@stage-labs/metro 0.1.0-beta.317 → 0.1.0-beta.318

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.317",
+  "version": "0.1.0-beta.318",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/daemon/src/mcp/server-approvals.ts

@@ -46,10 +46,16 @@ const noticeText = (tool: string, id: string, behavior: Behavior): string =>
 
 const requestedAt = (at: number, now = Date.now()): number => (Number.isFinite(at) && at > 0 ? Math.min(at, now) : now);
 
+const askedBy = (approval: McpApproval): string => {
+  if (approval.origin !== 'key') return '';
+  return approval.keyLabel === undefined ? ' (from an access key)' : ` (from an access key: ${approval.keyLabel})`;
+};
+
 interface Held {
   id: string;
   tool: string;
   line: string | undefined;
+  tellAgent: boolean;
   answer: (decision: McpDecision) => Promise<AnswerOutcome>;
   publish: (event: MetroEvent) => void;
 }
@@ -60,6 +66,10 @@ async function deliver(held: Held, behavior: Behavior): Promise<void> {
     log.info({ id: held.id, outcome }, 'mcp-server: the answer was not taken, so the agent is not told');
     return;
   }
+  if (!held.tellAgent) {
+    log.info({ id: held.id }, 'mcp-server: the call came with an access key, not from this agent\'s session, so the agent is not told');
+    return;
+  }
   const line = noticeLineFor(held.line);
   if (line === undefined) {
     log.warn({ id: held.id }, 'mcp-server: no chat is known to tell the agent the answer');
@@ -91,15 +101,15 @@ export function holdServerApproval(approval: McpApproval, answer: Held['answer']
   const tool = `${approval.connector}.${approval.tool}`;
   const announced = announcedLine(approval.id);
   const line = announced ?? promptLineFor(approval.id);
-  const held: Held = { id: approval.id, tool, line, answer, publish };
+  const held: Held = { id: approval.id, tool, line, tellAgent: approval.origin !== 'key', answer, publish };
   holdPrompt(
     { requestId: approval.id, tool, description: approval.connector, preview: approval.preview, line, at: requestedAt(approval.requestedAt), origin: 'mcp-server' },
     owner,
     sender(held),
     line === undefined ? undefined : async (text) => metroSend(line, text),
   );
-  log.info({ id: approval.id, tool, inChat: line !== undefined, announced: announced !== undefined }, 'mcp-server: an approval is waiting for the owner');
-  if (line !== undefined && announced === undefined) announce(approval.id, line, serverPromptBody({ requestId: approval.id, tool, preview: approval.preview }));
+  log.info({ id: approval.id, tool, origin: approval.origin ?? null, inChat: line !== undefined, announced: announced !== undefined }, 'mcp-server: an approval is waiting for the owner');
+  if (line !== undefined && announced === undefined) announce(approval.id, line, serverPromptBody({ requestId: approval.id, tool: `${tool}${askedBy(approval)}`, preview: approval.preview }));
   return true;
 }
 

package/runtime/node_modules/@metro-labs/http/src/mcp-server-protocol.ts

@@ -27,12 +27,18 @@ export interface McpCall {
   approval?: string;
 }
 
+type McpApprovalOrigin = 'box' | 'key';
+
+const KEY_LABEL_MAX = 64;
+
 export interface McpApproval {
   id: string;
   connector: string;
   tool: string;
   preview: string;
   requestedAt: number;
+  origin?: McpApprovalOrigin;
+  keyLabel?: string;
 }
 
 export type McpDecision = 'allow' | 'deny';
@@ -70,9 +76,16 @@ export function mcpTokenHashOf(raw: unknown): string {
   return raw.tokenHash;
 }
 
+function originOf(raw: Record<string, unknown>): Pick<McpApproval, 'origin' | 'keyLabel'> {
+  if (raw.origin === 'box') return { origin: 'box' };
+  if (raw.origin !== 'key') return {};
+  const label = typeof raw.keyLabel === 'string' ? raw.keyLabel.replace(/\p{Cc}/gu, '').trim() : '';
+  return label === '' || label.length > KEY_LABEL_MAX ? { origin: 'key' } : { origin: 'key', keyLabel: label };
+}
+
 function approvalOf(raw: unknown): McpApproval | null {
   if (!isRecord(raw) || typeof raw.id !== 'string' || !MCP_APPROVAL_ID_RE.test(raw.id) || typeof raw.connector !== 'string' || typeof raw.tool !== 'string' || typeof raw.preview !== 'string' || typeof raw.requestedAt !== 'number') return null;
-  return { id: raw.id, connector: raw.connector, tool: raw.tool, preview: raw.preview, requestedAt: raw.requestedAt };
+  return { id: raw.id, connector: raw.connector, tool: raw.tool, preview: raw.preview, requestedAt: raw.requestedAt, ...originOf(raw) };
 }
 
 export function mcpApprovalsOf(raw: unknown): McpApproval[] {

package/runtime/node_modules/@metro-labs/http/src/mcp-server-tools.ts

@@ -61,19 +61,30 @@ export const toolSearchDescription = (keys: string[] | null): string =>
     'Results are full definitions (name, description and the JSON schema of the arguments) in a <functions> block. Each name is <connector>.<tool>: pass it exactly as "tool" to tool_call. Tools the owner blocked are never returned.',
   ].join('\n');
 
-export const TOOL_CALL_DESCRIPTION = [
-  'Run connector tools that tool_search found. Always find a tool with tool_search first: its exact name and argument schema come from there.',
-  `Shape: ${TOOL_CALL_EXAMPLE}`,
-  `Up to ${String(MCP_CALLS_MAX)} independent calls run in parallel in one tool_call and are answered in order. Each result starts with "[n] <connector>.<tool>", then the tool's own content, or one line saying why it did not run:`,
-  '- not_found: no such connector or tool here. Run tool_search, then use a name it returned.',
-  '- needs_approval: the owner was asked in chat and on metro.box. Tell the person what is waiting, wait for the channel message "Approved: <tool> (<id>)", then call again with the same tool and arguments plus "approval": "<id>". An approval works once.',
-  '- denied or blocked: the owner refused or blocked this call. Do not retry it.',
-  '- signin: the connector must be signed in again. Tell the owner to do it on the organization\'s Connectors page on metro.box.',
-  '- unavailable: the connector or Metro could not be reached. Try again later.',
-  '- vendor_error: the connector answered with its own error, shown as it came.',
-].join('\n');
+export type ApprovalPlace = 'session' | 'page' | 'owner';
 
-export function mcpServerTools(keys: string[] | null): McpServerTool[] {
+const NEEDS_APPROVAL: Record<ApprovalPlace, string> = {
+  session: '- needs_approval: the owner was asked in chat and on metro.box. Tell the person what is waiting, wait for the channel message "Approved: <tool> (<id>)", then call again with the same tool and arguments plus "approval": "<id>". An approval works once.',
+  page: '- needs_approval: the owner must approve it on this agent\'s page on metro.box. Tell the person what is waiting and ask them to approve it there, then call again with the same tool and arguments plus "approval": "<id>". An approval works once, within 10 minutes of the answer.',
+  owner: '- needs_approval: the agent\'s owner was asked in chat and on its page on metro.box. Tell the person what is waiting; once it is approved, call again with the same tool and arguments plus "approval": "<id>". An approval works once, within 10 minutes of the answer.',
+};
+
+const toolCallDescription = (place: ApprovalPlace): string =>
+  [
+    'Run connector tools that tool_search found. Always find a tool with tool_search first: its exact name and argument schema come from there.',
+    `Shape: ${TOOL_CALL_EXAMPLE}`,
+    `Up to ${String(MCP_CALLS_MAX)} independent calls run in parallel in one tool_call and are answered in order. Each result starts with "[n] <connector>.<tool>", then the tool's own content, or one line saying why it did not run:`,
+    '- not_found: no such connector or tool here. Run tool_search, then use a name it returned.',
+    NEEDS_APPROVAL[place],
+    '- denied or blocked: the owner refused or blocked this call. Do not retry it.',
+    '- signin: the connector must be signed in again. Tell the owner to do it on the organization\'s Connectors page on metro.box.',
+    '- unavailable: the connector or Metro could not be reached. Try again later.',
+    '- vendor_error: the connector answered with its own error, shown as it came.',
+  ].join('\n');
+
+export const TOOL_CALL_DESCRIPTION = toolCallDescription('session');
+
+export function mcpServerTools(keys: string[] | null, place: ApprovalPlace = 'session'): McpServerTool[] {
   return [
     {
       name: TOOL_SEARCH,
@@ -85,7 +96,7 @@ export function mcpServerTools(keys: string[] | null): McpServerTool[] {
     {
       name: TOOL_CALL,
       title: 'Call connector tools',
-      description: TOOL_CALL_DESCRIPTION,
+      description: toolCallDescription(place),
       inputSchema: callSchema,
       annotations: { title: 'Call connector tools', readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     },

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.317"
+  "version": "0.1.0-beta.318"
 }

package/runtime/sdk-runner/runner.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-beta.317",
+  "version": "0.1.0-beta.318",
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.287",
     "@modelcontextprotocol/sdk": "^1.29.0",