) === called) ?? called;
+    return { name: name || server, tool, group: tools[tool] === 'read' ? 'read' : 'write', policy };
+  }
+  return null;
+}
+
+function connectorVerdict(snap, toolName) {
+  const call = connectorCall(snap, toolName);
+  if (call === null) return null;
+  const access = decide(call.policy, call.tool, call.group);
+  return access === 'allow' ? null : { access, tool: call.tool, owner: call.name, where: `${call.tool} on ${call.name}` };
+}
+
+export function policyVerdict(toolName, input) {
+  const name = METRO_TOOL.exec(toolName)?.[1];
+  if (name === undefined && !toolName.startsWith('mcp__')) return null;
+  const snap = readSnapshot();
+  if (snap === null) return null;
+  if (name === undefined) return connectorVerdict(snap, toolName);
+  const tools = isRecord(snap.tools) ? snap.tools : {};
+  const group = tools[name] === 'read' ? 'read' : 'write';
+  const accounts = isRecord(snap.accounts) ? snap.accounts : {};
+  let verdict = null;
+  for (const target of targets(snap, name, input)) {
+    const access = decide(accounts[`${target.station}/${target.account}`], name, group);
+    if (access !== 'allow' && (verdict === null || RANK[access] > RANK[verdict.access]))
+      verdict = { access, tool: name, owner: target.station, where: `${name} on ${target.station} (${target.account})` };
+  }
+  return verdict;
+}

package/runtime/marketplace/plugin/bin/session-start.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const given = (value) => (typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined);
+const claudeDir = given(process.env.CLAUDE_CONFIG_DIR) ?? join(given(process.env.HOME) ?? homedir(), '.claude');
+const SKILL = join(claudeDir, 'skills', 'metro-orchestrator', 'SKILL.md');
+const FALLBACK = join(dirname(dirname(fileURLToPath(import.meta.url))), 'orchestrator.md');
+
+const body = (text) => text.replace(/^---[\s\S]*?\n---\n/, '').trim();
+
+function guidance() {
+  for (const path of [SKILL, FALLBACK]) {
+    if (!existsSync(path)) continue;
+    try {
+      const text = body(readFileSync(path, 'utf8'));
+      if (text !== '') return text;
+    } catch {
+      continue;
+    }
+  }
+  return '';
+}
+
+const text = guidance();
+if (text !== '')
+  process.stdout.write(
+    `${JSON.stringify({ hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: `This machine runs as a metro agent. Standing rules, kept in the metro-orchestrator skill:\n\n${text}` } })}\n`,
+  );

package/runtime/marketplace/plugin/hooks/hooks.json

@@ -0,0 +1,25 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bin/guard.mjs\"",
+            "statusMessage": "Checking the orchestrator boundary"
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bin/session-start.mjs\""
+          }
+        ]
+      }
+    ]
+  }
+}

package/runtime/marketplace/plugin/orchestrator.md

@@ -0,0 +1,24 @@
+---
+name: metro-orchestrator
+description: How this box's agent works on metro. Acknowledge, delegate, relay, answer over chat, never block on the terminal. Loaded at every session start by the metro plugin; edit it here to change the rules on this box.
+---
+
+You are the main thread of a Claude Code session that is connected to chat through metro, on a machine nobody watches. The main thread is an orchestrator: it may only delegate and talk. A guard in the metro plugin denies every other tool on this thread, so this is the shape of the work, not a preference.
+
+**Inbound.** A message arrives as a `<channel source="metro" …>` block. Read `addressed` first: `direct`, `mention` or `reply` means it is for you; without it the message merely happened in a room you watch, so treat it as context and stay silent unless the person plainly wants you. For a message that is for you, the first tool call is `react` on it (👀, then 👍 or ✅ once done) so the person knows you saw it, and any reply goes on the same `line`, passed verbatim.
+
+**Delegate everything that is work.** Reading files, running commands, searching, fetching pages, editing, and every connector tool: hand it to a subagent with the `Agent` tool, `subagent_type: "worker"`, always `run_in_background: true`, then keep answering chat while it runs and relay the result when the task notification arrives. A foreground subagent blinds you to chat and the guard refuses it. You may read image files yourself, so a screenshot someone sends is yours to look at.
+
+**Never wait on the terminal.** `AskUserQuestion`, plan mode and anything that blocks for a person at the keyboard are denied everywhere, main thread and subagents alike. When something is ambiguous, do what does not depend on it, choose the most reasonable reading, say so in your reply, and if a real decision is needed ask over chat with `send` and carry on. Tool-approval prompts reach the chat too; the person answers `yes <id>` or `no <id>` there.
+
+**Calls that need the owner's approval run in a worker.** The owner can make a metro tool on a channel wait for approval. On the main thread such a call is refused, because waiting for the answer would stop the whole session: hand that exact call to a background worker (`run_in_background: true`) and keep answering. The worker waits for the owner's answer on its own.
+
+**Finish what was asked.** You work on your own. Nobody is watching a screen, and a question sent to chat may go unanswered for hours, so asking "Shall I?" about work already requested simply stops it. Anything reversible that follows from the request, do. Stop only for a destructive action or a genuine change of scope. Before you end a turn, read your own last paragraph: if it is a plan, a question, a list of next steps or a promise ("I'll…", "Next…"), then the work is not done, so do it now, retries and missing information included. End the turn when the task is finished, or when you are truly blocked on something only the person can give you.
+
+The exception is a person describing a problem, asking a question or thinking out loud. There the answer IS the deliverable: reply, and change nothing until they ask.
+
+**The whole request is the deliverable.** Do not quietly make it smaller, larger or different. Read an ambiguity the way a careful colleague would, make the ordinary judgement calls yourself, and name the assumption in your reply. If one part turns out to be blocked, finish every other part and say plainly what you left out and why: scaling the work down is the person's call, not yours. Something else you notice on the way is a suggestion at the end of the reply, not extra work to do now.
+
+**Report like a relay.** A worker's report is the only evidence you have, so pass on what it verified and say plainly what it did not. Short messages on chat: lead with the outcome, one idea per sentence, no tool names, no file paths unless the person needs them. Send a file out with `create_upload` (the curl line it hands back runs in a worker) and then `send` with the upload id.
+
+**Keep going.** Long tasks run as background agents and loops; check in over chat when something lands rather than going quiet. The session is restarted by the daemon if it exits, so an interrupted task is resumed from chat, not from memory.

package/runtime/node_modules/@metro-labs/core/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@metro-labs/core",
+  "version": "0.1.0",
+  "private": true,
+  "description": "What every metro process shares: the logger, the event bus and its types, ids, secure file writes, the train protocol, station types and attachment handling. No HTTP, no policy.",
+  "type": "module",
+  "exports": {
+    "./log": "./src/log.ts",
+    "./events": "./src/events.ts",
+    "./is-record": "./src/is-record.ts",
+    "./secure-fs": "./src/secure-fs.ts",
+    "./version": "./src/version.ts",
+    "./train-error": "./src/train-error.ts",
+    "./trains/protocol": "./src/protocol.ts",
+    "./ids": "./src/ids.ts",
+    "./tickets": "./src/tickets.ts",
+    "./station-names": "./src/station-names.ts",
+    "./str": "./src/str.ts",
+    "./lines": "./src/lines.ts",
+    "./endpoints": "./src/endpoints.ts",
+    "./stations/types": "./src/stations/types.ts",
+    "./stations/account-files": "./src/stations/account-files.ts",
+    "./stations/station-runtime": "./src/stations/station-runtime.ts",
+    "./stations/account-store": "./src/stations/account-store.ts",
+    "./stations/attachments": "./src/stations/attachments.ts",
+    "./stations/messaging-normalize": "./src/stations/messaging-normalize.ts",
+    "./stations/profile": "./src/stations/profile.ts",
+    "./stations/sender-profile": "./src/stations/sender-profile.ts",
+    "./stations/train-events": "./src/stations/train-events.ts",
+    "./stations/train-boot": "./src/stations/train-boot.ts"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "tsc --noEmit && METRO_STATE_DIR=\"$(mktemp -d /tmp/metro-test.XXXXXX)\" bun test test/"
+  },
+  "dependencies": {
+    "pino": "^9.5.0",
+    "pino-pretty": "^13.1.3"
+  },
+  "devDependencies": {
+    "@stage-labs/config": "0.1.0-beta.2",
+    "eslint": "^10.3.0",
+    "knip": "^6.15.0",
+    "madge": "^8.0.0",
+    "typescript": "^5"
+  }
+}

package/runtime/node_modules/@metro-labs/core/src/endpoints.ts

@@ -0,0 +1,7 @@
+export interface Endpoint {
+  id: string;
+  webhookId?: string;
+  label: string;
+  secret?: string;
+  createdAt: string;
+}

package/runtime/node_modules/@metro-labs/core/src/events.ts

@@ -0,0 +1,119 @@
+import { Line } from './lines.js';
+
+export { userSelf, daemonSelf } from './identity.js';
+
+export type StructuredEvent =
+  | { type: 'msg' }
+  | { type: 'react'; emoji?: string; targetId?: string }
+  | { type: 'edit'; targetId?: string }
+  | { type: 'delete'; targetId?: string }
+  | { type: 'reply'; replyTo?: string }
+  | { type: 'system'; source?: string; eventName?: string };
+
+export interface MetroEvent {
+  id: string;
+  ts: string;
+  station: string;
+  line: Line;
+  lineName?: string;
+  from: Line;
+  fromName?: string;
+  fromDisplayName?: string;
+  to: Line;
+  text?: string;
+  messageId?: string;
+  replyTo?: string;
+  isPrivate?: boolean;
+  mentionsSelf?: boolean;
+  replyToSelf?: boolean;
+  senderVerified?: boolean;
+  payload?: unknown;
+  display?: string;
+  event?: StructuredEvent;
+  agent?: string;
+  seq?: number;
+}
+
+function isExternalWebhook(e: MetroEvent): boolean {
+  return e.station === 'webhook' && !Line.isLocal(e.from);
+}
+
+function webhookEventName(e: MetroEvent): string | undefined {
+  const headers = (e.payload as { headers?: Record<string, string> } | undefined)
+    ?.headers;
+  return headers?.['x-github-event'] ?? headers?.['x-intercom-topic'];
+}
+
+export function classifyEvent(e: MetroEvent): StructuredEvent {
+  if (isExternalWebhook(e)) {
+    return {
+      type: 'system',
+      source: 'webhook',
+      eventName: webhookEventName(e),
+    };
+  }
+  const emoji =
+    (e.payload as { emoji?: string } | undefined)?.emoji ??
+    e.text?.match(/^\[react (.+)\]$/)?.[1];
+  if (emoji) return { type: 'react', emoji, targetId: e.replyTo };
+  if (e.replyTo) return { type: 'reply', replyTo: e.replyTo };
+  return { type: 'msg' };
+}
+
+export function formatDisplay(e: MetroEvent): string {
+  const headerFor = (icon: string, parts: (string | undefined)[]): string =>
+    `**${icon} ${parts.filter(Boolean).join(' · ')}**`;
+  const body = e.text ?? '';
+  if (isExternalWebhook(e)) {
+    const ev = webhookEventName(e);
+    return `${headerFor('🪝', ['webhook', e.lineName, ev])}\n> ${body}`;
+  }
+  if (Line.isLocal(e.from)) {
+    return `${headerFor('📤', [e.station, '→', e.fromName ?? e.to])}\n> ${body}`;
+  }
+  return `${headerFor('📩', [e.station, e.fromName ?? e.from, e.lineName])}\n> ${body}`;
+}
+
+export { mintId } from './ids.js';
+
+export type BusListener = (event: MetroEvent, busSeq: number) => void;
+
+export interface BufferedEvent {
+  busSeq: number;
+  event: MetroEvent;
+}
+
+const BUS_BUFFER_MAX = 500;
+
+const listeners = new Set<BusListener>();
+const buffer: BufferedEvent[] = [];
+let busSeq = 0;
+
+export function publishEvent(event: MetroEvent): void {
+  busSeq += 1;
+  const seq = busSeq;
+  buffer.push({ busSeq: seq, event });
+  if (buffer.length > BUS_BUFFER_MAX) buffer.shift();
+  for (const fn of [...listeners]) {
+    try {
+      fn(event, seq);
+    } catch (err) {
+      console.error('[metro-bus] listener threw for busSeq', seq, err);
+    }
+  }
+}
+
+export function currentBusSeq(): number {
+  return busSeq;
+}
+
+export function bufferedSince(afterBusSeq: number): BufferedEvent[] {
+  return buffer.filter((b) => b.busSeq > afterBusSeq);
+}
+
+export function subscribeEvents(fn: BusListener): () => void {
+  listeners.add(fn);
+  return () => {
+    listeners.delete(fn);
+  };
+}

package/runtime/node_modules/@metro-labs/core/src/identity.ts

@@ -0,0 +1,7 @@
+import { Line } from './lines.js';
+
+export const userSelf = (): Line =>
+  (process.env.METRO_FROM ?? 'metro://user') as Line;
+
+export const daemonSelf = (): Line =>
+  (process.env.METRO_FROM ?? process.env.METRO_SELF_URI ?? 'metro://user') as Line;

package/runtime/node_modules/@metro-labs/core/src/ids.ts

@@ -0,0 +1,24 @@
+import { randomBytes } from 'node:crypto';
+
+const ID_BYTES = 8;
+const REROLLS = 16;
+
+export const ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{10}$/;
+
+export const mintId = (): string =>
+  `msg_${randomBytes(6).toString('base64url')}`;
+
+export function newId(): string {
+  for (let attempt = 0; attempt < REROLLS; attempt += 1) {
+    const id = randomBytes(ID_BYTES).toString('base64url');
+    if (ID_RE.test(id)) return id;
+  }
+  throw new Error('could not generate an id');
+}
+
+export function parseId(raw: unknown): string | null {
+  if (typeof raw !== 'string') return null;
+  return ID_RE.test(raw) ? raw : null;
+}
+
+export const AGENT_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{1,31}$/;

package/runtime/node_modules/@metro-labs/core/src/is-record.ts

@@ -0,0 +1,2 @@
+export const isRecord = (v: unknown): v is Record<string, unknown> =>
+  typeof v === 'object' && v !== null && !Array.isArray(v);

package/runtime/node_modules/@metro-labs/core/src/lines.ts

@@ -0,0 +1,91 @@
+export type Line = string & { readonly __line: unique symbol };
+export const asLine = (s: string): Line => s as Line;
+
+const PREFIX = 'metro://';
+const build = (station: string, ...seg: (string | number)[]): Line =>
+  asLine(`${PREFIX}${station}/${seg.map(String).join('/')}`);
+
+function parseAccountScoped(
+  line: Line | string,
+  station: string,
+  validate?: (resource: string) => boolean,
+): { accountId: string; resource: string } | null {
+  const p = Line.parse(line);
+  if (p?.station !== station) return null;
+  let accountId: string, resource: string;
+  if (p.path.length === 2 && p.path[0] !== undefined && p.path[1] !== undefined) {
+    accountId = p.path[0];
+    resource = p.path[1];
+  } else if (p.path.length === 1 && p.path[0] !== undefined) {
+    accountId = 'default';
+    resource = p.path[0];
+  } else return null;
+  if (validate && !validate(resource)) return null;
+  return { accountId, resource };
+}
+
+const isSnowflake = (s: string): boolean => /^\d+$/.test(s);
+const isThreemaResource = (s: string): boolean =>
+  /^(?:[A-Z0-9]{8}|\*[A-Z0-9]{7})(?:-[0-9a-f]{16})?$/i.test(s);
+const isOutlookResource = (s: string): boolean => /^[A-Za-z0-9=_%.@+-]+$/.test(s);
+const isSignedInt = (s: string): boolean => /^-?\d+$/.test(s);
+
+function splitTelegramAccount(path: string[]): { accountId: string; rest: string[] } {
+  const first = path[0];
+  if (path.length >= 2 && first !== undefined && !isSignedInt(first))
+    return { accountId: first, rest: path.slice(1) };
+  return { accountId: 'default', rest: path };
+}
+
+function parseTelegramLine(
+  line: Line | string,
+): { accountId: string; chatId: number; topicId?: number } | null {
+  const p = Line.parse(line);
+  if (p?.station !== 'telegram-bot') return null;
+  const { accountId, rest } = splitTelegramAccount(p.path);
+  const [chatId, topicId] = rest;
+  if (rest.length < 1 || rest.length > 2 || chatId === undefined || !isSignedInt(chatId))
+    return null;
+  if (topicId !== undefined && !isSnowflake(topicId)) return null;
+  return {
+    accountId,
+    chatId: Number(chatId),
+    ...(topicId !== undefined ? { topicId: Number(topicId) } : {}),
+  };
+}
+
+export const Line = {
+  claude: (orgId: string, sessionId: string): Line =>
+    build('claude', orgId, sessionId),
+  webhook: (endpointId: string): Line => build('webhook', endpointId),
+  user: (station: string, id: string | number): Line =>
+    build(station, 'user', id),
+
+  parse(line: Line | string): { station: string; path: string[] } | null {
+    if (!line.startsWith(PREFIX)) return null;
+    const rest = line.slice(PREFIX.length);
+    const slash = rest.indexOf('/');
+    if (slash <= 0) return null;
+    const path = rest
+      .slice(slash + 1)
+      .split('/')
+      .filter(Boolean);
+    return path.length ? { station: rest.slice(0, slash), path } : null;
+  },
+  station: (line: Line | string): string | null =>
+    Line.parse(line)?.station ?? null,
+  isLocal: (line: Line | string): boolean => Line.station(line) === 'claude',
+
+  parseXmtp: (line: Line | string) => parseAccountScoped(line, 'xmtp'),
+
+  parseDiscord: (line: Line | string) =>
+    parseAccountScoped(line, 'discord-bot', isSnowflake),
+
+  parseTelegram: (line: Line | string) => parseTelegramLine(line),
+
+  parseThreema: (line: Line | string) =>
+    parseAccountScoped(line, 'threema', isThreemaResource),
+
+  parseOutlook: (line: Line | string) =>
+    parseAccountScoped(line, 'outlook', isOutlookResource),
+};

package/runtime/node_modules/@metro-labs/core/src/log.ts

@@ -0,0 +1,42 @@
+import { writeSync } from 'node:fs';
+import pino from 'pino';
+import pinoPretty from 'pino-pretty';
+
+const stream = process.stderr.isTTY
+  ? pinoPretty({
+      colorize: true,
+      translateTime: 'HH:MM:ss',
+      ignore: 'pid,hostname,name',
+      destination: 2,
+    })
+  : pino.destination(2);
+
+export const log = pino(
+  { base: { name: 'metro' }, level: process.env.METRO_LOG_LEVEL ?? 'info' },
+  stream,
+);
+
+export const logFatalSync = (
+  fields: Record<string, unknown>,
+  msg: string,
+): void => {
+  const line = JSON.stringify({
+    level: 60,
+    time: Date.now(),
+    name: 'metro',
+    ...fields,
+    msg,
+  });
+  try {
+    writeSync(2, `${line}\n`);
+  } catch {
+    return;
+  }
+};
+
+export const errMsg = (err: unknown): string => {
+  if (err instanceof Error) return err.message;
+  if (err && typeof err === 'object' && 'message' in err)
+    return String(err.message);
+  return String(err);
+};