@stage-labs/metro 0.1.0-beta.21 → 0.1.0-beta.211

package/runtime/node_modules/@metro-labs/{mcp → daemon}/src/mcp/tool-dispatch.ts

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { Line } from '@metro-labs/core/lines';
 import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import {
   ListToolsRequestSchema,
@@ -9,10 +10,12 @@ import {
   STATIONS,
   accountStationCapabilities,
 } from '../stations/registry.js';
-import type { Station, StationTool, ToolResult } from '../stations/types.js';
-import { COMMON_TOOLS, LIST_ACCOUNTS_TOOL } from './tool-schemas.js';
+import type { Station, StationTool, ToolResult } from '@metro-labs/core/stations/types';
+import { listedTools, stationForTool, type PublishedTool } from './tool-catalog.js';
+import { policyGate, withEffectivePolicy } from './policy-gate.js';
+import { settlePromptsFor } from '../approvals/pending.js';
 import { errResult, makeCtx, okJson, toErr } from './ctx.js';
-import { dispatchMessageTool } from './call-tools.js';
+import { dispatchMessageTool, type ToolHooks } from './call-tools.js';
 import { dispatchListMembers } from './member-tools.js';
 import {
   dispatchAddMembers,
@@ -21,16 +24,19 @@ import {
   dispatchRemoveMembers,
 } from './group-tools.js';
 import { dispatchCreateUpload } from './upload-tool.js';
-import { callTargetDenied, lineTargetDenied } from '../db/agent-scope.js';
+import { dispatchSetProfile, profileCapabilities } from './profile-tool.js';
+import { dispatchGetProfile, profileScopeLine } from './profile-lookup.js';
+import { callTargetDenied, lineTargetDenied } from '../agents/scope.js';
 import { SOURCE_KEYS } from '../stations/attach-resolve.js';
 import { decodedLengthOf } from '../stations/attach-inline.js';
-import { log } from '../daemon/log.js';
+import { log } from '@metro-labs/core/log';
 import {
   allowedAgents,
   currentIdentity,
   type RequestIdentity,
 } from './request-identity.js';
-import { str } from './str.js';
+import { str } from '@metro-labs/core/str';
+import { linelessRead, stationOfAccount } from './read-tool.js';
 
 const STATION_TOOLS = new Map<
   string,
@@ -49,21 +55,11 @@ const CORE_DISPATCH: Record<
   remove_members: dispatchRemoveMembers,
   export_invite: dispatchInviteLink,
   create_upload: dispatchCreateUpload,
+  set_profile: dispatchSetProfile,
+  get_profile: dispatchGetProfile,
 };
 
-const toolList = (): { tools: unknown[] } => ({
-  tools: [
-    ...COMMON_TOOLS,
-    ...STATIONS.flatMap((s) =>
-      s.tools.map((t) => ({
-        name: t.name,
-        description: t.description,
-        inputSchema: t.inputSchema,
-      })),
-    ),
-    LIST_ACCOUNTS_TOOL,
-  ],
-});
+export const toolList = (): { tools: PublishedTool[] } => ({ tools: listedTools() });
 
 let schemaSignature: string | undefined;
 
@@ -80,28 +76,31 @@ async function handleListAccounts(
 ): Promise<ToolResult> {
   try {
     return okJson({
-      accounts: await gatherAccounts(allowedAgents(identity)),
+      accounts: withEffectivePolicy(await gatherAccounts(allowedAgents(identity))),
       capabilities: accountStationCapabilities(),
+      profiles: profileCapabilities(),
     });
   } catch (e) {
     return errResult(`metro list_accounts failed: ${String(e)}`);
   }
 }
 
-function stationForTool(
-  name: string,
-  args: Record<string, unknown>,
-): string | undefined {
-  if (name === 'create_group') return str(args.station) || undefined;
-  return STATION_TOOLS.get(name)?.station.name;
-}
-
 export function scopeDenied(
   identity: RequestIdentity | undefined,
   name: string,
   args: Record<string, unknown>,
 ): boolean {
   const allowed = allowedAgents(identity);
+  if (name === 'read' && !str(args.line)) {
+    const account = str(args.account);
+    if (!account) return false;
+    const station = stationOfAccount(account);
+    return station === undefined || callTargetDenied(allowed, station, args);
+  }
+  if (name === 'get_profile') {
+    const line = profileScopeLine(args);
+    return line === undefined || callTargetDenied(allowed, Line.station(line) ?? '', { line });
+  }
   const station = stationForTool(name, args);
   if (station !== undefined) return callTargetDenied(allowed, station, args);
   return lineTargetDenied(allowed, args);
@@ -142,9 +141,10 @@ function logToolFailure(
   );
 }
 
-async function runTool(req: {
-  params: { name: string; arguments?: Record<string, unknown> };
-}): Promise<ToolResult> {
+async function runTool(
+  req: { params: { name: string; arguments?: Record<string, unknown> } },
+  hooks: ToolHooks,
+): Promise<ToolResult> {
   const name = req.params.name;
   const a = req.params.arguments ?? {};
 
@@ -152,6 +152,19 @@ async function runTool(req: {
   if (name !== 'list_accounts' && scopeDenied(identity, name, a))
     return errResult('metro: this account is outside your authorized scope');
 
+  settlePromptsFor(name, a);
+  const blocked = policyGate(name, a);
+  if (blocked) return blocked;
+
+  return dispatchTool(name, a, identity, hooks);
+}
+
+async function dispatchTool(
+  name: string,
+  a: Record<string, unknown>,
+  identity: RequestIdentity | undefined,
+  hooks: ToolHooks,
+): Promise<ToolResult> {
   const owned = STATION_TOOLS.get(name);
   if (owned) {
     try {
@@ -160,19 +173,18 @@ async function runTool(req: {
       return toErr(name, e);
     }
   }
-
   const core = CORE_DISPATCH[name];
   if (core) return core(a);
-
   if (name === 'list_accounts') return handleListAccounts(identity);
-
-  return dispatchMessageTool(name, a);
+  if (name === 'read' && !str(a.line)) return linelessRead(a);
+  return dispatchMessageTool(name, a, hooks);
 }
 
-export async function callToolHandler(req: {
-  params: { name: string; arguments?: Record<string, unknown> };
-}): Promise<ToolResult> {
-  const result = await runTool(req);
+export async function callToolHandler(
+  req: { params: { name: string; arguments?: Record<string, unknown> } },
+  hooks: ToolHooks = {},
+): Promise<ToolResult> {
+  const result = await runTool(req, hooks);
   if (result.isError === true)
     logToolFailure(req.params.name, req.params.arguments ?? {}, result);
   return result;
@@ -192,6 +204,7 @@ interface NotifyingExtra {
 export function registerToolHandlers(
   server: Server,
   notice?: SchemaNotice,
+  hooks: ToolHooks = {},
 ): void {
   server.setRequestHandler(ListToolsRequestSchema, () => {
     notice?.markCurrent();
@@ -206,7 +219,7 @@ export function registerToolHandlers(
       notice?.deliver(() =>
         extra.sendNotification({ method: TOOL_LIST_CHANGED }),
       );
-      return callToolHandler(req);
+      return callToolHandler(req, hooks);
     }) as Parameters<typeof server.setRequestHandler>[1],
   );
 }

package/runtime/node_modules/@metro-labs/{mcp → daemon}/src/mcp/tool-schemas.ts

@@ -1,3 +1,6 @@
+import type { ToolDef } from './tool-def.js';
+import { attachmentItem, CREATE_UPLOAD_TOOL } from './attachment-schema.js';
+
 const lineProp = {
   type: 'string',
   description:
@@ -8,98 +11,10 @@ const msgIdProp = {
   description: 'The target message_id.',
 } as const;
 
-const attachmentItem = {
-  type: 'object',
-  description:
-    'A file to attach. Provide EXACTLY ONE source; naming two is an error and so is naming ' +
-    'none. Which one to use: `upload` for any real file on your own machine, including a ' +
-    'confidential one (call `create_upload` first, push the bytes over HTTP, then name the ' +
-    'id here); `data` ONLY for a tiny file, a few KB at most, because the base64 has to be ' +
-    'written out verbatim in this tool call and long base64 gets corrupted in the writing; ' +
-    '`url` when the file is ALREADY published somewhere the daemon can fetch it; `path` ONLY ' +
-    'for a file that is already sitting on the daemon host, which is almost never your ' +
-    'machine.',
-  properties: {
-    upload: {
-      type: 'string',
-      description:
-        'The `upload_id` of a file already pushed to metro over HTTP (`create_upload` mints ' +
-        'the slot and the one-line command; the bytes never pass through this conversation). ' +
-        'THIS IS THE ROUTE FOR ANYTHING REAL: it takes files up to 64 MiB, works for a file on ' +
-        'your own machine, and publishes nothing. The upload belongs to your agent, expires ' +
-        '30 minutes after it is created, and no other agent can name it.',
-    },
-    data: {
-      type: 'string',
-      description:
-        'Base64-encoded file bytes, inline in this call. ONLY FOR TINY FILES. The hard cap is ' +
-        '8 MiB decoded, but the real ceiling is far lower and is not enforced by the daemon: ' +
-        'this base64 has to be emitted verbatim as part of the tool call, and past roughly ' +
-        '10 KB (~13 KB of base64) it comes out corrupted, so the file arrives silently ' +
-        'damaged or fails to decode. Use `upload` instead for anything bigger. A ' +
-        '`data:<mime>;base64,` prefix is accepted and supplies the mime when `mime` is ' +
-        'omitted. Stations impose their own, lower limits (xmtp refuses non-image files over ' +
-        '~190 KiB).',
-    },
-    url: {
-      type: 'string',
-      description:
-        'http(s) URL fetched BY THE DAEMON, so it must already be publicly reachable from the ' +
-        'daemon host. Right when the file is already published; never for anything ' +
-        'confidential, because it has to be public for this to work at all. Use `upload` for ' +
-        'a confidential file.',
-    },
-    path: {
-      type: 'string',
-      description:
-        'Absolute path resolved ON THE DAEMON HOST, which is a different machine from yours. ' +
-        'A path on your own disk does NOT resolve here and is refused, however local it ' +
-        'looks. Use `upload` for a file on your machine.',
-    },
-    mime: {
-      type: 'string',
-      description: 'MIME type (guessed from the name/extension if omitted).',
-    },
-    name: {
-      type: 'string',
-      description:
-        'Filename to present (defaults to the basename, or to the name given at upload time).',
-    },
-  },
-} as const;
-
-const CREATE_UPLOAD_TOOL = {
-  name: 'create_upload',
-  description:
-    'Reserve a slot to push a file to metro over HTTP so you can attach it with `send`. Use ' +
-    'this for any file that actually matters: it is the only attachment route that carries a ' +
-    'file from YOUR machine without publishing it and without the bytes passing through this ' +
-    'conversation. Args: name? (the filename to present), mime?. Returns `upload_id`, a ' +
-    'single-use `upload_url` and a ready-to-run `curl` line. ONE STEP NEEDS A SHELL: run that ' +
-    'command (or any HTTP client) to push the bytes; there is no way to move a local file to ' +
-    'the daemon over MCP alone, because anything in an MCP call has to be written out by the ' +
-    'model first. If you have no shell, hand the single command to a subagent that does and ' +
-    'keep the `upload_id` -- the slot belongs to this metro agent, not to whoever runs the ' +
-    'command. Then: send({line, attachments:[{upload:"<upload_id>"}]}). Up to 64 MiB, expires ' +
-    '30 minutes after it is created, and no other agent can reference it.',
-  inputSchema: {
-    type: 'object',
-    properties: {
-      name: {
-        type: 'string',
-        description: 'Filename to present to the recipient (e.g. `report.pdf`).',
-      },
-      mime: {
-        type: 'string',
-        description: 'MIME type (guessed from the name/extension if omitted).',
-      },
-    },
-  },
-};
-
-export const COMMON_TOOLS = [
+export const COMMON_TOOLS: ToolDef[] = [
   {
     name: 'reply',
+    group: 'write',
     description:
       'Reply to a specific message in a Metro conversation (text quotes the target). Args: ' +
       "line, message_id, text. The station is derived from the line. Returns the daemon's " +
@@ -116,9 +31,12 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'send',
+    group: 'write',
     description:
       'Send a message (and/or media) to a Metro conversation. Args: line, text?, reply_to?, ' +
-      'attachments?. The station is derived from the line. Each attachment names EXACTLY ONE ' +
+      'subject?, attachments?. The station is derived from the line. Outlook: send to ' +
+      'metro://outlook/<account>/<email address> to start a new email (subject defaults to the ' +
+      'first line of text); the result names the new thread line. Each attachment names EXACTLY ONE ' +
       'source, and the choice matters: `upload` (an `upload_id` from `create_upload`, the ' +
       'route for any real file on your own machine, confidential or not, up to 64 MiB); ' +
       '`data` (base64 inline -- TINY FILES ONLY, a few KB, because the base64 has to be ' +
@@ -139,6 +57,10 @@ export const COMMON_TOOLS = [
           type: 'string',
           description: 'Optional message_id to quote/reply to.',
         },
+        subject: {
+          type: 'string',
+          description: 'Outlook only: the subject of a new email.',
+        },
         attachments: {
           type: 'array',
           description: 'Optional files to attach.',
@@ -150,6 +72,7 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'react',
+    group: 'write',
     description:
       'Add an emoji reaction to a message. Args: line, message_id, emoji. The station is derived from the line.',
     inputSchema: {
@@ -162,8 +85,22 @@ export const COMMON_TOOLS = [
       required: ['line', 'message_id', 'emoji'],
     },
   },
+  {
+    name: 'typing',
+    group: 'write',
+    description:
+      'Show "typing…" once in a chat while you prepare an answer. The network clears it by itself after its own time (about 5 s on the Telegram bot, 10 s on Discord, 25 s on WhatsApp) or when you send. Call it again to show it again. Args: line.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        line: lineProp,
+      },
+      required: ['line'],
+    },
+  },
   {
     name: 'unreact',
+    group: 'write',
     description:
       'Remove an emoji reaction from a message. Args: line, message_id, emoji. The station is derived from the line.',
     inputSchema: {
@@ -181,6 +118,7 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'edit',
+    group: 'write',
     description:
       'Edit the text of a message you sent. Args: line, message_id, text. The station is ' +
       "derived from the line. Returns the daemon's reason if the station does not support edits.",
@@ -196,6 +134,8 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'delete',
+    group: 'write',
+    destructive: true,
     description:
       'Delete a message you sent. Args: line, message_id. The station is derived from the line. ' +
       "Returns the daemon's reason if the station does not support deletes.",
@@ -207,14 +147,26 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'read',
+    group: 'read',
     description:
-      'Read recent message history for a conversation. Args: line, limit?, before?, since?. The ' +
-      'station is derived from the line. Returns the raw history JSON (shapes differ per ' +
-      "station), or the daemon's reason if the station does not support reads.",
+      'Read message history. Args: line?, account?, limit?, before?, since?, until?, query?, ' +
+      'from?, unread_only?, message_id?. Give a line to read one conversation, or an account ' +
+      '(from list_accounts) instead of a line to read across that whole account, where the ' +
+      'station allows it. `message_id` returns that one message in full, with its files saved ' +
+      'like inbound media (url and local_path). Each station applies the filters it supports; ' +
+      'the answer lists any it did not apply in `ignored`, so check it. Returns the raw JSON ' +
+      "(shapes differ per station), or the daemon's reason if the station does not support " +
+      'reads. Outlook: `query` is a Microsoft search over all mail (with `from` folded into it; ' +
+      'line, since, until and unread_only then narrow what the search found), and without ' +
+      '`query` every filter is applied by Outlook itself, newest first.',
     inputSchema: {
       type: 'object',
       properties: {
         line: lineProp,
+        account: {
+          type: 'string',
+          description: 'An account id from list_accounts, to read the whole account when you give no line.',
+        },
         limit: { type: 'number', description: 'Max messages to return.' },
         before: {
           type: 'string',
@@ -224,18 +176,26 @@ export const COMMON_TOOLS = [
           type: 'string',
           description: 'Return messages since this timestamp.',
         },
+        until: {
+          type: 'string',
+          description: 'Return messages before this timestamp.',
+        },
+        query: { type: 'string', description: 'Free text to search for.' },
+        from: { type: 'string', description: 'Only messages from this sender (an id or an address).' },
+        unread_only: { type: 'boolean', description: 'Only messages not read yet.' },
+        message_id: { type: 'string', description: 'Return this one message in full.' },
       },
-      required: ['line'],
     },
   },
   {
     name: 'list_members',
+    group: 'read',
     description:
       'List the members of a Metro group/channel in a station-agnostic shape. Args: line, ' +
       'limit?. The station is derived from the line. Returns {line, station, memberCount, ' +
       'members:[{id, name?, display_name?, address?, roles?, is_admin?, is_bot?}], capability:' +
       '{supported, complete, reason?, total?}}. Each station fills the fields it has (xmtp: id=' +
-      'inboxId + address; discord: id + username/nick + roles + is_bot; telegram/telegram-user: ' +
+      'inboxId + address; discord-bot: id + username/nick + roles + is_bot; telegram-bot/telegram: ' +
       'id + username/first_name). Never throws on "not supported": stations that cannot ' +
       'enumerate (e.g. the Telegram Bot API) return an empty or partial list with a reason in ' +
       '`capability`. Check `capability.complete` before assuming the roster is exhaustive.',
@@ -253,11 +213,12 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'create_group',
+    group: 'write',
     description:
       'Create a new group/channel on a station and add members, in a station-agnostic shape. ' +
-      'Args: station (required, xmtp|telegram-user|discord|telegram), name (required), members? ' +
-      '(string[]; xmtp: 0x address or inboxId, telegram-user: @username or user id, discord: ' +
-      'user id), account? (which station account), parent? (discord only: the metro:// line of ' +
+      'Args: station (required, xmtp|telegram|discord-bot|telegram-bot), name (required), members? ' +
+      '(string[]; xmtp: 0x address or inboxId, telegram: @username or user id, discord-bot: ' +
+      'user id), account? (which station account), parent? (discord-bot only: the metro:// line of ' +
       'the channel to open the thread under). Returns {op, line (the NEW group line), station, ' +
       'supported, reason?, id?, name?, members:[{id, status: added|invited|removed|failed, ' +
       'reason?}], inviteLink?}. Never throws on "not supported": stations that lack the op ' +
@@ -269,7 +230,7 @@ export const COMMON_TOOLS = [
       properties: {
         station: {
           type: 'string',
-          description: 'The station to create the group on (xmtp|telegram-user|discord).',
+          description: 'The station to create the group on (xmtp|telegram|discord-bot).',
         },
         name: { type: 'string', description: 'The group/channel name.' },
         members: {
@@ -292,6 +253,7 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'add_members',
+    group: 'write',
     description:
       'Add members to an existing Metro group, in a station-agnostic shape. Args: line ' +
       '(required), members? (string[]; station-specific identifiers). xmtp also accepts ' +
@@ -324,6 +286,8 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'remove_members',
+    group: 'write',
+    destructive: true,
     description:
       'Remove members from an existing Metro group, in a station-agnostic shape. Args: line ' +
       '(required), members? (string[]). xmtp also accepts addresses?/inboxIds? for backward ' +
@@ -354,10 +318,11 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'export_invite',
+    group: 'write',
     description:
       'Get a join/invite link for a Metro group, for platforms where direct-add is not always ' +
       'permitted. Args: line (required). The station is derived from the line. Returns {op, ' +
-      'line, station, supported, reason?, inviteLink?}. Only telegram-user supports this today; ' +
+      'line, station, supported, reason?, inviteLink?}. Only telegram supports this today; ' +
       'other stations return {supported:false, reason}. Never throws on "not supported".',
     inputSchema: {
       type: 'object',
@@ -368,8 +333,9 @@ export const COMMON_TOOLS = [
   CREATE_UPLOAD_TOOL,
 ];
 
-export const LIST_ACCOUNTS_TOOL = {
+export const LIST_ACCOUNTS_TOOL: ToolDef = {
   name: 'list_accounts',
+  group: 'read',
   description:
     'List the configured messaging accounts across all stations (PUBLIC identity only: ' +
     'addresses, bot ids/usernames). No args. Never returns tokens, private keys, or the ' +
@@ -378,20 +344,3 @@ export const LIST_ACCOUNTS_TOOL = {
     'verb need not be discovered by trial and error.',
   inputSchema: { type: 'object', properties: {} },
 };
-
-export const MCP_INSTRUCTIONS =
-  'Messages from Metro chat arrive as <channel source="metro" line="..." from="..." ' +
-  'station="..." message_id="...">. To respond, use the messaging tools, always passing the ' +
-  '`line` attribute verbatim (the station is derived from it): `send` (text and/or media via ' +
-  '`attachments`, optional `reply_to`), `reply` (quote a `message_id` with `text`), `react`/' +
-  '`unreact` (emoji on a `message_id`), `edit`/`delete` (a `message_id`), and `read` (recent ' +
-  "history). Station support varies - the tool returns the daemon's reason if a verb is " +
-  'unsupported on that line. An inbound attachment is surfaced as a note carrying the ' +
-  "sender's own text alongside a `Public URL` - fetch that url to read the file; the note's " +
-  '`local_path` resolves on the DAEMON host, not on yours, so the Read tool works on it only ' +
-  'for an agent running there. To send a file OUT, call `create_upload`, ' +
-  'run the one curl line it hands back (that step needs a shell; the bytes go from your disk ' +
-  'straight to metro and never through this conversation), then `send` with ' +
-  'attachments:[{upload:"<upload_id>"}]. Inline `data` is for tiny files only, `url` only for ' +
-  'an already-public file, and `path` is read on the DAEMON host, not yours. Tool-approval ' +
-  'prompts are relayed to the same chat - answer "yes <id>"/"no <id>".';

package/runtime/node_modules/@metro-labs/{mcp → daemon}/src/mcp/upload-tool.ts

@@ -1,34 +1,29 @@
-import { publicBaseOrDefault } from '../daemon/attach-serve.js';
+import { publicBaseOrDefault } from '../files/attach-serve.js';
 import { safeFileName } from '../stations/attach-inline.js';
-import { guessMime } from '../stations/attachments.js';
+import { guessMime } from '@metro-labs/core/stations/attachments';
 import {
   createUploadSlot,
   issueUploadTicket,
   MAX_UPLOAD_BYTES,
   removeUpload,
   UPLOAD_TTL_MS,
-} from '../daemon/upload-store.js';
-import type { ToolResult } from '../stations/types.js';
+} from '../files/upload-store.js';
+import type { ToolResult } from '@metro-labs/core/stations/types';
 import { errResult, okJson } from './ctx.js';
 import { allowedAgents, currentIdentity } from './request-identity.js';
-import { str } from './str.js';
+import { str } from '@metro-labs/core/str';
 
 const ttlMinutes = (): number => Math.round(UPLOAD_TTL_MS / 60_000);
 
 const NO_AGENT =
   'create_upload needs an agent credential; this session is not scoped to one agent';
 
-const manyAgents = (n: number): string =>
-  `create_upload is scoped to one agent, but this session covers ${String(n)}` +
-  ' (a multi-agent sign-in); use `POST /api/uploads?agent=<id>` directly instead';
-
 type OwnerAgent = { agentId: string } | { error: string };
 
 function ownerAgent(): OwnerAgent {
   const allowed = allowedAgents(currentIdentity());
   const [only] = [...allowed];
-  if (allowed.size === 1 && only !== undefined) return { agentId: only };
-  return { error: allowed.size === 0 ? NO_AGENT : manyAgents(allowed.size) };
+  return allowed.size === 1 && only !== undefined ? { agentId: only } : { error: NO_AGENT };
 }
 
 export function dispatchCreateUpload(