@stage-labs/metro 0.1.0-beta.23 → 0.1.0-beta.230

package/dist/tail.js

@@ -0,0 +1,119 @@
+import { localAgent } from './local.js';
+import { assertAgentId, localUrl } from './runtime.js';
+const BACKOFF_MS = [1_000, 2_000, 5_000];
+const STALL_MS = 90_000;
+export const backoffAt = (attempt) => BACKOFF_MS[Math.min(attempt, BACKOFF_MS.length - 1)] ?? 5_000;
+export function sseDataLines(buffer, chunk) {
+    const lines = (buffer + chunk).split('\n');
+    const rest = lines.pop() ?? '';
+    const events = [];
+    for (const raw of lines) {
+        const line = raw.endsWith('\r') ? raw.slice(0, -1) : raw;
+        if (!line.startsWith('data:'))
+            continue;
+        const value = line.slice(5);
+        events.push(value.startsWith(' ') ? value.slice(1) : value);
+    }
+    return { rest, events };
+}
+function keySource(agentId) {
+    const fromEnv = process.env.METRO_AGENT_KEY?.trim();
+    if (fromEnv !== undefined && fromEnv !== '')
+        return { resolve: () => Promise.resolve(fromEnv), fixed: true };
+    return {
+        resolve: () => {
+            const agent = localAgent();
+            if (agent === null || (agentId !== undefined && agent.id !== agentId))
+                throw new Error(`no agent ${agentId === undefined ? '' : `${agentId} `}on this machine — start metro serve, or set METRO_AGENT_KEY`);
+            return Promise.resolve(agent.key);
+        },
+        fixed: false,
+    };
+}
+const armStall = (control) => setTimeout(() => {
+    control.abort();
+}, STALL_MS);
+async function connect(key, signal) {
+    try {
+        return await fetch(`${localUrl()}/api/tail`, {
+            headers: { authorization: `Bearer ${key}` },
+            signal,
+        });
+    }
+    catch {
+        return null;
+    }
+}
+async function pump(body, control, stall) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                return 'ended';
+            clearTimeout(stall.timer);
+            stall.timer = armStall(control);
+            const out = sseDataLines(buffer, decoder.decode(value, { stream: true }));
+            buffer = out.rest;
+            for (const event of out.events)
+                process.stdout.write(`${event}\n`);
+        }
+    }
+    catch {
+        return 'ended';
+    }
+}
+async function streamOnce(key) {
+    const control = new AbortController();
+    const stall = { timer: armStall(control) };
+    try {
+        const res = await connect(key, control.signal);
+        if (res === null)
+            return 'unreachable';
+        if (res.status === 401)
+            return 'unauthorized';
+        if (!res.ok || res.body === null)
+            return 'unreachable';
+        return await pump(res.body, control, stall);
+    }
+    finally {
+        clearTimeout(stall.timer);
+    }
+}
+function note(state, message) {
+    if (state.last === message)
+        return;
+    state.last = message;
+    process.stderr.write(`metro: ${message}\n`);
+}
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function settle(end, source, key, state) {
+    if (end === 'unauthorized') {
+        if (source.fixed)
+            throw new Error('the key in METRO_AGENT_KEY was refused by the local daemon');
+        note(state, 'key refused — fetching the current one');
+        return source.resolve();
+    }
+    if (end === 'unreachable')
+        note(state, `no metro daemon on ${localUrl()} — run 'metro serve'`);
+    else
+        note(state, 'stream ended — reconnecting');
+    return key;
+}
+export async function tailEvents(argv) {
+    const agentId = argv[0] === undefined ? undefined : assertAgentId(argv[0]);
+    const source = keySource(agentId);
+    let key = await source.resolve();
+    const state = { last: '' };
+    let attempt = 0;
+    for (;;) {
+        const end = await streamOnce(key);
+        if (end === 'ended')
+            attempt = 0;
+        key = await settle(end, source, key, state);
+        await delay(backoffAt(attempt));
+        attempt += 1;
+    }
+}

package/dist/update.js

@@ -9,7 +9,19 @@ export function installArgs(manager, version) {
         ? ['add', '--global', spec]
         : ['install', '--global', spec];
 }
-export async function update() {
+export const checkReport = (current, latest) => ({
+    current,
+    latest,
+    newer: latest !== '' && isNewer(latest, current),
+});
+async function updateCheck() {
+    return checkReport(currentVersion(), await publishedVersion());
+}
+export async function update(argv = []) {
+    if (argv.includes('--check')) {
+        process.stdout.write(`${JSON.stringify(await updateCheck())}\n`);
+        return 0;
+    }
     const current = currentVersion();
     const newest = await publishedVersion();
     if (newest === '') {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.23",
-  "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
+  "version": "0.1.0-beta.230",
+  "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -35,26 +35,5 @@
     "knip": "^6.15.0",
     "madge": "^8.0.0",
     "typescript": "^5"
-  },
-  "dependencies": {
-    "@discordjs/voice": "^0.19.2",
-    "@modelcontextprotocol/sdk": "^1.12.0",
-    "@mtcute/bun": "0.30.1",
-    "@xmtp/content-type-primitives": "^3.0.1",
-    "@xmtp/content-type-reaction": "^2.0.2",
-    "@xmtp/content-type-remote-attachment": "^2.0.4",
-    "@xmtp/content-type-reply": "^2.0.3",
-    "@xmtp/content-type-wallet-send-calls": "^2.0.0",
-    "@xmtp/node-bindings": "1.9.1",
-    "@xmtp/node-sdk": "^6.0.0",
-    "baileys": "7.0.0-rc14",
-    "discord.js": "^14.26.4",
-    "drizzle-orm": "^0.44.0",
-    "pino": "^9.5.0",
-    "pino-pretty": "^13.1.3",
-    "postgres": "^3.4.5",
-    "prism-media": "^1.3.5",
-    "viem": "^2.52.2",
-    "zod": "^3.23.8"
   }
 }

package/runtime/marketplace/.claude-plugin/marketplace.json

@@ -0,0 +1,12 @@
+{
+  "name": "metro",
+  "description": "Metro — connector relay and chat bridge for agents",
+  "owner": { "name": "Bonustrack", "url": "https://metro.box" },
+  "plugins": [
+    {
+      "name": "metro",
+      "source": "./plugin",
+      "description": "Every connector on this box as its own MCP server through metro's local relay, the orchestrator guard, and the standing rules loaded at session start."
+    }
+  ]
+}

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -0,0 +1,17 @@
+{
+  "name": "metro",
+  "version": "0.1.0-beta.230",
+  "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
+  "author": {
+    "name": "Bonustrack",
+    "url": "https://metro.box"
+  },
+  "repository": "https://github.com/bonustrack/metro",
+  "license": "MIT",
+  "keywords": [
+    "metro",
+    "mcp",
+    "connectors",
+    "relay"
+  ]
+}

package/runtime/marketplace/plugin/.mcp.json

@@ -0,0 +1 @@
+{}

package/runtime/marketplace/plugin/METRO.md

@@ -0,0 +1,26 @@
+---
+name: metro
+description: How this box's agent works on metro. Acknowledge, delegate, relay, answer over chat, never block on the terminal. Loaded at every session start by the metro plugin; edit it here to change the rules on this box.
+---
+
+You are the main thread of a Claude Code session that is connected to chat through metro, on a machine nobody watches. The main thread is an orchestrator: it may only delegate and talk. A guard in the metro plugin denies every other tool on this thread, so this is the shape of the work, not a preference.
+
+**Inbound.** A message arrives as a `<channel source="metro" …>` block. Read `addressed` first: `direct`, `mention` or `reply` means it is for you; without it the message merely happened in a room you watch, so treat it as context and stay silent unless the person plainly wants you. For a message that is for you, the first tool call is `react` on it (👀, then 👍 or ✅ once done) so the person knows you saw it, and any reply goes on the same `line`, passed verbatim. Exception: when the person asks you to close something ("mark as done"), skip the reaction and the acknowledgement: close it directly and confirm once when it is finished.
+
+**Typing.** Whenever you are about to send a message on a line within the next 10 seconds, call `typing` on that `line` first, so the person sees "typing…" while you write. It shows once and fades by itself (about 5 s on the Telegram bot, 10 s on Discord, 25 s on WhatsApp) or when your message arrives, so there is nothing to stop. Only WhatsApp, the Telegram bot and Discord support it; on other channels skip it.
+
+**Delegate everything that is work.** Reading files, running commands, searching, fetching pages, editing, and every connector tool: hand it to a subagent with the `Agent` tool, `subagent_type: "worker"`, always `run_in_background: true`, then keep answering chat while it runs and relay the result when the task notification arrives. A foreground subagent blinds you to chat and the guard refuses it. You may read image files yourself, so a screenshot someone sends is yours to look at.
+
+**Never wait on the terminal.** `AskUserQuestion`, plan mode and anything that blocks for a person at the keyboard are denied everywhere, main thread and subagents alike. When something is ambiguous, do what does not depend on it, choose the most reasonable reading, say so in your reply, and if a real decision is needed ask over chat with `send` and carry on. Tool-approval prompts reach the chat too; the person answers `yes <id>` or `no <id>` there.
+
+**Calls that need the owner's approval run in a worker.** The owner can make a metro tool on a channel wait for approval. On the main thread such a call is refused, because waiting for the answer would stop the whole session: hand that exact call to a background worker (`run_in_background: true`) and keep answering. The worker waits for the owner's answer on its own.
+
+**Finish what was asked.** You work on your own. Nobody is watching a screen, and a question sent to chat may go unanswered for hours, so asking "Shall I?" about work already requested simply stops it. Anything reversible that follows from the request, do. Stop only for a destructive action or a genuine change of scope. Before you end a turn, read your own last paragraph: if it is a plan, a question, a list of next steps or a promise ("I'll…", "Next…"), then the work is not done, so do it now, retries and missing information included. End the turn when the task is finished, or when you are truly blocked on something only the person can give you.
+
+The exception is a person describing a problem, asking a question or thinking out loud. There the answer IS the deliverable: reply, and change nothing until they ask.
+
+**The whole request is the deliverable.** Do not quietly make it smaller, larger or different. Read an ambiguity the way a careful colleague would, make the ordinary judgement calls yourself, and name the assumption in your reply. If one part turns out to be blocked, finish every other part and say plainly what you left out and why: scaling the work down is the person's call, not yours. Something else you notice on the way is a suggestion at the end of the reply, not extra work to do now.
+
+**Report like a relay.** A worker's report is the only evidence you have, so pass on what it verified and say plainly what it did not. Short messages on chat: lead with the outcome, one idea per sentence, no tool names, no file paths unless the person needs them. Send a file out with `create_upload` (the curl line it hands back runs in a worker) and then `send` with the upload id.
+
+**Keep going.** Long tasks run as background agents and loops; check in over chat when something lands rather than going quiet. The session is restarted by the daemon if it exits, so an interrupted task is resumed from chat, not from memory.

package/runtime/marketplace/plugin/STAGE.md

@@ -0,0 +1,42 @@
+---
+name: stage
+description: How to use Stage channels (XMTP groups, https://stage.box) through metro. Create a channel, rename it, add or remove members, set labels and assignees, read its info, and send, reply, react, unreact, delete and read messages. Works only when this agent has an XMTP account in metro.
+---
+
+Stage (https://stage.box) is a messenger built on XMTP. A Stage channel is an XMTP group. You use it with the metro tools below (`mcp__metro__<name>`).
+
+**XMTP only.** All of this needs an XMTP account connected to this agent in metro. Check with `list_accounts`: it must show an account under `xmtp`. Many agents have none. Then none of this works: say so plainly and do not try another channel. The owner can add an XMTP channel on https://metro.box.
+
+**Lines and links.** A channel's line is `metro://xmtp/<account>/<channel id>`. Pass it verbatim as `line`. Its link is `https://stage.box/#/channel/<channel id>`, the last part of the line. Stage shows Markdown, so `[#Launch plan](https://stage.box/#/channel/<channel id>)` is a clickable link. A `message_id` comes from the inbound message or from `read`.
+
+**Channels.**
+- Create: `create_group {"station": "xmtp", "name": "Launch plan", "members": ["0x…"]}`. Members are 0x addresses or XMTP inbox ids. It returns the new `line` and `id`.
+- Rename: `set_channel_metadata {"line": "…", "name": "New title"}`. No tool sets the description or the picture.
+- Add or remove people: `add_members {"line": "…", "members": ["0x…"]}`. `remove_members` takes the same shape.
+- Leave: `close_channel {"line": "…", "removeSelf": true}`.
+- Read: `group_info {"line": "…"}` gives the name, `labels`, `assigned`, `appData` and the members (`inboxId`, `address`). `list_members {"line": "…"}` gives the members only.
+- Direct chat: `dm {"address": "0x…"}` opens a 1:1 chat and returns its line.
+- With several XMTP accounts, add `"account": "<id>"` to `create_group` and `dm`.
+
+**Labels and assignees.** They live in the channel's metadata, and Stage shows them on the channel.
+- Labels: `set_channel_metadata {"line": "…", "metadata": {"labels": ["🚧 In progress", "Metro"]}}`. At most 16 labels of 24 characters each.
+- Assignees: `set_channel_metadata {"line": "…", "metadata": {"assigned": ["0x…"]}}`. Only 0x addresses of current members.
+- Each key you send replaces that whole list. Keys you leave out stay as they are. To add one label or one assignee, read `group_info` first and send the old list plus the new one. `[]` clears a list. Read `group_info` again to check it saved.
+
+**Task status labels.** When a channel is a task, keep exactly one of these status labels, plus any project labels:
+- `🗒️ Backlog`
+- `🎯 To-do`
+- `🚧 In progress`
+- `🔍 In review`
+- `✅ Done`
+- `🚫 Blocked`
+
+Move it from Backlog or To-do to In progress, then In review, then Done. Use Blocked while you wait on someone. To change it, read `group_info`, swap the old status for the new one in `labels`, keep the other labels, and send the whole list with `set_channel_metadata` `metadata.labels`.
+
+**Messages.**
+- Send: `send {"line": "…", "text": "Hello"}`. Reply with a quote: `reply {"line": "…", "message_id": "…", "text": "…"}`.
+- React: `react {"line": "…", "message_id": "…", "emoji": "👍"}`. `unreact` takes the same shape.
+- Delete one of your own messages: `delete {"line": "…", "message_id": "…"}`. XMTP has no edit and no typing.
+- History: `read {"line": "…", "limit": 20}`.
+- Poll: `ask {"line": "…", "question": "Ship today?", "options": ["Yes", "No"]}`.
+- File: `create_upload {"name": "report.pdf"}`, run the `curl` line it returns in a shell, then `send {"line": "…", "attachments": [{"upload": "<upload_id>"}]}`. Files that are not images are refused over about 190 KiB.

package/runtime/marketplace/plugin/bin/guard.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { policyVerdict } from './policy.mjs';
+
+const BLOCKING = new Set(['AskUserQuestion', 'ExitPlanMode', 'EnterPlanMode']);
+const ORCHESTRATION = new Set([
+  'Agent',
+  'Workflow',
+  'ToolSearch',
+  'Skill',
+  'ScheduleWakeup',
+  'Monitor',
+  'CronCreate',
+  'CronList',
+  'CronDelete',
+  'TaskCreate',
+  'TaskGet',
+  'TaskList',
+  'TaskOutput',
+  'TaskStop',
+  'TaskUpdate',
+]);
+const IMAGE = /\.(png|jpe?g|gif|webp|bmp)$/i;
+const MCP = /^mcp__/;
+const METRO_MCP = /^mcp__metro__/;
+
+function answer(decision, reason) {
+  process.stdout.write(
+    `${JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: decision, permissionDecisionReason: reason } })}\n`,
+  );
+}
+
+function ownerPolicy(tool, input, subagent) {
+  const verdict = policyVerdict(tool, input);
+  if (verdict === null) return null;
+  const { where } = verdict;
+  if (verdict.access === 'deny') return { decision: 'deny', reason: `Blocked by the owner's policy for ${verdict.owner} (${verdict.tool}).` };
+  if (subagent) return { decision: 'ask', reason: `The owner asked to approve ${where}.` };
+  return {
+    decision: 'deny',
+    reason: `${where} needs the owner's approval, and waiting for it here would stop the whole session. Run this exact call from a background worker (Agent, run_in_background: true): the worker waits for the owner's answer while you keep answering.`,
+  };
+}
+
+function verdict(payload, input) {
+  const tool = typeof payload.tool_name === 'string' ? payload.tool_name : '';
+  if (BLOCKING.has(tool))
+    return `${tool} blocks the session waiting on the terminal, and nobody is watching it. Decide with your best judgement and state the assumption, or ask over chat with the metro tools and keep working in the meantime.`;
+  if (typeof payload.agent_id === 'string' && payload.agent_id !== '') return null;
+  if (tool === 'Agent' && input.run_in_background === false)
+    return 'A foreground subagent blinds the main thread: it cannot see or acknowledge inbound metro messages until the agent finishes. Re-issue the identical Agent call with run_in_background: true, then wait for the task notification.';
+  if (ORCHESTRATION.has(tool)) return null;
+  if (METRO_MCP.test(tool)) return null;
+  if (MCP.test(tool))
+    return `A connector call is work, not orchestration: ${tool} reads somebody's files, mail or records, and its answer can be long enough to crowd out the chat you are here to follow. Only metro's own tools run on this thread. Delegate it to a subagent with the Agent tool (run_in_background: true; the worker reaches every connector) and relay what it finds.`;
+  if (tool === 'Read' && typeof input.file_path === 'string' && IMAGE.test(input.file_path)) return null;
+  return `The main thread is orchestrator-only, so ${tool === '' ? 'this tool' : tool} is not available here. Delegate the work to a subagent with the Agent tool (run_in_background: true; the worker agent has full tool access) or to a Workflow, and report the result over metro.`;
+}
+
+let payload = {};
+try {
+  payload = JSON.parse(readFileSync(0, 'utf8'));
+} catch {
+  payload = {};
+}
+const shaped = payload !== null && typeof payload === 'object' ? payload : {};
+const input = shaped.tool_input !== null && typeof shaped.tool_input === 'object' ? shaped.tool_input : {};
+const reason = verdict(shaped, input);
+const policy = reason === null && typeof shaped.tool_name === 'string' ? ownerPolicy(shaped.tool_name, input, typeof shaped.agent_id === 'string' && shaped.agent_id !== '') : null;
+if (reason !== null) answer('deny', reason);
+else if (policy !== null) answer(policy.decision, policy.reason);

package/runtime/marketplace/plugin/bin/metro-plugin.mjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const agentsDir = () => process.env.METRO_AGENTS_DIR || join(homedir(), '.metro', 'agents');
+
+function readAgent() {
+  const path = join(agentsDir(), 'agent.json');
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    throw new Error(`no agent on this machine yet (${path})`);
+  }
+  if (typeof parsed?.key !== 'string') throw new Error(`no agent key in ${path}`);
+  return parsed;
+}
+
+if (process.argv[2] !== 'headers') {
+  process.stderr.write('usage: metro-plugin.mjs headers\n');
+  process.exit(1);
+}
+
+try {
+  process.stdout.write(`${JSON.stringify({ Authorization: `Bearer ${readAgent().key}` })}\n`);
+} catch (err) {
+  process.stderr.write(`metro: ${err.message}\n`);
+  process.stdout.write('{}\n');
+}

package/runtime/marketplace/plugin/bin/policy.mjs

@@ -0,0 +1,97 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const METRO_TOOL = /^mcp__metro__(.+)$/;
+const RANK = { allow: 0, ask: 1, deny: 2 };
+const LINE_FIELD = { get_profile: 'from' };
+const STATION_ARG = new Set(['create_group', 'set_profile']);
+
+const isRecord = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+const text = (v) => (typeof v === 'string' ? v : '');
+const agentsDir = () => process.env.METRO_AGENTS_DIR?.trim() || join(homedir(), '.metro', 'agents');
+
+function readSnapshot() {
+  try {
+    const parsed = JSON.parse(readFileSync(join(agentsDir(), 'policy.json'), 'utf8'));
+    return isRecord(parsed) && parsed.version === 1 ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+const fromLine = (line, override) => {
+  const parts = line.split('/');
+  return line.startsWith('metro://') && parts[2] && parts[3] ? [{ station: parts[2], account: override || parts[3] }] : [];
+};
+
+function stationOfAccount(snap, account) {
+  const hits = Object.entries(isRecord(snap.stations) ? snap.stations : {}).filter(
+    ([, ids]) => Array.isArray(ids) && ids.includes(account),
+  );
+  return hits.length === 1 ? hits[0][0] : undefined;
+}
+
+function targets(snap, name, input) {
+  if (Array.isArray(snap.ungated) && snap.ungated.includes(name)) return [];
+  const account = text(input.account);
+  const line = text(input[LINE_FIELD[name] ?? 'line']);
+  if (line) return fromLine(line, name in LINE_FIELD ? '' : account);
+  const owners = isRecord(snap.owners) ? snap.owners : {};
+  const station = (STATION_ARG.has(name) ? text(input.station) : text(owners[name])) || (account ? stationOfAccount(snap, account) : undefined);
+  if (!station) return [];
+  if (account) return [{ station, account }];
+  const ids = isRecord(snap.stations) && Array.isArray(snap.stations[station]) ? snap.stations[station] : [];
+  return ids.map((id) => ({ station, account: id }));
+}
+
+function decide(policy, name, group) {
+  if (!isRecord(policy)) return 'allow';
+  const byTool = isRecord(policy.tools) ? policy.tools[name] : undefined;
+  const access = byTool ?? policy[group] ?? 'allow';
+  return access in RANK ? access : 'allow';
+}
+
+const normalized = (name) => name.replace(/[^a-zA-Z0-9_-]/g, '_');
+
+function connectorCall(snap, toolName) {
+  for (const [server, entry] of Object.entries(isRecord(snap.connectors) ? snap.connectors : {})) {
+    if (!isRecord(entry)) continue;
+    const name = text(entry.name);
+    const prefixes = [`mcp__plugin_metro_${server}__`, `mcp__${server}__`, `mcp__${normalized(`metro.box ${name}`)}__`];
+    const prefix = prefixes.find((p) => toolName.startsWith(p) && toolName.length > p.length);
+    if (prefix === undefined) continue;
+    const called = toolName.slice(prefix.length);
+    const tools = isRecord(entry.tools) ? entry.tools : {};
+    const policy = isRecord(entry.policy) ? entry.policy : {};
+    const known = [...Object.keys(tools), ...Object.keys(isRecord(policy.tools) ? policy.tools : {})];
+    const tool = known.find((k) => k === called) ?? known.find((k) => normalized(k) === called) ?? called;
+    return { name: name || server, tool, group: tools[tool] === 'read' ? 'read' : 'write', policy };
+  }
+  return null;
+}
+
+function connectorVerdict(snap, toolName) {
+  const call = connectorCall(snap, toolName);
+  if (call === null) return null;
+  const access = decide(call.policy, call.tool, call.group);
+  return access === 'allow' ? null : { access, tool: call.tool, owner: call.name, where: `${call.tool} on ${call.name}` };
+}
+
+export function policyVerdict(toolName, input) {
+  const name = METRO_TOOL.exec(toolName)?.[1];
+  if (name === undefined && !toolName.startsWith('mcp__')) return null;
+  const snap = readSnapshot();
+  if (snap === null) return null;
+  if (name === undefined) return connectorVerdict(snap, toolName);
+  const tools = isRecord(snap.tools) ? snap.tools : {};
+  const group = tools[name] === 'read' ? 'read' : 'write';
+  const accounts = isRecord(snap.accounts) ? snap.accounts : {};
+  let verdict = null;
+  for (const target of targets(snap, name, input)) {
+    const access = decide(accounts[`${target.station}/${target.account}`], name, group);
+    if (access !== 'allow' && (verdict === null || RANK[access] > RANK[verdict.access]))
+      verdict = { access, tool: name, owner: target.station, where: `${name} on ${target.station} (${target.account})` };
+  }
+  return verdict;
+}

package/runtime/marketplace/plugin/bin/session-start.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const given = (value) => (typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined);
+const claudeDir = given(process.env.CLAUDE_CONFIG_DIR) ?? join(given(process.env.HOME) ?? homedir(), '.claude');
+const SKILL = join(claudeDir, 'skills', 'metro', 'SKILL.md');
+const FALLBACK = join(dirname(dirname(fileURLToPath(import.meta.url))), 'METRO.md');
+
+const body = (text) => text.replace(/^---[\s\S]*?\n---\n/, '').trim();
+
+function guidance() {
+  for (const path of [SKILL, FALLBACK]) {
+    if (!existsSync(path)) continue;
+    try {
+      const text = body(readFileSync(path, 'utf8'));
+      if (text !== '') return text;
+    } catch {
+      continue;
+    }
+  }
+  return '';
+}
+
+const text = guidance();
+if (text !== '')
+  process.stdout.write(
+    `${JSON.stringify({ hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: `This machine runs as a metro agent. Standing rules, kept in the metro skill:\n\n${text}` } })}\n`,
+  );

package/runtime/marketplace/plugin/hooks/hooks.json

@@ -0,0 +1,25 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bin/guard.mjs\"",
+            "statusMessage": "Checking the orchestrator boundary"
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bin/session-start.mjs\""
+          }
+        ]
+      }
+    ]
+  }
+}

package/runtime/node_modules/@metro-labs/core/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@metro-labs/core",
+  "version": "0.1.0",
+  "private": true,
+  "description": "What every metro process shares: the logger, the event bus and its types, ids, secure file writes, the train protocol, station types and attachment handling. No HTTP, no policy.",
+  "type": "module",
+  "exports": {
+    "./log": "./src/log.ts",
+    "./events": "./src/events.ts",
+    "./is-record": "./src/is-record.ts",
+    "./secure-fs": "./src/secure-fs.ts",
+    "./version": "./src/version.ts",
+    "./train-error": "./src/train-error.ts",
+    "./trains/protocol": "./src/protocol.ts",
+    "./ids": "./src/ids.ts",
+    "./tickets": "./src/tickets.ts",
+    "./station-names": "./src/station-names.ts",
+    "./str": "./src/str.ts",
+    "./lines": "./src/lines.ts",
+    "./endpoints": "./src/endpoints.ts",
+    "./stations/types": "./src/stations/types.ts",
+    "./stations/account-files": "./src/stations/account-files.ts",
+    "./stations/station-runtime": "./src/stations/station-runtime.ts",
+    "./stations/account-store": "./src/stations/account-store.ts",
+    "./stations/attachments": "./src/stations/attachments.ts",
+    "./stations/mail": "./src/stations/mail.ts",
+    "./stations/mail-text": "./src/stations/mail-text.ts",
+    "./stations/mail-trust": "./src/stations/mail-trust.ts",
+    "./stations/oauth": "./src/stations/oauth.ts",
+    "./stations/messaging-normalize": "./src/stations/messaging-normalize.ts",
+    "./stations/profile": "./src/stations/profile.ts",
+    "./stations/sender-profile": "./src/stations/sender-profile.ts",
+    "./stations/train-events": "./src/stations/train-events.ts",
+    "./stations/train-boot": "./src/stations/train-boot.ts"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "tsc --noEmit && METRO_STATE_DIR=\"$(mktemp -d /tmp/metro-test.XXXXXX)\" bun test test/"
+  },
+  "dependencies": {
+    "pino": "^9.5.0",
+    "pino-pretty": "^13.1.3"
+  },
+  "devDependencies": {
+    "@stage-labs/config": "0.1.0-beta.2",
+    "eslint": "^10.3.0",
+    "knip": "^6.15.0",
+    "madge": "^8.0.0",
+    "typescript": "^5"
+  }
+}

package/runtime/node_modules/@metro-labs/core/src/endpoints.ts

@@ -0,0 +1,7 @@
+export interface Endpoint {
+  id: string;
+  webhookId?: string;
+  label: string;
+  secret?: string;
+  createdAt: string;
+}

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → core/src}/events.ts

@@ -1,7 +1,8 @@
-import { randomBytes } from 'node:crypto';
-import { Line } from '../stations/lines.js';
+import { Line } from './lines.js';
+import { errMsg, log } from './log.js';
 
-export { userSelf, daemonSelf, selfLine } from './identity.js';
+export const userSelf = (): Line =>
+  (process.env.METRO_FROM ?? 'metro://user') as Line;
 
 export type StructuredEvent =
   | { type: 'msg' }
@@ -24,6 +25,10 @@ export interface MetroEvent {
   text?: string;
   messageId?: string;
   replyTo?: string;
+  isPrivate?: boolean;
+  mentionsSelf?: boolean;
+  replyToSelf?: boolean;
+  senderVerified?: boolean;
   payload?: unknown;
   display?: string;
   event?: StructuredEvent;
@@ -71,8 +76,7 @@ export function formatDisplay(e: MetroEvent): string {
   return `${headerFor('📩', [e.station, e.fromName ?? e.from, e.lineName])}\n> ${body}`;
 }
 
-export const mintId = (): string =>
-  `msg_${randomBytes(6).toString('base64url')}`;
+export { mintId } from './ids.js';
 
 export type BusListener = (event: MetroEvent, busSeq: number) => void;
 
@@ -81,7 +85,7 @@ export interface BufferedEvent {
   event: MetroEvent;
 }
 
-export const BUS_BUFFER_MAX = 500;
+const BUS_BUFFER_MAX = 500;
 
 const listeners = new Set<BusListener>();
 const buffer: BufferedEvent[] = [];
@@ -96,7 +100,7 @@ export function publishEvent(event: MetroEvent): void {
     try {
       fn(event, seq);
     } catch (err) {
-      console.error('[metro-bus] listener threw for busSeq', seq, err);
+      log.error({ busSeq: seq, err: errMsg(err) }, 'bus: a listener threw');
     }
   }
 }