@stage-labs/metro 0.1.0-beta.302 → 0.1.0-beta.304

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.302",
+  "version": "0.1.0-beta.304",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.302",
-  "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
+  "version": "0.1.0-beta.304",
+  "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon (or one `mcp` server on mcp.metro.box), the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",
     "url": "https://metro.box"

package/runtime/marketplace/plugin/METRO.md

@@ -15,6 +15,8 @@ You are the main thread of a Claude Code session that is connected to chat throu
 
 **Calls that need the owner's approval run in a worker.** The owner can make a metro tool on a channel wait for approval. On the main thread such a call is refused, because waiting for the answer would stop the whole session: hand that exact call to a background worker (`run_in_background: true`) and keep answering. The worker waits for the owner's answer on its own.
 
+**Connectors through the `mcp` server.** When the `mcp` server is present, it holds every connector tool behind two tools. Find what you need with `find_tools`: `select:notion.search,linear.create_issue` for exact names, keywords (`notion page update`) to rank, or `+slack send` to require `slack` in the tool name. Have a worker run them with `call_tool`, up to 10 independent calls in one go. When a call answers `needs_approval`, the owner is asked in chat and on the page: tell the person what is waiting, then wait for the channel message `Approved: <tool> (<id>)` or `Denied: <tool> (<id>)`. After an approval, have a worker call `call_tool` again with the same tool and arguments and `approval: "<id>"`.
+
 **Finish what was asked.** You work on your own. Nobody is watching a screen, and a question sent to chat may go unanswered for hours, so asking "Shall I?" about work already requested simply stops it. Anything reversible that follows from the request, do. Stop only for a destructive action or a genuine change of scope. Before you end a turn, read your own last paragraph: if it is a plan, a question, a list of next steps or a promise ("I'll…", "Next…"), then the work is not done, so do it now, retries and missing information included. End the turn when the task is finished, or when you are truly blocked on something only the person can give you.
 
 The exception is a person describing a problem, asking a question or thinking out loud. There the answer IS the deliverable: reply, and change nothing until they ask.

package/runtime/marketplace/plugin/bin/guard.mjs

@@ -23,6 +23,7 @@ const ORCHESTRATION = new Set([
 const IMAGE = /\.(png|jpe?g|gif|webp|bmp)$/i;
 const MCP = /^mcp__/;
 const METRO_MCP = /^mcp__metro__/;
+const FIND_TOOLS = 'mcp__plugin_metro_mcp__find_tools';
 const VOICE = process.env.METRO_SESSION === 'voice';
 
 function answer(decision, reason) {
@@ -54,7 +55,7 @@ function verdict(payload, input) {
       : 'A foreground subagent blinds the main thread: it cannot see or acknowledge inbound metro messages until the agent finishes. Re-issue the identical Agent call with run_in_background: true, then wait for the task notification.';
   if (VOICE) return null;
   if (ORCHESTRATION.has(tool)) return null;
-  if (METRO_MCP.test(tool)) return null;
+  if (METRO_MCP.test(tool) || tool === FIND_TOOLS) return null;
   if (MCP.test(tool))
     return `A connector call is work, not orchestration: ${tool} reads somebody's files, mail or records, and its answer can be long enough to crowd out the chat you are here to follow. Only metro's own tools run on this thread. Delegate it to a subagent with the Agent tool (run_in_background: true; the worker reaches every connector) and relay what it finds.`;
   if (tool === 'Read' && typeof input.file_path === 'string' && IMAGE.test(input.file_path)) return null;

package/runtime/marketplace/plugin/bin/metro-plugin.mjs

@@ -4,6 +4,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 
 const agentsDir = () => process.env.METRO_AGENTS_DIR || join(homedir(), '.metro', 'agents');
+const MCP_TOKEN = /^mcp_[A-Za-z0-9_-]{43}$/;
 
 function readAgent() {
   const path = join(agentsDir(), 'agent.json');
@@ -17,8 +18,25 @@ function readAgent() {
   return parsed;
 }
 
-if (process.argv[2] !== 'headers') {
-  process.stderr.write('usage: metro-plugin.mjs headers\n');
+function readMcpToken() {
+  try {
+    const token = readFileSync(join(agentsDir(), 'mcp-token'), 'utf8').trim();
+    return MCP_TOKEN.test(token) ? token : null;
+  } catch {
+    return null;
+  }
+}
+
+const command = process.argv[2];
+
+if (command === 'mcp-headers') {
+  const token = readMcpToken();
+  if (token !== null) process.stdout.write(`${JSON.stringify({ Authorization: `Bearer ${token}` })}\n`);
+  process.exit(0);
+}
+
+if (command !== 'headers') {
+  process.stderr.write('usage: metro-plugin.mjs headers | mcp-headers\n');
   process.exit(1);
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/view.ts

@@ -3,6 +3,8 @@ import { join } from 'node:path';
 import { errMsg, log } from '@metro-labs/core/log';
 import { isRecord } from '@metro-labs/core/is-record';
 import { agentsDir } from '../agents/files.js';
+import { mcpServerUrl } from '../mcp-server/config.js';
+import { MCP_TOKEN_FILE } from '../mcp-server/token.js';
 import { removeHome, writeHomeText } from './home-fs.js';
 import { closeMetroHome } from './metro-home.js';
 import { agentUser, agentViewDir, type AgentUser } from './user.js';
@@ -49,7 +51,8 @@ export function viewFiles(dir = agentsDir()): Map<string, string | null> {
     ['agent.json', agentFile(dir)],
     ['model.json', modelFile(dir)],
   ]);
-  for (const name of COPIED) files.set(name, existsSync(join(dir, name)) ? readText(join(dir, name)) : null);
+  const copied = mcpServerUrl() === null ? COPIED : [...COPIED, MCP_TOKEN_FILE];
+  for (const name of copied) files.set(name, existsSync(join(dir, name)) ? readText(join(dir, name)) : null);
   return files;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/agents/bundle.ts

@@ -5,7 +5,7 @@ import { apiFailure, apiSession, cors, readJsonBody, requireAdmin, sendJson } fr
 import { ApiError } from '@metro-labs/http/api-error';
 import { isRecord } from '@metro-labs/core/is-record';
 import { parseId } from '@metro-labs/core/ids';
-import type { LoadedAccount, LoadedAgent, LoadedConnector } from '../stations/materialize.js';
+import type { LoadedAccount, LoadedAgent } from '../stations/materialize.js';
 import { STATIONS } from '@metro-labs/core/station-names';
 import { approversOf } from './files.js';
 
@@ -17,7 +17,7 @@ const STATION_NAMES = new Set<string>(STATIONS);
 export interface AgentBundle {
   version: 1;
   agent: { id: string; name: string; stations: LoadedAccount[] };
-  connectors: LoadedConnector[];
+  connectors: [];
 }
 
 export const loadedAgentOf = (bundle: AgentBundle): LoadedAgent => ({
@@ -68,13 +68,6 @@ function stationOf(raw: unknown): LoadedAccount {
   };
 }
 
-function connectorOf(raw: unknown): LoadedConnector {
-  if (!isRecord(raw) || typeof raw.id !== 'string' || typeof raw.name !== 'string' || typeof raw.url !== 'string')
-    throw bad('a connector is missing its id, name or url');
-  if (!isRecord(raw.config)) throw bad('a connector has no config');
-  return { id: raw.id, name: raw.name, url: raw.url, config: raw.config };
-}
-
 function agentOf(raw: unknown): AgentBundle['agent'] {
   if (!isRecord(raw)) throw bad('not a v1 agent bundle');
   const { id, name, stations } = raw;
@@ -85,8 +78,7 @@ function agentOf(raw: unknown): AgentBundle['agent'] {
 
 export function parseBundle(raw: unknown): AgentBundle {
   if (!isRecord(raw) || raw.version !== 1) throw bad('not a v1 agent bundle');
-  const connectors = Array.isArray(raw.connectors) ? raw.connectors : [];
-  return { version: 1, agent: agentOf(raw.agent), connectors: connectors.map(connectorOf) };
+  return { version: 1, agent: agentOf(raw.agent), connectors: [] };
 }
 
 async function answer(req: IncomingMessage, deps: BundleApiDeps, path: string): Promise<unknown> {

package/runtime/node_modules/@metro-labs/daemon/src/approvals/pending.ts

@@ -17,6 +17,7 @@ export interface PendingPrompt {
   line: string | undefined;
   at: number;
   call?: CallSource;
+  origin?: 'mcp-server';
 }
 
 interface Held extends PendingPrompt {
@@ -93,6 +94,8 @@ export const pendingPrompts = (): PendingPrompt[] => [...held.values()].map(show
 
 export const promptLine = (requestId: string): string | undefined => held.get(requestId)?.line;
 
+export const isPromptHeld = (requestId: string): boolean => held.has(requestId);
+
 function chatNotice(via: AnsweredVia, behavior: Behavior): string | undefined {
   if (via === 'expiry') return 'Expired, denied.';
   if (via === 'page') return behavior === 'allow' ? 'Approved on the page.' : 'Denied on the page.';
@@ -116,8 +119,12 @@ export async function answerPrompt(
   const entry = held.get(requestId);
   if (entry === undefined) return undefined;
   held.delete(requestId);
-  if (behavior === 'allow' && via !== 'expiry') grant(entry);
-  log.info({ requestId, tool: entry.tool, behavior, by: who === via ? via : `${via} ${who}` }, 'approvals: a Claude Code permission prompt answered');
+  const server = entry.origin === 'mcp-server';
+  if (behavior === 'allow' && via !== 'expiry' && !server) grant(entry);
+  log.info(
+    { requestId, tool: entry.tool, behavior, by: who === via ? via : `${via} ${who}` },
+    server ? 'approvals: an mcp.metro.box approval answered' : 'approvals: a Claude Code permission prompt answered',
+  );
   await entry.send(behavior);
   await tellChat(entry, via, behavior);
   return shown(entry);
@@ -152,7 +159,7 @@ export function revokeCallPrompts(route: CallRoute): void {
 
 export function settlePrompts(toolMatches: (tool: string) => boolean, args: Record<string, unknown>): void {
   for (const [id, entry] of held)
-    if (toolMatches(entry.tool) && previewMatches(entry.preview, args)) {
+    if (entry.origin !== 'mcp-server' && toolMatches(entry.tool) && previewMatches(entry.preview, args)) {
       held.delete(id);
       log.info({ requestId: id, tool: entry.tool }, 'approvals: the call reached metro, so Claude Code already closed the prompt');
     }

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -21,10 +21,12 @@ import {
   trainEventToMetroEvent,
 } from '../routes/http.js';
 import { agentsDir, fileSource } from '../agents/files.js';
-import { publishLocalConnectors } from '../connectors/publication.js';
+import { connectorsReady, publishConnectors } from '../connectors/publication.js';
+import { adoptOrgServerKeys } from '../connectors/org-adopt.js';
 import { readAgentKey } from '../connectors/agent-key.js';
 import { stopOrgConnectorSync, watchOrgConnectorSync } from '../connectors/org-sync-watch.js';
-import { loadConnectorPolicies, readLocalConnectors } from '../connectors/store.js';
+import { stopMcpServer, watchMcpServer } from '../mcp-server/link.js';
+import { holdServerApproval } from '../mcp/server-approvals.js';
 import { ensureMetroPlugin } from '../claude/plugin-install.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
 import { provisionAgentUser } from '../agent-user/provision.js';
@@ -140,10 +142,8 @@ function sessionApis(setLiveEvents: (on: boolean) => void, switchModel: (model:
 async function main(): Promise<void> {
   applyLocalOwner();
 installBearerSessions(agentsDir(), localOwner);
+  adoptOrgServerKeys();
   watchPolicySnapshot();
-  loadConnectorPolicies().catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'connector policy: loading the policies failed');
-  });
   log.info({ agent: await ensureLocalAgent() }, 'local daemon: agent');
   await materializeFrom(fileSource);
   ensureStationDeps();
@@ -160,10 +160,15 @@ installBearerSessions(agentsDir(), localOwner);
   );
   metroMcp.startInbound();
   startPromptExpiry();
-  publishLocalConnectors(readLocalConnectors());
   startUploadReaper();
   startAttachReaper();
   watchOrgConnectorSync({ owner: localOwner, key: readAgentKey });
+  watchMcpServer({
+    owner: localOwner,
+    hold: (approval, answer) => {
+      holdServerApproval(approval, answer, emit);
+    },
+  });
   startCloudWatchPublisher();
   watchFallbackUsage();
   announceLocalEndpoint();
@@ -195,7 +200,7 @@ async function startClaude(): Promise<void> {
   ensureMetroPlugin()
     .then((outcome) => {
       log.info({ outcome }, 'plugin: metro plugin for Claude Code');
-      if (outcome !== 'skipped') publishLocalConnectors(readLocalConnectors());
+      if (outcome !== 'skipped') publishConnectors();
     })
     .catch((err: unknown) => {
       log.warn({ err: errMsg(err) }, 'plugin: could not ensure the Claude Code plugin');
@@ -203,7 +208,7 @@ async function startClaude(): Promise<void> {
   tryClaudeSetup();
   try { githubSkills().watch(); } catch { log.warn('github-skills: saved source could not be loaded'); }
   tryMemoryJob(memoryRoutine());
-  watchSession();
+  watchSession({ connectorsReady: () => connectorsReady() });
 }
 
 const SHUTDOWN_TIMEOUT_MS = 3_000;
@@ -216,6 +221,9 @@ async function shutdown(): Promise<void> {
   shuttingDown = true;
   log.info('dispatcher shutting down');
   stopOrgConnectorSync(true);
+  stopMcpServer().catch((err: unknown) => {
+    log.warn({ err: errMsg(err) }, 'mcp-server: could not stop the approval relay');
+  });
   const leaving = leaveCallsForShutdown();
   unwatchSession();
   tunnel?.stop();

package/runtime/node_modules/@metro-labs/daemon/src/channels/inbound.ts

@@ -7,6 +7,7 @@ import {
   type SavedMedia,
 } from './media-note.js';
 import { buildWebhookNote } from './webhook-note.js';
+import { isMetroNotice } from './notice.js';
 import { replyMeta } from './addressed.js';
 import { reactContent, reactionEmoji } from './react-note.js';
 import {
@@ -285,7 +286,9 @@ export class InboundRelay {
     capSet(this.allowedLines, ALLOWED_LINES_MAX);
   }
 
-  private droppedSender(from: string, line: string, verified: unknown): boolean {
+  private droppedSender(ev: Record<string, unknown>, from: string, line: string): boolean {
+    if (isMetroNotice(ev)) return false;
+    const verified = ev.senderVerified;
     if (
       from.startsWith('metro://claude') ||
       from === 'metro://user' ||
@@ -311,7 +314,7 @@ export class InboundRelay {
     if (!this.deps.getStations().has(station)) return null;
     const from = str(ev.from);
     const line = str(ev.line);
-    if (this.droppedSender(from, line, ev.senderVerified)) return null;
+    if (this.droppedSender(ev, from, line)) return null;
     const text = str(ev.text);
     if (!replay && this.isDuplicate(station, line, evType, str(ev.messageId))) {
       this.deps.log(
@@ -337,7 +340,7 @@ export class InboundRelay {
     if (await this.handlePermissionReply(ev, base)) return;
     await this.notify('notifications/claude/channel', {
       content:
-        base.evType === 'system'
+        base.evType === 'system' && !isMetroNotice(ev)
           ? buildWebhookNote(base.text, str(ev.lineName), ev.payload)
           : base.text,
       meta: {

package/runtime/node_modules/@metro-labs/daemon/src/channels/notice.ts

@@ -0,0 +1,22 @@
+import { mintId, type MetroEvent } from '@metro-labs/core/events';
+import { isRecord } from '@metro-labs/core/is-record';
+import { asLine, Line } from '@metro-labs/core/lines';
+
+const NOTICE_FROM = 'metro://metro';
+const NOTICE_SOURCE = 'metro';
+
+export function metroNotice(line: string, text: string): MetroEvent {
+  return {
+    id: mintId(),
+    ts: new Date().toISOString(),
+    station: Line.station(line) ?? '',
+    line: asLine(line),
+    from: asLine(NOTICE_FROM),
+    to: asLine(line),
+    text,
+    event: { type: 'system', source: NOTICE_SOURCE },
+  };
+}
+
+export const isMetroNotice = (ev: Record<string, unknown>): boolean =>
+  ev.from === NOTICE_FROM && isRecord(ev.event) && ev.event.type === 'system' && ev.event.source === NOTICE_SOURCE;

package/runtime/node_modules/@metro-labs/daemon/src/claude/session.ts

@@ -49,6 +49,7 @@ export interface SessionDeps {
   now?: () => number;
   version?: string;
   prepare?: (runner: HarnessRunner) => Promise<void>;
+  connectorsReady?: () => boolean;
 }
 
 export interface SessionStatus {
@@ -316,9 +317,10 @@ function strike(now: number): boolean {
   return true;
 }
 
-export type Ensured = 'started' | 'restarted' | 'running' | 'blocked' | 'off' | 'paused';
+export type Ensured = 'started' | 'restarted' | 'running' | 'blocked' | 'off' | 'paused' | 'waiting';
 
 function holdsBack(deps: SessionDeps, now: number): Ensured | null {
+  if (deps.connectorsReady?.() === false) return 'waiting';
   if (now < memory.pausedUntil) return 'paused';
   if (sessionBlocked(deps) !== null) return 'blocked';
   return strike(now) ? 'paused' : null;

package/runtime/node_modules/@metro-labs/daemon/src/claude/setup.ts

@@ -151,6 +151,7 @@ const PRIOR_METRO: ReadonlySet<string> = new Set([
   'e6b59eba825b4568dfa9ace5049fd9568a2e10d731719976ad2657084fd4e5f9',
   '5ce3f76d610aae91adc922d0edc6c8be1f27aa2fec4a5e3a6d6231a04fb9310b',
   'b910597d24f31fa479b130a2545f94dd23684d802d99e36b637fc57c818a33be',
+  'd3f7ed0f5175b9a7a77f06f6204ae0020369d0c8f6e2724196bb3c5822d4d8ba',
 ]);
 const PRIOR_STAGE: ReadonlySet<string> = new Set([
   'dd7d30474765de3865ddc87c1cf3220161ded09502027cdff18597e5df0aab43',

package/runtime/node_modules/@metro-labs/daemon/src/connectors/gates.ts

@@ -2,7 +2,6 @@ import type { ToolGroup } from '@metro-labs/core/stations/types';
 import { decide, policyFor, setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
 import { serverKeysOf } from './plugin-sync.js';
 import { NEEDS_APPROVAL, revokeToolPrompts, settlePrompts, takeGrant } from '../approvals/pending.js';
-import { isOrgRelayId } from './relay-id.js';
 import type { BlockedReason } from './relay-policy.js';
 
 export interface GateRow {
@@ -101,14 +100,5 @@ export function connectorToolOf(toolName: string, entries: readonly ConnectorGat
   for (const gate of entries)
     for (const prefix of [`mcp__plugin_metro_${gate.server}__`, `mcp__${gate.server}__`])
       if (toolName.startsWith(prefix) && toolName.length > prefix.length) return resolvedTool(gate, toolName.slice(prefix.length));
-  return legacyToolOf(toolName, entries);
-}
-
-function legacyToolOf(toolName: string, entries: readonly ConnectorGate[]): { gate: ConnectorGate; tool: string } | undefined {
-  if (!toolName.startsWith('mcp__metro_box_')) return undefined;
-  const legacy = entries.filter((gate) => !isOrgRelayId(gate.id) && toolName.startsWith(`mcp__${normalized(`metro.box ${gate.name}`)}__`));
-  const gate = legacy.length === 1 ? legacy[0] : undefined;
-  if (gate === undefined) return undefined;
-  const called = toolName.slice(`mcp__${normalized(`metro.box ${gate.name}`)}__`.length);
-  return called === '' ? undefined : resolvedTool(gate, called);
+  return undefined;
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-adopt.ts

@@ -0,0 +1,57 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { agentsDir } from '../agents/files.js';
+import { isOrgRelayId, orgRelayId } from './relay-id.js';
+import { readServerKeys, writeServerKeys } from './server-keys.js';
+
+interface Alias {
+  sourceId: string;
+  relayId: string;
+}
+
+function recordsOf(dir: string): unknown[] {
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(join(dir, 'connector-migrations.json'), 'utf8'));
+  } catch (err) {
+    if (isRecord(err) && err.code === 'ENOENT') return [];
+    log.warn({ err: errMsg(err) }, 'connectors: the old migration records could not be read; server keys left as they are');
+    return [];
+  }
+  if (isRecord(raw) && raw.version === 1 && Array.isArray(raw.records)) return raw.records;
+  log.warn('connectors: the old migration records are not valid; server keys left as they are');
+  return [];
+}
+
+function aliasOf(record: unknown): Alias[] {
+  if (!isRecord(record) || record.phase !== 'active' || typeof record.sourceId !== 'string' || typeof record.destinationId !== 'string') return [];
+  const relayId = orgRelayId(record.destinationId);
+  return isOrgRelayId(relayId) && record.sourceId !== relayId ? [{ sourceId: record.sourceId, relayId }] : [];
+}
+
+export function adoptOrgServerKeys(dir = agentsDir()): number {
+  try {
+    const aliases = recordsOf(dir).flatMap(aliasOf);
+    if (aliases.length === 0) return 0;
+    const keys = readServerKeys(dir);
+    if (keys === undefined) return 0;
+    let moved = 0;
+    for (const { sourceId, relayId } of aliases) {
+      const key = keys.get(sourceId);
+      if (key === undefined || keys.has(relayId)) continue;
+      keys.delete(sourceId);
+      keys.set(relayId, key);
+      moved += 1;
+    }
+    if (moved > 0) {
+      writeServerKeys(keys, dir);
+      log.info({ moved }, 'connectors: server keys moved to organization connector ids, tool names unchanged');
+    }
+    return moved;
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'connectors: the server keys could not be moved to organization connector ids');
+    return 0;
+  }
+}