@stage-labs/metro 0.1.0-beta.207 → 0.1.0-beta.209

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.207",
+  "version": "0.1.0-beta.209",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.207",
+  "version": "0.1.0-beta.209",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/approvals/pending.ts

@@ -111,14 +111,18 @@ export function forgetPromptsOf(owner: object): void {
   for (const [id, entry] of held) if (entry.owner === owner) held.delete(id);
 }
 
-export function settlePromptsFor(name: string, args: Record<string, unknown>): void {
+export function settlePrompts(toolMatches: (tool: string) => boolean, args: Record<string, unknown>): void {
   for (const [id, entry] of held)
-    if (entry.tool.endsWith(`__${name}`) && previewMatches(entry.preview, args)) {
+    if (toolMatches(entry.tool) && previewMatches(entry.preview, args)) {
       held.delete(id);
-      log.info({ requestId: id, tool: entry.tool }, 'approvals: the call ran, so the prompt was answered in Claude Code');
+      log.info({ requestId: id, tool: entry.tool }, 'approvals: the call reached metro, so Claude Code already closed the prompt');
     }
 }
 
+export const settlePromptsFor = (name: string, args: Record<string, unknown>): void => {
+  settlePrompts((tool) => tool.endsWith(`__${name}`), args);
+};
+
 export async function expirePrompts(now = Date.now(), ttl = APPROVAL_TTL_MS): Promise<number> {
   const overdue = [...held.values()].filter((entry) => now - entry.at >= ttl);
   for (const entry of overdue)

package/runtime/node_modules/@metro-labs/daemon/src/connectors/gates.ts

@@ -1,7 +1,7 @@
 import type { ToolGroup } from '@metro-labs/core/stations/types';
 import { policyFor, setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
 import { serverKeysOf } from './plugin-sync.js';
-import { NEEDS_APPROVAL, takeGrant } from '../approvals/pending.js';
+import { NEEDS_APPROVAL, settlePrompts, takeGrant } from '../approvals/pending.js';
 
 interface GateRow {
   id: string;
@@ -48,6 +48,7 @@ const promptFor = (connectorId: string, tool: string) => (asked: string): boolea
 export function blockedReason(connectorId: string, tool: string, args: Record<string, unknown> = {}): string | null {
   const gate = gates.find((g) => g.id === connectorId);
   if (gate === undefined) return null;
+  settlePrompts(promptFor(connectorId, tool), args);
   const access = policyFor({ kind: 'connector', id: connectorId }, { name: tool, group: toolGroupOf(gate, tool) });
   if (access === 'deny') return `Blocked by the owner's policy for ${gate.name} (${tool}).`;
   if (access === 'allow' || takeGrant(promptFor(connectorId, tool), args)) return null;

package/runtime/node_modules/@metro-labs/daemon/src/files/upload-store.ts

@@ -1,6 +1,6 @@
 import { randomBytes } from 'node:crypto';
 import { readdirSync, rmSync, statSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { ensureSecureDir, readJson, writeSecure } from '@metro-labs/core/secure-fs';
 import { grantAllowsPath, issueGrant } from './attach-grant.js';
@@ -16,7 +16,7 @@ const SUFFIXES = ['', '.part', '.meta', '.owner', '.grant'] as const;
 const SWEEP_MS = 60_000;
 
 export const uploadDir = (): string =>
-  process.env.METRO_UPLOAD_DIR ?? join(tmpdir(), 'metro-uploads');
+  process.env.METRO_UPLOAD_DIR ?? join(homedir(), '.metro', 'uploads');
 
 export const newUploadId = (): string =>
   `up_${randomBytes(16).toString('base64url')}`;

package/runtime/node_modules/@metro-labs/daemon/src/mcp/tool-dispatch.ts

@@ -152,9 +152,9 @@ async function runTool(
   if (name !== 'list_accounts' && scopeDenied(identity, name, a))
     return errResult('metro: this account is outside your authorized scope');
 
+  settlePromptsFor(name, a);
   const blocked = policyGate(name, a);
   if (blocked) return blocked;
-  settlePromptsFor(name, a);
 
   return dispatchTool(name, a, identity, hooks);
 }

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.207"
+  "version": "0.1.0-beta.209"
 }